26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 57:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4ea,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Lazy.Generic Sample 492f63a1bbea… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 492f63a1bbea…. Malware family: Lazy.Generic. Threat score 100/100. 17/28 AV engines flagged this file. 18 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b","keywords":["Malicious","Lazy.Generic","malware analysis","sandbox report","threat intelligence","492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b"],"about":{"@type":"SoftwareApplication","name":"GZD24070024 到貨 - 31677(WIS36)-308-12814975,76,308-12823182,3326,308-12831767,1774,6329,6332-PL.pdf.scr","applicationCategory":["peexe","assembly","executable"],"identifier":"492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Lazy.Generic","antivirusDetections":{"malicious":17,"total":28},"behavioralIndicators":{"malicious":18,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T873,Found reference to API "System.Runtime.InteropServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "set_ReadOnly" (Indicator: "read"; Source: "sample.bin"), Found reference to API "SELECT ProductCode FROM Products ORDER BY ProductCode" (Indicator: "select"; Source: "sample.bin"), Found reference to API "GetWaitTimeForErrorCount" (Indicator: "time"; Source: "sample.bin"), Found reference to API "IsDateTime" (Indicator: "time"; Source: "sample.bin"), Found reference to API "ExecuteReader" (Indicator: "read"; Source: "sample.bin"), Found reference to API "state" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "System.Threading" (Indicator: "read"; Source: "sample.bin"), Found reference to API "set_TabIndex" (Indicator: "bind"; Source: "sample.bin"), Found reference to API "ReadToEnd" (Indicator: "read"; Source: "sample.bin"), Found reference to API "EditorBrowsableState" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "btnAccept_Click" (Indicator: "accept"; Source: "sample.bin"), Found reference to API "DbConnection" (Indicator: "connect"; Source: "sample.bin"), Found reference to API "get_StatusCode" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "SecurityAction" (Indicator: "security"; Source: "sample.bin"), Found reference to API "System.Runtime.Versioning" (Indicator: "time"; Source: "sample.bin"), Found reference to API "SqlDataReader" (Indicator: "read"; Source: "sample.bin"), Found reference to API "SecurityPermissionAttribute" (Indicator: "security"; Source: "sample.bin"), Found reference to API "RequestTimeout" (Indicator: "time"; Source: "sample.bin"), Found reference to API "GetConnection" (Indicator: "connect"; Source: "sample.bin"), Found reference to API "btnAccept" (Indicator: "accept"; Source: "sample.bin"), Found reference to API "RuntimeCompatibilityAttribute" (Indicator: "time"; Source: "sample.bin"), Found reference to API "Synchronized" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "btnClose_Click" (Indicator: "close"; Source: "sample.bin"), Found reference to API "Read" (Indicator: "read"; Source: "sample.bin")28:T1585,Found reference string "Policy Bypass Add-MpPreference -ExclusionPath '" (Indicator: "add-mppreference"; File: "00005628.000015FC.9201103.00402000.wprm") Found reference string ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\492f63a1bb" (Indicator: "add-mppreference"; Source: "00000000-00005628-00000C47-17438562898") Found reference string ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '492f63a1bb" (Indicator: "add-mppreference"; Source: "00000000-00005628-00000C47-35255699922") Found reference string ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\HAPU" (Indicator: "add-mppreference"; Source: "00000000-00005628-00000C47-67671428754") Found reference string ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.ex" (Indicator: "add-mppreference"; Source: "00000000-00005628-00000C47-86554589918") Found reference string "-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe'" (Indicator: "add-mppreference"; File: "powershell.exe") Found reference string "-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe'" (Indicator: "add-mppreference"; File: "powershell.exe") Found reference string "-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%APPDATA%\XClient.exe'" (Indicator: "add-mppreference"; File: "powershell.exe") Found reference string "-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'" (Indicator: "add-mppreference"; File: "powershell.exe") Found reference string "ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe'" (Indicator: "add-mppreference"; Source: "00000000-00005628.00000000.76467.00550000.00000004.mdmp") Found reference string "-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '" (Indicator: "add-mppreference"; Source: "00000000-00005628.00000000.76467.01B40000.00000004.mdmp, 00000000-00005628.00000001.78389.01B40000.00000004.mdmp, 00000000-00005628.00000002.80314.01B40000.00000004.mdmp") Found reference string "-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '" (Indicator: "add-mppreference"; Source: "00000000-00005628.00000000.76467.01B40000.00000004.mdmp, 00000000-00005628.00000001.78389.01B40000.00000004.mdmp, 00000000-00005628.00000002.80314.01B40000.00000004.mdmp") Found reference string "-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe'" (Indicator: "add-mppreference"; Source: "00000000-00005628.00000000.76467.01B40000.00000004.mdmp, 00000000-00005628.00000001.78389.01B40000.00000004.mdmp") Found reference string "ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '" (Indicator: "add-mppreference"; Source: "00000000-00005628.00000001.78389.00400000.00000040.mdmp") Found reference string "ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '" (Indicator: "add-mppreference"; Source: "00000000-00005628.00000001.78389.00400000.00000040.mdmp") Found reference string "xecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\HAPUBWS\AppData\Roaming\XClient.exe'" (Indicator: "add-mppreference"; Source: "00000000-00005628.00000001.78389.00550000.00000004.mdmp") Found reference string "ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe'" (Indicator: "add-mppreference"; Source: "00000000-00005628.00000001.78389.00550000.00000004.mdmp") Found reference string "-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe'" (Indicator: "add-mppreference"; Source: "00000000-00005628.00000001.78389.01B40000.00000004.mdmp") Found reference string "-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\HAPUBWS\AppData\Roaming\XClient.exe'" (Indicator: "add-mppreference"; Source: "00000000-00005628.00000001.78389.01B40000.00000004.mdmp") Found reference string "ecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b" (Indicator: "add-mppreference"; Source: "00000000-00005628.00000002.80314.01B40000.00000004.mdmp") Found reference string "-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27bx" (Indicator: "add-mppreference"; Source: "00000000-00005628.00000002.80314.01B40000.00000004.mdmp") Found reference string "-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\HAPUBWS\AppData\Roaming\XClient.H" (Indicator: "add-mppreference"; Source: "00000000-00005628.00000002.80314.01B40000.00000004.mdmp") Found reference string "-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'" (Indicator: "add-mppreference"; Source: "00000000-00005628.00000002.80314.01B40000.00000004.mdmp") Found reference string "indows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'" (Indicator: "add-mppreference"; Source: "00000000-00005628.00000002.80314.045F0000.00000004.mdmp")29:T5df,"492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\SHELLFOLDER") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\SHELLFOLDER") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\SHELLFOLDER") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER")2a:Tdf9,"492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" queried SystemProcessInformation at 00000000-00005628-00000105-46775905 [PID: 5628] "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" queried SystemProcessInformation at 00000000-00005628-00000105-48939231 [PID: 5628] "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" queried SystemProcessInformation at 00000000-00005628-00000105-48939621 [PID: 5628] "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" queried SystemProcessInformation at 00000000-00005628-00000105-49075531 [PID: 5628] "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" queried SystemProcessInformation at 00000000-00005628-00000105-49078152 [PID: 5628] "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" queried SystemProcessInformation at 00000000-00005628-00000105-49078465 [PID: 5628] "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" queried SystemProcessInformation at 00000000-00005628-00000105-49229882 [PID: 5628] "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" queried SystemProcessInformation at 00000000-00005628-00000105-79395472 [PID: 5628] "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" queried SystemProcessInformation at 00000000-00005628-00000105-79395865 [PID: 5628] "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" queried SystemProcessInformation at 00000000-00005628-00000105-79580942 [PID: 5628] "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" queried SystemProcessInformation at 00000000-00005628-00000105-109558815 [PID: 5628] "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" queried SystemProcessInformation at 00000000-00005628-00000105-109559145 [PID: 5628] "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" queried SystemProcessInformation at 00000000-00005628-00000105-109713845 [PID: 5628] "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" queried SystemProcessInformation at 00000000-00005628-00000105-139691526 [PID: 5628] "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" queried SystemProcessInformation at 00000000-00005628-00000105-139691868 [PID: 5628] "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" queried SystemProcessInformation at 00000000-00005628-00000105-139877608 [PID: 5628] "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" queried SystemProcessInformation at 00000000-00005628-00000105-169855485 [PID: 5628] "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" queried SystemProcessInformation at 00000000-00005628-00000105-169855796 [PID: 5628] "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" queried SystemProcessInformation at 00000000-00005628-00000105-170010494 [PID: 5628] "powershell.exe" queried SystemProcessInformation at 00000000-00005984-00000105-2387770 [PID: 5984] "powershell.exe" queried SystemProcessInformation at 00000000-00005984-00000105-2536434 [PID: 5984] "powershell.exe" queried SystemProcessInformation at 00000000-00005984-00000105-3620555 [PID: 5984] "powershell.exe" queried SystemProcessInformation at 00000000-00005892-00000105-2733839 [PID: 5892] "powershell.exe" queried SystemProcessInformation at 00000000-00005892-00000105-2889867 [PID: 5892] "powershell.exe" queried SystemProcessInformation at 00000000-00005892-00000105-4177980 [PID: 5892]2b:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIbVQYJKoZIhvcNAQcCoIIbRjCCG0ICAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQU+zz3vaNz0s6W8CREgPojmh03NLSgghYqMIIEEjCCAvqgAwIBAgIPAMEAizw8iBHRPvZj7N9AMA0GCSqGSIb3DQ" "cchString": "9628" "dwFlags": "1" "pbBinary": "30821b5506092a864886f70d010702a0821b4630821b42020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414fb3cf7bda373d2ce96f0244480fa239a1d3734b4a082162a30820412308202faa003020102020f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d01010405003070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479301e170d3937303131303037303030305a170d3230313233313037303030305a3070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a902bdc170e63bf24e1b289f97785e30eaa2a98d255ff8fe954ca3b7fe9da2203e7c51a29ba28f60326bd1426479eeac76c954daf2eb9c861c8f9f8466b3c56b7a6223d61d3cde0f0192e896c4bf2d669a9a682699d03a2cbf0cb55826c146e70a3e38962ca92839a8ec498342e3840fbb9a6c5561ac827ca1602d774ce999b4643b9a501c310824149fa9e7912b18e63d986314605805659f1d375287f7a7ef9402c61bd3bf5545b38980bf3aec54944eaefda77a6d744eaf18cc96092821005790606937bb4b12073c56ff5bfba4660a08a6d2815657efb63b5e16817704daf6beae8095feb0cd7fd6a71a725c3ccabcf008a32230b30685c9b320771385df0203010001a381a83081a53081a20603551d0104819a30819780105bd070ef69729e23517e14b24d8effcba1723070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479820f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d0101040500038201010095e80bc08df3971835edb80124d87711f35c60329f9e0bcb3e0591888fc93ae621f2f057932cb5a047c862effcd7cc3b3b5aa9365469fe246d3fc9ccaade057cdd318d3d9f10706abbfe124f1869c0fcd043e311" "pcbBinary": "591b0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIbVQYJKoZIhvcNAQcCoIIbRjCCG0ICAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9628" "dwFlags": "1" "pbBinary": "30821b5506092a864886f70d010702a0821b4630821b42020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414fb3cf7bda373d2ce96f0244480fa239a1d3734b4a082162a30820412308202faa003020102020f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d01010405003070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479301e170d3937303131303037303030305a170d3230313233313037303030305a3070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a902bdc170e63bf24e1b289f97785e30eaa2a98d255ff8fe954ca3b7fe9da2203e7c51a29ba28f60326bd1426479eeac76c954daf2eb9c861c8f9f8466b3c56b7a6223d61d3cde0f0192e896c4bf2d669a9a682699d03a2cbf0cb55826c146e70a3e38962ca92839a8ec498342e3840fbb9a6c5561ac827ca1602d774ce999b4643b9a501c310824149fa9e7912b18e63d986314605805659f1d375287f7a7ef9402c61bd3bf5545b38980bf3aec54944eaefda77a6d744eaf18cc96092821005790606937bb4b12073c56ff5bfba4660a08a6d2815657efb63b5e16817704daf6beae8095feb0cd7fd6a71a725c3ccabcf008a32230b30685c9b320771385df0203010001a381a83081a53081a20603551d0104819a30819780105bd070ef69729e23517e14b24d8effcba1723070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479820f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d0101040500038201010095e80bc08df3971835edb80124d87711f35c60329f9e0bcb3e0591888fc93ae621f2f057932cb5a047c862effcd7cc3b3b5aa9365469fe246d3fc9ccaade057cdd318d3d9f10706abbfe124f1869c0fcd043e311" "pcbBinary": "591b0000" "pdwFlags": "01000000"}2c:T5a5,Assembly shows XOR instruction xor dl byte ptr [eax+1A2A01A6h] in Stream UID: 00000000-00005628-36888-1-004137EE Assembly shows XOR instruction xor eax dword ptr [ebp+02h] in Stream UID: 00000000-00005628-36888-1-004137EE Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00005628-36888-1-004137EE Assembly shows XOR instruction xor byte ptr [eax] al in Stream UID: 00000000-00005628-36888-1-004137EE Assembly shows XOR instruction xor dword ptr [eax] eax in Stream UID: 00000000-00005628-36888-1-004137EE Assembly shows XOR instruction xor al byte ptr [eax] in Stream UID: 00000000-00005628-36888-1-004137EE Assembly shows XOR instruction xor eax dword ptr [eax] in Stream UID: 00000000-00005628-36888-1-004137EE Assembly shows XOR instruction xor al 00h in Stream UID: 00000000-00005628-36888-1-004137EE Assembly shows XOR instruction xor eax 1A2A7000h in Stream UID: 00000000-00005628-36888-1-004137EE Assembly shows XOR instruction xor dword ptr [ecx] eax in Stream UID: 00000000-00005628-36888-1-004137EE Assembly shows XOR instruction xor byte ptr [edx] al in Stream UID: 00000000-00005628-36888-1-004137EE Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00005628-36888-13-00405DE4 Assembly shows XOR instruction xor al 25h in Stream UID: 00000000-00005628-36888-13-00405DE4 Assembly shows XOR instruction xor bh byte ptr [ebx] in Stream UID: 00000000-00005628-36888-13-00405DE42d:T484,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decode base64 data Matched sigs: Able to decrypt/decode data Matched sigs: Able to perform cryptographic operations Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains reference to crypto DLLs Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains reference to cryptographic keys Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - AES encryption Matched sigs: YARA signature match - Customized RC4 encryption for MSIL2e:T808,Found XOR loop in file "XClient.exe" at offset 221402; code bytes = 30d0 Found XOR loop in file "XClient.exe" at offset 248839; code bytes = 30d0 Found XOR loop in file "XClient.exe" at offset 164912; code bytes = 33c1 Found XOR loop in file "XClient.exe" at offset 189260; code bytes = 33c1 Found XOR loop in file "XClient.exe" at offset 457596; code bytes = 33c1 Found XOR loop in file "XClient.exe" at offset 476711; code bytes = 33c1 Found XOR loop in file "XClient.exe" at offset 155648; code bytes = 8030 Found XOR loop in file "XClient.exe" at offset 192142; code bytes = 8030 Found XOR loop in file "XClient.exe" at offset 192539; code bytes = 8030 Found XOR loop in file "XClient.exe" at offset 226221; code bytes = 8030 Found XOR loop in file "XClient.exe" at offset 234941; code bytes = 8030 Found XOR loop in file "XClient.exe" at offset 247605; code bytes = 8030 Found XOR loop in file "XClient.exe" at offset 312802; code bytes = 8030 Found XOR loop in file "XClient.exe" at offset 384949; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 221402; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 248839; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 164912; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 189260; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 457596; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 476711; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 155648; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 192142; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 192539; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 226221; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 234941; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 247605; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 312802; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 384949; code bytes = 80302f:T80e,"492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000001400000000000000000000000000000000000000000000000200000248364100216f004e0000000000000000000000008000000000000000216f004ee07641000100000000000000020000000c000000b82e4100b82e4100b32e4100000000000000000000003c0000000001b0ee2d0000000000d0f42d0095e16777b76f0900feffffff435c6b7750596b7794000000a0000000b22e4100b02e41009400000054f02d00fdfe247634e92d0001000000d0f42d0092e01672015d8599feffffffecef2d004c9c16725c0c000000f02d005f9c16720000000000000000 (UID: 00000000-00005672)30:T211c,"492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000001005c00530058e2400011000011c67d00005092410048364100b1080000aaa8640000200000b0080000580f00000d004200a2000000b1080000a1000000a1080000c9570000000000000000000036a8ffff5c00500000000000b1080000 (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310076f5f66b772b9a4f77f42ee371303e4000a035e3711b9a4f77dce72d00a0174000b2f46b770b9a4f77ece72d000000dc710000dc710000000048e72d00f0000000f000dc710000000058e72d0053000000ece82d000000000001000000bce72d0040f56b770000000000000000a8e72d00 (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c47007418da47008c4700740000000018da4700c4dc2d00086d6b77188173770000000078dd2d0000000000de54d56404dd2d0095e167775f6c0900feffffff6b2c6c7731195d75021000000000000000000100d8dc2d00c89f6b778c4700740000000000000000 (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000001005c00530058fc58000f00010efb89000e63006f006e00660069006700750072006100740069006f006e00000055004200570053005c0041000b00000b8189000058fc580050f758006f00630061006c005c00500072006f0067007200 (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb7f77f0cc60000030fd7f9a5c6c7700f0fd7f94b729004430fd7f00000000400000003f0000002b0000000030fd7f88b72900c15c6c77608273772b0000000030fd7f9a5c6c7700f0fd7facb7290057896b778083737713175d75d8eb7f77 (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f01a1c7208000000c41a1c722f862c6302000000d41c1c7200002a00e6161c72d09bba00c09bba00c0d32900d0f01d7280d4290053af1d72134f1911feffffffc41a1c72421a1c72e6161c7214d42900d91b1c72e6161c7267c1c975ae056075745760750000000000000000cc925c75 (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000600000001000000b11d00000200000053657276696365205061636b20310000f01a1c7208000000c41a1c722f862c6302000000d41c1c7200002a00020000000000000088000000c0d3290000d42900459dc9750000ba0000000000800000000200000000002a0098131f7214d42900 (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310076f5f66b779f4fd873f42ee37108c76004a035e3716f4cd87344eeb90448165900b2f46b777f4cd87354eeb9040000dc710000dc7100000000b0edb904f0000000f000dc7100000000c0edb9045300000054efb904000000000100000024eeb90440f56b77000000000000000010eeb904 (UID: 00000000-00005628) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000000000000010000000100000000000000000000002d0063006f00720000000000000000000000000000000000010000002f000000000000000000000064006c006c0000006500780007000007c9c1000000000000000f45000000000000000000000000000000000000000000 (UID: 00000000-00005984) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000095e16777bbb40a00fefffffff5f66b77634d6c77681e44001015917088089100b2f46b777f50fc7784ec9d000000907000009070804d6c771b50fc77f0000000f000907000000000f0eb9d005c00430084ed9d00000000000100000054ec9d0040f56b77000000000000000040ec9d00 (UID: 00000000-00005984) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310072f0eb9d0001000000000000000000d47500000000dceb9d00000000000000000000000000f0eb9d00000000000000000000000000f88fbaf7e4eb9d000300000000000000880000000000d475f0eb9d00459dc9750000ae0000000000800000000200000000009e00dc1a907004ec9d00 (UID: 00000000-00005984) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005984) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb7f77b010240400f0fd7f9a5c6c7700f0fa7f70d5ea0444f0fd7f00000000400000003f0000002500000000f0fd7f64d5ea04c15c6c77608273772500000000f0fd7f9a5c6c7700f0fa7f88d5ea0457896b778083737713175d75d8eb7f77 (UID: 00000000-00005984) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000240000000200000000000000000000005a7321001100000000000000000000002200000000000000000000000f00010ed01e000e63006f006e00660069006700750072006100740069006f006e0000005c00500072006f006700720061006d0073005c0050007900740068006f006e00 (UID: 00000000-00005892) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000095e16777ebd30a00fefffffff5f66b77634d6c77681e20001015217288082100b2f46b775f371477b4ec75000000207200002072804d6c777b371477f0000000f00020720000000020ec75005c004300b4ed7500000000000100000084ec750040f56b77000000000000000070ec7500 (UID: 00000000-00005892) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007220ec750001000000000000000000d475000000000cec750000000000000000000000000020ec75000000000000000000000000001707676514ec75000300000000000000880000000000d47520ec7500459dc9750000350000000000800000000200000000007600dc1a207234ec7500 (UID: 00000000-00005892) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005892) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb7f7788adf00300f0fd7f9a5c6c7700f0fa7fa0d2eb0444f0fd7f00000000400000003f0000002500000000f0fd7f94d2eb04c15c6c77608273772500000000f0fd7f9a5c6c7700f0fa7fb8d2eb0457896b778083737713175d75d8eb7f77 (UID: 00000000-00005892) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000024000000020000000000000000000000028b2b001100000000000000000000002200000000000000000000000f00010e8a39000e63006f006e00660069006700750072006100740069006f006e0000005c00500072006f006700720061006d0073005c0050007900740068006f006e00 (UID: 00000000-00001596)31:T754,"powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")32:T1314,"492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" queries volume information of "C:\492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" at 00000000-00005672-0000010C-3199868 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" queries volume information of "C:\492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" at 00000000-00005628-0000010C-2961121 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" queries volume information of an entire harddrive"C:\" at 00000000-00005628-0000010C-44978378 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\XClient.exe" at 00000000-00005628-0000010C-45994115 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00005984-0000010C-2635613 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00005984-0000010C-3088995 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00005984-0000010C-3434943 "powershell.exe" queries volume information of "C:\share" at 00000000-00005984-0000010C-3436175 "powershell.exe" queries volume information of "C:\share" at 00000000-00005984-0000010C-3507744 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll" at 00000000-00005984-0000010C-4588076 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll" at 00000000-00005984-0000010C-4594556 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll" at 00000000-00005984-0000010C-4597892 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll" at 00000000-00005984-0000010C-4601419 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.dll" at 00000000-00005984-0000010C-4604728 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll" at 00000000-00005984-0000010C-4826869 "powershell.exe" queries volume information of "C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll" at 00000000-00005984-0000010C-4941350 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll" at 00000000-00005984-0000010C-6478795 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll" at 00000000-00005984-0000010C-6484239 "powershell.exe" queries volume information of "C:\Program Files\AutoIt3\AutoItX\AutoItX3.PowerShell.dll" at 00000000-00005984-0000010C-6521127 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00005892-0000010C-2975319 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00005892-0000010C-3578310 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00005892-0000010C-3861760 "powershell.exe" queries volume information of "C:\share" at 00000000-00005892-0000010C-3863075 "powershell.exe" queries volume information of "C:\share" at 00000000-00005892-0000010C-3948379 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll" at 00000000-00005892-0000010C-492496033:T426,"492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "APPENDPATH") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "PATH") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\492F63A1BBEAAB365148DE239CD17F2A298C3EF421D95A4C2AE34B678C1EA27B.EXE") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\492F63A1BBEAAB365148DE239CD17F2A298C3EF421D95A4C2AE34B678C1EA27B.EXE")34:T5a7,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")35:T698,"492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00005628) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00005984) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00005984) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00005892) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00005892) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00001596) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00001596) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002492) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00002492)36:T506,"492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "CreateProcessA" with parameter "C:\492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" - (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\492f63a1bb" - (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '492f63a1bb" - (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\HAPU" - (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.ex" - (UID: 00000000-00005628)37:T12f43,"492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter WindowsCodecs.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter sxs.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter SXS.DLL (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00005628) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005628) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pb378ec07#\d254c63bedcb76c81c3125bd527b7d1a\Microsoft.PowerShell.ConsoleH (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\73a1a80aed03e789a49cec899b7505dd\System.Management.Automation. (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automatio (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter MSISIP.DLL (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wshext.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WindowsPowerShell\v1.0\pwrshsip.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\df2dd09ed7c341842a104e1e668f184e\System.Data.ni.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Dired13b18a9#\2e76676fbd265f70be92c82bbf76b8e5\System.DirectoryServices.ni.d (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f792626#\05765f777020deeddc8ad54b48343b9c\Microsoft.PowerShell.Security (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\f0821980bfe2fc8375ccfc37dbe6e9d8\Microsoft.Management.Infrastr (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Numerics\e7d6ed984300c7212c6e682c4f730b1e\System.Numerics.ni.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\f73f48afb5512225dedaee9c88ac5050\Microsoft.CSharp.ni.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.M870d558a#\7ceb6b903321c16b12386a8df1be50f9\Microsoft.Management.Infrastr (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pae3498d9#\8dcf1daed985f481eed5cca9d2945c18\Microsoft.PowerShell.Commands (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Confe64a9051#\1561b93d6d25c4a9c3e2659ab29a5e73\System.Configuration.Install. (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.DLL (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005984) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pb378ec07#\d254c63bedcb76c81c3125bd527b7d1a\Microsoft.PowerShell.ConsoleH (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\73a1a80aed03e789a49cec899b7505dd\System.Management.Automation. (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automatio (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter MSISIP.DLL (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wshext.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WindowsPowerShell\v1.0\pwrshsip.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\df2dd09ed7c341842a104e1e668f184e\System.Data.ni.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Dired13b18a9#\2e76676fbd265f70be92c82bbf76b8e5\System.DirectoryServices.ni.d (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f792626#\05765f777020deeddc8ad54b48343b9c\Microsoft.PowerShell.Security (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\f0821980bfe2fc8375ccfc37dbe6e9d8\Microsoft.Management.Infrastr (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Numerics\e7d6ed984300c7212c6e682c4f730b1e\System.Numerics.ni.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\f73f48afb5512225dedaee9c88ac5050\Microsoft.CSharp.ni.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.M870d558a#\7ceb6b903321c16b12386a8df1be50f9\Microsoft.Management.Infrastr (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pae3498d9#\8dcf1daed985f481eed5cca9d2945c18\Microsoft.PowerShell.Commands (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Confe64a9051#\1561b93d6d25c4a9c3e2659ab29a5e73\System.Configuration.Install. (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.DLL (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter wshtcpip (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter wship6.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005892) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pb378ec07#\d254c63bedcb76c81c3125bd527b7d1a\Microsoft.PowerShell.ConsoleH (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\73a1a80aed03e789a49cec899b7505dd\System.Management.Automation. (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automatio (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter MSISIP.DLL (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wshext.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WindowsPowerShell\v1.0\pwrshsip.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\df2dd09ed7c341842a104e1e668f184e\System.Data.ni.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Dired13b18a9#\2e76676fbd265f70be92c82bbf76b8e5\System.DirectoryServices.ni.d (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f792626#\05765f777020deeddc8ad54b48343b9c\Microsoft.PowerShell.Security (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\f0821980bfe2fc8375ccfc37dbe6e9d8\Microsoft.Management.Infrastr (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Numerics\e7d6ed984300c7212c6e682c4f730b1e\System.Numerics.ni.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\f73f48afb5512225dedaee9c88ac5050\Microsoft.CSharp.ni.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.M870d558a#\7ceb6b903321c16b12386a8df1be50f9\Microsoft.Management.Infrastr (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pae3498d9#\8dcf1daed985f481eed5cca9d2945c18\Microsoft.PowerShell.Commands (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Confe64a9051#\1561b93d6d25c4a9c3e2659ab29a5e73\System.Configuration.Install. (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.DLL (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001596) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pb378ec07#\d254c63bedcb76c81c3125bd527b7d1a\Microsoft.PowerShell.ConsoleH (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\73a1a80aed03e789a49cec899b7505dd\System.Management.Automation. (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automatio (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter MSISIP.DLL (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wshext.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WindowsPowerShell\v1.0\pwrshsip.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\df2dd09ed7c341842a104e1e668f184e\System.Data.ni.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Dired13b18a9#\2e76676fbd265f70be92c82bbf76b8e5\System.DirectoryServices.ni.d (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f792626#\05765f777020deeddc8ad54b48343b9c\Microsoft.PowerShell.Security (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\f0821980bfe2fc8375ccfc37dbe6e9d8\Microsoft.Management.Infrastr (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Numerics\e7d6ed984300c7212c6e682c4f730b1e\System.Numerics.ni.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\f73f48afb5512225dedaee9c88ac5050\Microsoft.CSharp.ni.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.M870d558a#\7ceb6b903321c16b12386a8df1be50f9\Microsoft.Management.Infrastr (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pae3498d9#\8dcf1daed985f481eed5cca9d2945c18\Microsoft.PowerShell.Commands (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Confe64a9051#\1561b93d6d25c4a9c3e2659ab29a5e73\System.Configuration.Install. (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.DLL (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002492) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002492)38:Tb6a,":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00005628.00000001.78389.00550000.00000004.mdmp 00000000-00005628.00000002.80314.00550000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00005628.00000001.78389.00550000.00000004.mdmp 00000000-00005628.00000001.78389.006F0000.00000002.mdmp 00000000-00005628.00000002.80314.00550000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00005628.00000001.78389.00550000.00000004.mdmp 00000000-00005628.00000002.80314.00550000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00005628.00000001.78389.00550000.00000004.mdmp 00000000-00005628.00000001.78389.006F0000.00000002.mdmp 00000000-00005628.00000002.80314.00550000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\xclient.lnk") in Source: 00000000-00005628.00000002.80314.00550000.00000004.mdmp 00000000-00005628.00000002.80314.01B40000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00005628.00000002.80314.00550000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00005628.00000002.80314.00550000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00005628.00000002.80314.00550000.00000004.mdmp 00000000-00005628.00000002.80314.01B40000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClienth" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\xclienth") in Source: 00000000-00005628.00000002.80314.01B40000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\xclient") in Source: 00000000-00005628.00000002.80314.01B40000.00000004.mdmp39:T81b,"Software\" in Source: 00005628.000015FC.9201103.00402000.wprm "Software\" in Source: 00000000-00005628.00000000.76467.01B40000.00000004.mdmp 00000000-00005628.00000001.78389.01B40000.00000004.mdmp 00000000-00005628.00000002.80314.01B40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005628.00000000.76467.01B40000.00000004.mdmp 00000000-00005628.00000001.78389.01B40000.00000004.mdmp 00000000-00005628.00000002.80314.01B40000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005628.00000000.76467.01B40000.00000004.mdmp 00000000-00005628.00000001.78389.01B40000.00000004.mdmp 00000000-00005628.00000002.80314.01B40000.00000004.mdmp "Software\3113BFFBC90745CAE806" in Source: 00000000-00005628.00000000.76467.01B40000.00000004.mdmp 00000000-00005628.00000001.78389.01B40000.00000004.mdmp 00000000-00005628.00000002.80314.01B40000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005628.00000001.78389.00550000.00000004.mdmp 00000000-00005628.00000002.80314.00550000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005628.00000001.78389.00550000.00000004.mdmp 00000000-00005628.00000002.80314.00550000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00005628.00000002.80314.01B40000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00005628.00000002.80314.01B40000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005672.00000001.76193.003C0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005672.00000001.76193.003C0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005672.00000001.76193.003C0000.00000004.mdmp3a:T1855,"492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135]3b:T9e3,"Software\" in Source: 00000000-00005628.00000000.76467.01B40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005628.00000000.76467.01B40000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005628.00000000.76467.01B40000.00000004.mdmp "Software\3113BFFBC90745CAE806" in Source: 00000000-00005628.00000000.76467.01B40000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005628.00000001.78389.00550000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005628.00000001.78389.00550000.00000004.mdmp "Software\" in Source: 00000000-00005628.00000001.78389.01B40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005628.00000001.78389.01B40000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005628.00000001.78389.01B40000.00000004.mdmp "Software\3113BFFBC90745CAE806" in Source: 00000000-00005628.00000001.78389.01B40000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005628.00000002.80314.00550000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005628.00000002.80314.00550000.00000004.mdmp "Software\" in Source: 00000000-00005628.00000002.80314.01B40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005628.00000002.80314.01B40000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005628.00000002.80314.01B40000.00000004.mdmp "Software\3113BFFBC90745CAE806" in Source: 00000000-00005628.00000002.80314.01B40000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00005628.00000002.80314.01B40000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00005628.00000002.80314.01B40000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005672.00000001.76193.003C0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005672.00000001.76193.003C0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005672.00000001.76193.003C0000.00000004.mdmp3c:T62b0,"492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6a740000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 710a0000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "KERNEL32" at base 76200000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "ADVAPI32.DLL" at base 775b0000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6baa0000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "SHLWAPI.DLL" at base 77220000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "VERSION.DLL" at base 74a00000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 64c60000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "USER32.DLL" at base 75d80000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "MSCOREE.DLL" at base 6bb30000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "PSAPI.DLL" at base 75d60000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "RPCRT4.DLL" at base 759d0000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "KERNEL32.DLL" at base 76200000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63850000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "OLE32.DLL" at base 75b30000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "CRYPTBASE.DLL" at base 75460000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74030000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 74080000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 721b0000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62df0000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 6a590000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 61f80000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "UXTHEME.DLL" at base 74030000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 61760000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6a480000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 60fe0000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 72190000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "NTDLL.DLL" at base 77660000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "SHELL32.DLL" at base 762e0000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 774c0000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "PROFAPI.DLL" at base 75580000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "BCRYPT.DLL" at base 75080000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "CRYPTSP.DLL" at base 74f70000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74d00000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "IMM32.DLL" at base 75d40000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "COMCTL32.DLL" at base 71dc0000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "GDI32.DLL" at base 75a80000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 6a290000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "GDIPLUS.DLL" at base 73e90000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 73e90000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76200000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "WINDOWSCODECS.DLL" at base 73910000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "NTDLL" at base 77660000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75410000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 774c0000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "RPCRTREMOTE.DLL" at base 75500000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 644b0000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 630a0000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 74070000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6a6b0000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62640000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 61e20000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 6a4c0000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "SSPICLI.DLL" at base 753f0000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 72220000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "PROPSYS.DLL" at base 74090000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "COMCTL32.DLL" at base 74460000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "OLEAUT32.DLL" at base 77810000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "APPHELP.DLL" at base 75410000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "CLBCATQ.DLL" at base 75940000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6a8b0000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "SETUPAPI.DLL" at base 76030000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74090000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "NTMARTA.DLL" at base 749d0000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75590000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 75ee0000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "SECUR32.DLL" at base 75290000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 755a0000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "SXS.DLL" at base 75470000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 721f0000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 762e0000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6e9b0000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "LINKINFO.DLL" at base 6e9a0000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "NTSHRUI.DLL" at base 72260000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "SRVCLI.DLL" at base 75160000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "CSCAPI.DLL" at base 70d90000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "SLC.DLL" at base 73a60000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 6a310000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 60fb0000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6a200000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 64c90000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "WS2_32.DLL" at base 76f30000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74f30000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74a90000 "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74f20000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 77220000 "powershell.exe" loaded module "VERSION.DLL" at base 74a00000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 710a0000 "powershell.exe" loaded module "KERNEL32" at base 76200000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 644b0000 "powershell.exe" loaded module "USER32.DLL" at base 75d80000 "powershell.exe" loaded module "MSCOREE.DLL" at base 6bb30000 "powershell.exe" loaded module "PSAPI.DLL" at base 75d60000 "powershell.exe" loaded module "RPCRT4.DLL" at base 759d0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 76200000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 6bb30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 630a0000 "powershell.exe" loaded module "OLE32.DLL" at base 75b30000 "powershell.exe" loaded module "CRYPTBASE.DLL" at base 75460000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 77810000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62640000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 61e20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.PB378EC07#\D254C63BEDCB76C81C3125BD527B7D1A\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 72190000 "powershell.exe" loaded module "CRYPTSP.DLL" at base 74f70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74d00000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 775b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAA57FC8CC#\73A1A80AED03E789A49CEC899B7505DD\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 60330000 "powershell.exe" loaded module "NTDLL.DLL" at base 77660000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 72220000 "powershell.exe" loaded module "SHELL32.DLL" at base 762e0000 "powershell.exe" loaded module "WINTRUST.DLL" at base 75660000 "powershell.exe" loaded module "MSISIP.DLL" at base 720f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 756b0000 "powershell.exe" loaded module "IMM32.DLL" at base 75d40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 70900000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 720e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DATA\DF2DD09ED7C341842A104E1E668F184E\SYSTEM.DATA.NI.DLL" at base 5fb10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6a160000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 64c90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 69bd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DIRED13B18A9#\2E76676FBD265F70BE92C82BBF76B8E5\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 68780000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 74070000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6a6b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.P6F792626#\05765F777020DEEDDC8AD54B48343B9C\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 6b620000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\F0821980BFE2FC8375CCFC37DBE6E9D8\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 69b50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.NUMERICS\E7D6ED984300C7212C6E682C4F730B1E\SYSTEM.NUMERICS.NI.DLL" at base 69b00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 68580000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 69ab0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 5fa00000 "powershell.exe" loaded module "SECUR32.DLL" at base 75290000 "powershell.exe" loaded module "SSPICLI.DLL" at base 753f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.CSHARP\F73F48AFB5512225DEDAEE9C88AC5050\MICROSOFT.CSHARP.NI.DLL" at base 5f860000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74030000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 774c0000 "powershell.exe" loaded module "RPCRTREMOTE.DLL" at base 75500000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.M870D558A#\7CEB6B903321C16B12386A8DF1BE50F9\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 5f7d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.PAE3498D9#\8DCF1DAED985F481EED5CCA9D2945C18\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 5f5f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFE64A9051#\1561B93D6D25C4A9C3E2659AB29A5E73\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 6ba20000 "powershell.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75590000 "powershell.exe" loaded module "URLMON.DLL" at base 75ee0000 "powershell.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 755a0000 "powershell.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 71bc0000 "powershell.exe" loaded module "NCRYPT.DLL" at base 750a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74c40000 "powershell.exe" loaded module "USERENV.DLL" at base 757f0000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 774c0000 "powershell.exe" loaded module "GPAPI.DLL" at base 74b40000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 774c0000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 774c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 70ec0000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 70ec0000 "powershell.exe" loaded module "SENSAPI.DLL" at base 74080000 "powershell.exe" loaded module "PROFAPI.DLL" at base 75580000 "powershell.exe" loaded module "CRYPT32.DLL" at base 756b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 5f4e0000 "powershell.exe" loaded module "GDI32.DLL" at base 75a80000 "powershell.exe" loaded module "BCRYPT.DLL" at base 75080000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.PB378EC07#\D254C63BEDCB76C81C3125BD527B7D1A\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 6a430000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAA57FC8CC#\73A1A80AED03E789A49CEC899B7505DD\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 5e840000 "powershell.exe" loaded module "MSISIP.DLL" at base 74080000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 72200000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 721f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DATA\DF2DD09ED7C341842A104E1E668F184E\SYSTEM.DATA.NI.DLL" at base 61600000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 650b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 60e80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 6a300000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DIRED13B18A9#\2E76676FBD265F70BE92C82BBF76B8E5\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 6a1d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.P6F792626#\05765F777020DEEDDC8AD54B48343B9C\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 72190000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 69c40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\F0821980BFE2FC8375CCFC37DBE6E9D8\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 6b600000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.NUMERICS\E7D6ED984300C7212C6E682C4F730B1E\SYSTEM.NUMERICS.NI.DLL" at base 708d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 69b30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6a180000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.CSHARP\F73F48AFB5512225DEDAEE9C88AC5050\MICROSOFT.CSHARP.NI.DLL" at base 68710000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.M870D558A#\7CEB6B903321C16B12386A8DF1BE50F9\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 685b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.PAE3498D9#\8DCF1DAED985F481EED5CCA9D2945C18\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 64ed0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFE64A9051#\1561B93D6D25C4A9C3E2659AB29A5E73\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 69b00000 "powershell.exe" loaded module "SENSAPI.DLL" at base 6c750000 "powershell.exe" loaded module "WINHTTP.DLL" at base 70820000 "powershell.exe" loaded module "WS2_32.DLL" at base 76f30000 "powershell.exe" loaded module "CREDSSP.DLL" at base 74c30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74f30000 "powershell.exe" loaded module "WSHTCPIP" at base 74a90000 "powershell.exe" loaded module "WSHIP6.DLL" at base 74f20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHQOS.DLL" at base 71cb0000 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 738c0000 "powershell.exe" loaded module "DHCPCSVC6.DLL" at base 737d0000 "powershell.exe" loaded module "DHCPCSVC.DLL" at base 73750000 "powershell.exe" loaded module "NSI.DLL" at base 75e50000 "powershell.exe" loaded module "CFGMGR32.DLL" at base 75610000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 774c0000 "powershell.exe" loaded module "DNSAPI.DLL" at base 74df0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74a90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74f20000 "powershell.exe" loaded module "RASADHLP.DLL" at base 71cf0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73830000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 64dc0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 69b10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\F0821980BFE2FC8375CCFC37DBE6E9D8\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 68700000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 685f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.NUMERICS\E7D6ED984300C7212C6E682C4F730B1E\SYSTEM.NUMERICS.NI.DLL" at base 685a0000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6a740000 "powershell.exe" loaded module "SENSAPI.DLL" at base 6c4a00003d:T1533,"492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" touched "Security Manager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32")3e:T947,"492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "XClient.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"3f:T7d2,"492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR-SA") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR-SA") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG-BG") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG-BG") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA")40:T101f,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00005672-00000C2B-187938544] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00005672-00000C2B-188251749] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00005672-00000C2B-189662272] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005672-00000C2B-189799459] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00005672-00000C2B-190078981] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00005672-00000C2B-190142400] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00005672-00000C2B-190268019] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00005672-00000C2B-190579488] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00005672-00000C2B-191178028] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00005672-00000C2B-191252766] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00005672-00000C2B-191349889] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00005672-00000C2B-191557498] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00005672-00000C2B-191762578] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00005672-00000C2B-191825711] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00005672-00000C2B-191901839] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00005672-00000C2B-191963845] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00005672-00000C2B-192471616] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll" [Source: 00000000-00005672-00000C2B-193219119] Observed system executable string:"%WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" [Source: 00000000-00005672-00000C2B-193406006] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00005672-00000C2B-194147182] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00005672-00000C2B-194229483] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00005672-00000C2B-194312571] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00005628-00000C2B-200522368] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00005628-00000C2B-200908763] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00005628-00000C2B-240083442]41:T5dd,"XClient.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%APPDATA%\XClient.exe]- [targetUID: 00000000-00005628] "XClient.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Unicoded MachineID hapubws-pc Archive NeedIndexed ctime=Sun Aug 23 23:40:11 2026 atime=Sun Aug 23 23:40:11 2026 mtime=Sun Aug 23 23:40:11 2026 length=495104 window=normal IDListSize 0x0144 Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\""- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk]- [targetUID: 00000000-00005628] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4987 bytes 1 file at 0x2c last modified Sep 04 2025 20:23:24 +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00005892] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00005892] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00005984] "Log.tmp" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\Log.tmp]- [targetUID: 00000000-00005628]42:Ta00,"492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\"; Key: ""; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\V4.0"; Key: ""; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: ""; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: ""; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\STANDARDS"; Key: ""; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\STANDARDS\V4.0.30319"; Key: ""; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: ""; Value: "")43:Tfec,"492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "INSTALLROOT"; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "CLRLOADLOGDIR"; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "USELEGACYV2RUNTIMEACTIVATIONPOLICYDEFAULTVALUE"; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "ONLYUSELATESTCLR"; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "NOCLIENTCHECKS"; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\NET FRAMEWORK SETUP\NDP\V4\FULL"; Key: "RELEASE"; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "492F63A1BBEAAB365148DE239CD17F2A298C3EF421D95A4C2AE34B678C1EA27B"; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "DISABLECONFIGCACHE"; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4"; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "763FD754-7086-4DFE-95EB-C01A46FAF4CA"; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "A669021C-C450-4609-A035-5AF59AF4DF18"; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "CC2BCBBA-16B6-4CF3-8990-D74C2E8AF500"; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "CACHELOCATION"; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "DOWNLOADCACHEQUOTAINKB"; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "ENABLELOG"; Value: "")44:T6e5,"492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.windows.forms\c9a4cbc00f690a9e3cddfc400f6e85bb\system.windows.forms.ni.dll.aux" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.drawing\f7568d7f1b9d356f64779b4c0927cfb3\system.drawing.ni.dll.aux" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.configuration\96f7edb07b12303f0ec2595c7f3778c7\system.configuration.ni.dll.aux" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.xml\15af16d373cf0528cb74fc73d365fdbf\system.xml.ni.dll.aux"45:Tcfc,"492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to touch file "C:\FLTLIB.DLL" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to touch file "C:\MSVCP140.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to touch file "C:\VCRUNTIME140.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to touch file "C:\ucrtbase.DLL" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to touch file "C:\api-ms-win-core-localization-l1-2-0.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to touch file "C:\api-ms-win-core-synch-l1-2-0.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to touch file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to touch file "C:\api-ms-win-core-file-l1-2-0.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll"46:Tcf7,"492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\FLTLIB.DLL" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\MSVCP140.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\ucrtbase.DLL" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL"47:T8af,"492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe.config" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\NQYq\" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.INI" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe.Local\" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\492F63A1BBEAAB365148DE239CD17F2A298C3EF421D95A4C2AE34B678C1EA27B.EXE.CONFIG" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\NQYQ" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\492F63A1BBEAAB365148DE239CD17F2A298C3EF421D95A4C2AE34B678C1EA27B.INI" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" trying to access non-existent file "C:\492F63A1BBEAAB365148DE239CD17F2A298C3EF421D95A4C2AE34B678C1EA27B.EXE.LOCAL"48:T5f9,"492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" writes file "c:\users\%osuser%\appdata\roaming\xclient.exe" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" writes file "c:\users\%osuser%\appdata\roaming\microsoft\windows\start menu\programs\startup\xclient.lnk" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" writes file "c:\users\%osuser%\appdata\local\temp\log.tmp" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\fnbmficf.r3v.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\a3csuyol.34d.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\my1locdb.iqj.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\t4ncfqhi.bva.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157" "powershell.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\57c8edb95df3f0ad4ee2dc2b8cfd4157" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\y4itejga.qgh.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\jve1lvwd.1q5.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\xu2hll5l.b23.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\fbqxyda0.klx.psm1"49:T58f,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00005628-00000C2C-244507503") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00005892-00000C2C-217431869") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00005892-00000C2C-217643097") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00005892-00000C2C-217695630") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00005892-00000C2C-217695630") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00005892-00000C2C-217695630") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00005892-00000C2C-218371609") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00005892-00000C2C-218371609") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00005892-00000C2C-218416527") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00005892-00000C2C-218416936") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00005892-00000C2C-218449343") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00005892-00000C2C-218449754")4a:T529,Observed namespace "System.Data.SqlClient.SqlConnection" and TypeReference ".ctor" in "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference ".ctor" in "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference "ExecuteReader" in "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference "get_Parameters" in "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b" Observed namespace "System.Data.SqlClient.SqlParameterCollection" and TypeReference "AddWithValue" in "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b" Observed namespace "System.Data.SqlClient.SqlConnection" and TypeReference ".ctor" in "XClient.exe" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference ".ctor" in "XClient.exe" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference "ExecuteReader" in "XClient.exe" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference "get_Parameters" in "XClient.exe" Observed namespace "System.Data.SqlClient.SqlParameterCollection" and TypeReference "AddWithValue" in "XClient.exe"4b:Teac,"492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00005672) "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00005672)4c:T514,Found string "[ESC]" (Indicator: "[esc]"; File: "00005628.000015FC.9201103.00402000.wprm") Found string "[Shift]" (Indicator: "[shift]"; File: "00005628.000015FC.9201103.00402000.wprm") Found string "[Back]" (Indicator: "[Back]"; File: "00005628.000015FC.9201103.00402000.wprm") Found string "[Tab]" (Indicator: "[tab]"; File: "00005628.000015FC.9201103.00402000.wprm") Found string "[ESC]" (Indicator: "[esc]"; Source: "00000000-00005628.00000002.80314.01B40000.00000004.mdmp") Found string "[CTRL]" (Indicator: "[ctrl]"; Source: "00000000-00005628.00000002.80314.01B40000.00000004.mdmp") Found string "[CTRL]" (Indicator: "[Ctrl]"; Source: "00000000-00005628.00000002.80314.01B40000.00000004.mdmp") Found string "[Shift]" (Indicator: "[shift]"; Source: "00000000-00005628.00000002.80314.01B40000.00000004.mdmp") Found string "[Back]" (Indicator: "[Back]"; Source: "00000000-00005628.00000002.80314.01B40000.00000004.mdmp") Found string "[Tab]" (Indicator: "[tab]"; Source: "00000000-00005628.00000002.80314.01B40000.00000004.mdmp") Found string "[CAPSLOCK: OFF]" (Indicator: "[CAPSLOCK: OFF]"; Source: "00000000-00005628.00000002.80314.01B40000.00000004.mdmp") Found string "[CAPSLOCK: ON]" (Indicator: "[CAPSLOCK: ON]"; Source: "00000000-00005628.00000002.80314.01B40000.00000004.mdmp")4d:T78e,Found string "\drivers\etc\hosts" (Indicator: "\drivers\"; File: "00005628.000015FC.9201103.00402000.wprm") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00005628.00000000.76467.00550000.00000004.mdmp, 00000000-00005628.00000001.78389.00550000.00000004.mdmp, 00000000-00005628.00000002.80314.00550000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00005628.00000001.78389.00550000.00000004.mdmp, 00000000-00005628.00000002.80314.00550000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00005628.00000001.78389.00550000.00000004.mdmp, 00000000-00005628.00000002.80314.00550000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00005628.00000001.78389.00550000.00000004.mdmp, 00000000-00005628.00000002.80314.00550000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00005628.00000001.78389.00550000.00000004.mdmp, 00000000-00005628.00000002.80314.00550000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00005628.00000001.78389.00550000.00000004.mdmp, 00000000-00005628.00000002.80314.00550000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00005628.00000001.78389.00550000.00000004.mdmp, 00000000-00005628.00000002.80314.00550000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00005672.00000000.75879.003C0000.00000004.mdmp, 00000000-00005672.00000001.76193.003C0000.00000004.mdmp")4e:Tcca,"492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")4f:T444,"492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" reads file "C:\Users\desktop.ini" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini"50:T630,"SELECT ProductCode FROM Products ORDER BY ProductCode" (Source: GZD24070024 - 31677(WIS36)-308-12814975 76 308-12823182 3326 308-12831767 1774 6329 6332-PL.pdf.scr Indicator: "select productcode from products order by productcode") "UPDATE Products SET ProductCode = @NewProductCode, Name = @NewName, YearsWarranty = @NewYearsWarranty, ReleaseDate = @NewReleaseDate WHERE ProductCode = @OldProductCode AND Name = @OldName AND YearsWarranty = @OldYearsWarranty AND ReleaseDate = @OldReleaseDate" (Source: GZD24070024 - 31677(WIS36)-308-12814975 76 308-12823182 3326 308-12831767 1774 6329 6332-PL.pdf.scr Indicator: "update products set productcode = @newproductcode, name = @newname, yearswarranty = @newyearswarranty, releasedate = @newreleasedate where productcode = @oldproductcode and name = @oldname and yearswarranty = @oldyearswarranty and releasedate = @oldreleasedate") "DELETE FROM Products WHERE ProductCode = @ProductCode AND Name = @Name AND YearsWarranty = @YearsWarranty AND ReleaseDate = @ReleaseDate" (Source: GZD24070024 - 31677(WIS36)-308-12814975 76 308-12823182 3326 308-12831767 1774 6329 6332-PL.pdf.scr Indicator: "delete from products where productcode = @productcode and name = @name and yearswarranty = @yearswarranty and releasedate = @releasedate") "SELECT ProductCode, Name, YearsWarranty, ReleaseDate FROM Products WHERE ProductCode = @ProductCode ORDER BY ProductCode" (Source: 6000096-ProductDB~GetProduct, Indicator: "select productcode, name, yearswarranty, releasedate from products where productcode = @productcode order by productcode")51:Tf38,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00000960-00000C28-1590704924] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00000960-00000C25-1937068328] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00000960-00000C25-1937167197] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00000960-00000C25-1937228818] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00000960-00000C25-1937316216] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00000960-00000C25-1937352186] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00000960-00000C25-1937412192] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00000960-00000C25-1937494217] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00000960-00000C25-1937565810] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00000960-00000C25-1937636146] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00000960-00000C25-1937758703] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00000960-00000C25-1937872457] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00000960-00000C25-1937899608] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00000960-00000C25-1937938947] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00000960-00000C25-1938175190] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00000960-00000C25-1938859431] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00000960-00000C25-1938887196] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00000960-00000C25-1938913138] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00000960-00000C25-1939340977] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00000960-00000C25-1939498177] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00000960-00000C25-1939605822] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00002288-00000C25-1941010098] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00002288-00000C25-1984035690] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00002288-00000C25-1984642625] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" [Source: 00000000-00002288-00000C25-1984945221]52:T8e48,Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00002288.00000000.187447.02AF0000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead" - Source: "00000000-00002288.00000000.187447.047A0000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead" - Source: "00000000-00002288.00000001.189367.047A0000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead" - Source: "00000000-00002288.00000002.191288.047A0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00002288.00000002.191288.081A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004540.00000000.187523.026B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004540.00000000.187523.026B0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004540.00000000.187523.0279F000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00004540.00000000.187523.0279F000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00004540.00000000.187523.0279F000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00004540.00000000.187523.0279F000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00004540.00000000.187523.0279F000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00004540.00000000.187523.0279F000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00004540.00000000.187523.0279F000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00004540.00000000.187523.0279F000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00004540.00000000.187523.0279F000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e1.2.840.113549.1.1.52.16.840.1.113730.1.11.3.6.1.4.1.311.21.1g6" - Source: "00000000-00004540.00000000.187523.0279F000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004540.00000000.187523.0279F000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004540.00000000.187523.0279F000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;il" - Source: "00000000-00004540.00000000.187523.0279F000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004540.00000000.187523.0279F000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004540.00000000.187523.0279F000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004540.00000000.187523.0279F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00004540.00000000.187523.0279F000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004540.00000000.187523.0279F000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004540.00000000.187523.0279F000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004540.00000000.187523.0279F000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004540.00000000.187523.0279F000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0com/1.2.840.113549.1.1.20q" - Source: "00000000-00004540.00000000.187523.0279F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004540.00000000.187523.0279F000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?$tre" - Source: "00000000-00004540.00000000.187523.0279F000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004540.00000000.187523.06E00000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00004540.00000000.187523.06E00000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00004540.00000000.187523.06E00000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00004540.00000000.187523.06E00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/ccts/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.ya'4+a6" - Source: "00000000-00004540.00000000.187523.06E00000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/defa+l6$ly6eljy9s" - Source: "00000000-00004540.00000000.187523.06E00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004540.00000000.187523.06E00000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00004540.00000000.187523.6F1C1000.00000020.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006540.00000000.188260.02580000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.2.840.113549.1.9.16.2.11esskeyexchpreferencedecodeexessreceiptrequestdecodeex1.2.840.113549.1.9.16.2.12esssigncertificatedecodeexeappxbundlesipputsigneddatamsg1.2.840.113549.1.9.16.2.2cryptsipputsigneddatamsgeappxsipputsigneddatamsgcryptsipputsigneddatamsgcryptsipputsigneddatamsg6ucryptsipputsigneddatamsg1.2.840.113549.1.9.16.1.16ucryptsipputsigneddatamsg1.2.840.113549.1.9.16.2.1wp4xv1.2.840.113549.3.4appxbundlesipputsigneddatamsgcryptsipputsigneddatamsgd" - Source: "00000000-00006540.00000000.188260.02580000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006540.00000000.188260.02580000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006540.00000000.188260.02656000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006540.00000000.188260.02656000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006540.00000000.188260.02656000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;se]l+>%ydigicert" - Source: "00000000-00006540.00000000.188260.02656000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006540.00000000.188260.02656000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00006540.00000000.188260.02656000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006540.00000000.188260.02656000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006540.00000000.188260.02656000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006540.00000000.188260.02656000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006540.00000000.188260.02656000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006540.00000000.188260.02656000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?egreater" - Source: "00000000-00006540.00000000.188260.02656000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006540.00000000.188260.02656000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006540.00000000.188260.02656000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006540.00000000.188260.02656000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006540.00000000.188260.02656000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcdigicert" - Source: "00000000-00006540.00000000.188260.02656000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006540.00000000.188260.02656000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006540.00000000.188260.02656000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006540.00000000.188260.02656000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00006540.00000000.188260.02820000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006540.00000000.188260.02820000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006540.00000000.188260.02820000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006540.00000000.188260.06E40000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?geotrust" - Source: "00000000-00006540.00000000.188260.06E40000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006540.00000000.188260.06E40000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006540.00000000.188260.06E40000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00006540.00000000.188260.6EA41000.00000020.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e8;s@greater" - Source: "00000000-00006696.00000000.188940.031C9000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006696.00000000.188940.031C9000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006696.00000000.188940.031C9000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006696.00000000.188940.031C9000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006696.00000000.188940.031C9000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006696.00000000.188940.031C9000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006696.00000000.188940.031C9000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006696.00000000.188940.031C9000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00006696.00000000.188940.031C9000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcnew" - Source: "00000000-00006696.00000000.188940.031C9000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006696.00000000.188940.032A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006696.00000000.188940.032A0000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00006696.00000000.188940.07980000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00006696.00000000.188940.07980000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006696.00000000.188940.07980000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006696.00000000.188940.07980000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f9iqmgvw,czcrefemit_inmemorymanifestmodulerefemit_inmemorymanifestmoduleqcasmqcasmogcmqc;thawte," - Source: "00000000-00009060.00000000.189563.07650000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00009060.00000000.189563.07650000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00009060.00000000.189563.07650000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00009060.00000000.189563.07650000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;se]l+>%ydigicert" - Source: "00000000-00009060.00000000.189563.07650000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00009060.00000000.189563.07650000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00009060.00000000.189563.07650000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00009060.00000000.189563.07650000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00009060.00000000.189563.07650000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00009060.00000000.189563.07650000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00009060.00000000.189563.07650000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00009060.00000000.189563.07650000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00009060.00000000.189563.07650000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0com/2.16.840.1.113730.1.1cth" - Source: "00000000-00009060.00000000.189563.07650000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00009060.00000000.189563.07650000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00009060.00000000.189563.07650000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00009060.00000000.189563.07650000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00009060.00000000.189563.07650000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00009060.00000000.189563.07650000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00009060.00000000.189563.09A00000.00000002.mdmp") Found URL "http://www.microsoft.com0wr1e" - Source: "00000000-00009060.00000000.189563.09A00000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00009060.00000000.189563.09A00000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00009060.00000000.189563.09A00000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00009060.00000000.189563.6E411000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00009060.00000000.189563.6E411000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00009060.00000000.189563.6E411000.00000020.mdmp")53:T11dc,"GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00000960) "GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00000960) "GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00000960) "GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00000960) "GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00000960) "GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00000960) "GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00000960) "GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00000960) "GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00000960) "GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00000960) "GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00000960) "GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00000960) "GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00000960) "GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00000960) "GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00000960) "GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00000960) "GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00000960) "GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00000960) "GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00000960) "GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00000960) "GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00000960) "GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00000960) "GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00000960) "GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00000960)54:T5dd,Observed namespace "System.Data.SqlClient.SqlConnection" and TypeReference ".ctor" in "GZD24070024 - 31677(WIS36)-308-12814975,76,308-12823182,3326,308-12831767,1774,6329,6332-PL.pdf.scr" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference ".ctor" in "GZD24070024 - 31677(WIS36)-308-12814975,76,308-12823182,3326,308-12831767,1774,6329,6332-PL.pdf.scr" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference "ExecuteReader" in "GZD24070024 - 31677(WIS36)-308-12814975,76,308-12823182,3326,308-12831767,1774,6329,6332-PL.pdf.scr" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference "get_Parameters" in "GZD24070024 - 31677(WIS36)-308-12814975,76,308-12823182,3326,308-12831767,1774,6329,6332-PL.pdf.scr" Observed namespace "System.Data.SqlClient.SqlParameterCollection" and TypeReference "AddWithValue" in "GZD24070024 - 31677(WIS36)-308-12814975,76,308-12823182,3326,308-12831767,1774,6329,6332-PL.pdf.scr" Observed namespace "System.Data.SqlClient.SqlConnection" and TypeReference ".ctor" in "XClient.exe" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference ".ctor" in "XClient.exe" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference "ExecuteReader" in "XClient.exe" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference "get_Parameters" in "XClient.exe" Observed namespace "System.Data.SqlClient.SqlParameterCollection" and TypeReference "AddWithValue" in "XClient.exe"55:T7ae,"GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" wrote 00000004 bytes to a remote process "C:\GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" (Handle: 1304) "GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" wrote 00000200 bytes to a remote process "C:\GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" (Handle: 1304) "GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" wrote 00011800 bytes to a remote process "C:\GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" (Handle: 1304) "GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" wrote 00000600 bytes to a remote process "C:\GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" (Handle: 1304) "GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1388) "GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1168) "GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1416) "GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1412)56:T43f,Spawned process "GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" (UID: 00000000-00000960) Spawned process "GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe" (UID: 00000000-00002288) Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\\GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe'" (UID: 00000000-00004540) Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'GZD24070024_-31677_WIS36_-308-12814975_76_308-12823182_3326_308-12831767_1774_6329_6332-PL.pdf.scr.exe'" (UID: 00000000-00006540) Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%APPDATA%\\XClient.exe'" (UID: 00000000-00006696) Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'" (UID: 00000000-00009060)1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1792069496280,"unified_at":"2026-10-15T13:04:56.280Z","metadata":{"hashes":{"sha256":"492f63a1bbeaab365148de239cd17f2a298c3ef421d95a4c2ae34b678c1ea27b","sha1":"ab57e6c408a669e4350825a0368b0d0b0506b678","md5":"36f0f3887e05313f5179538d6afe7d0e","sha512":"c4b5cceb6e9dc940fb84dbbbc23b10726be1c8598d0017727d129757c748fc2776e40198ee1fd5483e2e2d963dd964274b1d5bf90375945e531135e021159676","ssdeep":"12288:TPDzsilR2Xi6ywQJSg9pTEEgvnIWwKj+kCqrGk:TPDDl0yxxJSOxEBvnYJeqk","ssdeep_chunks":["12288:TPDzsil","12288:PDzsilR","12288:DzsilR2","12288:zsilR2X","12288:silR2Xi","12288:ilR2Xi6","12288:lR2Xi6y","12288:R2Xi6yw","12288:2Xi6ywQ","12288:Xi6ywQJ","12288:i6ywQJS","12288:6ywQJSg","12288:ywQJSg9","12288:wQJSg9p","12288:QJSg9pT","12288:JSg9pTE","12288:Sg9pTEE","12288:g9pTEEg","12288:9pTEEgv","12288:pTEEgvn","12288:TEEgvnI","12288:EEgvnIW","12288:EgvnIWw","12288:gvnIWwK","12288:vnIWwKj","12288:nIWwKj+","12288:IWwKj+k","12288:WwKj+kC","12288:wKj+kCq","12288:Kj+kCqr","12288:j+kCqrG","12288:+kCqrGk","24576:TPDzsil","24576:PDzsilR","24576:DzsilR2","24576:zsilR2X","24576:silR2Xi","24576:ilR2Xi6","24576:lR2Xi6y","24576:R2Xi6yw","24576:2Xi6ywQ","24576:Xi6ywQJ","24576:i6ywQJS","24576:6ywQJSg","24576:ywQJSg9","24576:wQJSg9p","24576:QJSg9pT","24576:JSg9pTE","24576:Sg9pTEE","24576:g9pTEEg","24576:9pTEEgv","24576:pTEEgvn","24576:TEEgvnI","24576:EEgvnIW","24576:EgvnIWw","24576:gvnIWwK","24576:vnIWwKj","24576:nIWwKj+","24576:IWwKj+k","24576:WwKj+kC","24576:wKj+kCq","24576:Kj+kCqr","24576:j+kCqrG","24576:+kCqrGk","12288:TPDDl0y","12288:PDDl0yx","12288:DDl0yxx","12288:Dl0yxxJ","12288:l0yxxJS","12288:0yxxJSO","12288:yxxJSOx","12288:xxJSOxE","12288:xJSOxEB","12288:JSOxEBv","12288:SOxEBvn","12288:OxEBvnY","12288:xEBvnYJ","12288:EBvnYJe","12288:BvnYJeq","12288:vnYJeqk"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744","pehash":"2403c636c549959bfb9991384767006356e3a9cd"},"file_info":{"file_name":"GZD24070024 到貨 - 31677(WIS36)-308-12814975,76,308-12823182,3326,308-12831767,1774,6329,6332-PL.pdf.scr","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":495104,"entropy":7.92,"compile_timestamp":"2024-07-08T02:32:06","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1720411936000,"last_seen":1788118149000,"last_multi_scan":1788118149000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":3,"import_count":0,"export_count":0,"embedded_file_count":3,"sections":[{"name":".text","virtual_address":"0x2000","virtual_size":488348,"raw_size":488448},{"name":".rsrc","virtual_address":"0x7a000","virtual_size":5512,"raw_size":5632},{"name":".reloc","virtual_address":"0x7c000","virtual_size":12,"raw_size":512}],"section_names":[".text",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","rat","remcos","credentialharvesting","xworm","criminal","evasive","windows-server-utility"]},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":2,"threat_actors_count":1,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":89},"sandbox_signatures":{"informative_count":228,"suspicious_count":24,"malicious_count":18,"total":270},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.RATX-gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Lazy.568987","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packed.Ratx-10033260-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"crowdstrikefalconml":{"name":"CrowdStrike Falcon ML","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Lazy.568987 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Kryptik.ALWW trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005b7d071 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/MSIL-SSP","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Kryptik.LEJ.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Kryptik.Win32.4830101","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Lazy.Generic","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"Xworm","sources":[{"report_type":"qsp","report_id":""}]}],"threat_actors":[{"value":"PLUMP SPIDER","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to load content from resource"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"suspicious","value":"YARA signature match - Customized RC4 encryption for MSIL"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"},{"type":"informative","value":"YARA signature match – high entropy image embedded in .NET resource"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains ability to perform sql operations (Dotnet)"},{"type":"informative","value":"Contains SQL queries"},{"type":"informative","value":"Able to perform SQL operations"},{"type":"informative","value":"Able to perform SQL operations (Dotnet)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Able to execute applications using .NET process API"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Found WMI keywords in script (string)"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"},{"type":"malicious","value":"YARA signature match - Malware.XWorm"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Executes PowerShell with command line"},{"type":"malicious","value":"Executes powershell requesting to bypass execution policy"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Writes shellcode to a remote process"},{"type":"suspicious","value":"Spawned processes are likely due to an injection"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Tries to map intranet network resources to internet zone"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Able to modify Windows Defender exclusions (Powershell command string)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"},{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"suspicious","value":"PE file has unusual entropy sections"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Defense Evasion","technique":"Impair Defenses","attack_id":"T1562","attack_id_wiki":"https://attack.mitre.org/techniques/T1562","identifiers":[{"type":"informative","value":"Uses powershell with a add-mppreference commandline param"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"},{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"suspicious","value":"Drops a file that contains keystrokes (possible keylogger)"},{"type":"suspicious","value":"YARA signature match – Special key logging"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Creates file in AppData directory"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Contains ability to query registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Able to modify Remote Configuration"},{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API that may be used to take screenshots"},{"type":"informative","value":"Able to capture screen (API string)"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"May execute SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"suspicious","value":"Drops cabinet archive files"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (Dotnet)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Able to download remote files (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"malicious","value":"Known malware detected"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to change the configuration parameters of a service"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Persistence","technique":"PowerShell Profile","attack_id":"T1546.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/013","identifiers":[{"type":"informative","value":"Contains reference to Powershell profile file"}],"sources":[{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"}],"sources":[{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Defense Evasion","technique":"Rootkit","attack_id":"T1014","attack_id_wiki":"https://attack.mitre.org/techniques/T1014","identifiers":[{"type":"informative","value":"References device drivers used by rootkit malware"}],"sources":[{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"malicious","value":"Sets a global windows hook to intercept keystrokes"},{"type":"informative","value":"Sets a windows hook"}],"sources":[{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT ProductCode FROM Products ORDER BY ProductCode\" (Source: sample.bin, Indicator: \"select productcode from products order by productcode\"), \"DELETE FROM Products WHERE ProductCode = @ProductCode AND Name = @Name AND YearsWarranty = @YearsWarranty AND ReleaseDate = @ReleaseDate\" (Source: sample.bin, Indicator: \"delete from products where productcode = @productcode and name = @name and yearswarranty = @yearswarranty and releasedate = @releasedate\"), \"UPDATE Products SET ProductCode = @NewProductCode, Name = @NewName, YearsWarranty = @NewYearsWarranty, ReleaseDate = @NewReleaseDate WHERE ProductCode = @OldProductCode AND Name = @OldName AND YearsWarranty = @OldYearsWarranty AND ReleaseDate = @OldReleaseDate\" (Source: sample.bin, Indicator: \"update products set productcode = @newproductcode, name = @newname, yearswarranty = @newyearswarranty, releasedate = @newreleasedate where productcode = @oldproductcode and name = @oldname and yearswarranty = @oldyearswarranty and releasedate = @oldreleasedate\")","origin":"sample.bin","mitre_attack_id":"T1213","id":"string-16","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"MessageBox\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"7.1.1.1\", \"16.0.0.0\", \"7.0.1.1\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b83d291cd0f5a1a02d62c"},{"report_type":"sandbox","report_id":"668b6720207e5638ad0658eb"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"pubsub.pubnub.com\", Heuristic match: \"