26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 6e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4a3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Genie.8DN.Generic Sample 63cbf8a0edc2… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 63cbf8a0edc2…. Malware family: Genie.8DN.Generic. Threat score 100/100. 19/27 AV engines flagged this file. 18 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0","keywords":["Malicious","Genie.8DN.Generic","malware analysis","sandbox report","threat intelligence","63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0"],"about":{"@type":"SoftwareApplication","name":"microzx.scr.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Genie.8DN.Generic","antivirusDetections":{"malicious":19,"total":27},"behavioralIndicators":{"malicious":18,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T1611,Found reference to "HMACSHA1" (Indicator: "HMAC"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to "HMACSHA512" (Indicator: "HMAC"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to "HMACSHA512" (Indicator: "HMACSHA512"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to "HMACSHA512" (Indicator: "SHA512"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to "HMACSHA256" (Indicator: "HMAC"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to "SHA1Managed" (Indicator: "SHA1Managed"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to "Rijndael" (Indicator: "Rijndael"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to "KeyedHashAlgorithm" (Indicator: "HashAlgorithm"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to "KeyedHashAlgorithm" (Indicator: "KeyedHashAlgorithm"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to "CryptographicException" (Indicator: "CryptographicException"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to "SHA1CryptoServiceProvider" (Indicator: "SHA1CryptoServiceProvider"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to "RNGCryptoServiceProvider" (Indicator: "RNGCryptoServiceProvider"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDES"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDESCryptoServiceProvider"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to "HMACSHA1" (Indicator: "HMAC"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp, 00000000-00001720.00000001.68938.02810000.00000004.mdmp, 00000000-00001720.00000002.70862.02810000.00000004.mdmp") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp, 00000000-00001720.00000001.68938.02810000.00000004.mdmp, 00000000-00001720.00000002.70862.02810000.00000004.mdmp") Found reference to "HMACSHA512" (Indicator: "HMAC"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp, 00000000-00001720.00000001.68938.02810000.00000004.mdmp, 00000000-00001720.00000002.70862.02810000.00000004.mdmp") Found reference to "HMACSHA512" (Indicator: "HMACSHA512"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp, 00000000-00001720.00000001.68938.02810000.00000004.mdmp, 00000000-00001720.00000002.70862.02810000.00000004.mdmp") Found reference to "HMACSHA512" (Indicator: "SHA512"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp, 00000000-00001720.00000001.68938.02810000.00000004.mdmp, 00000000-00001720.00000002.70862.02810000.00000004.mdmp") Found reference to "HMACSHA256" (Indicator: "HMAC"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp, 00000000-00001720.00000001.68938.02810000.00000004.mdmp, 00000000-00001720.00000002.70862.02810000.00000004.mdmp") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp, 00000000-00001720.00000001.68938.02810000.00000004.mdmp, 00000000-00001720.00000002.70862.02810000.00000004.mdmp") Found reference to "HMAC" (Indicator: "HMAC"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to "SHA1Managed" (Indicator: "SHA1Managed"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to "Rijndael" (Indicator: "Rijndael"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp, 00000000-00001720.00000001.68938.02810000.00000004.mdmp, 00000000-00001720.00000002.70862.02810000.00000004.mdmp")28:T8be,"powershell.exe" called "CryptImportKey" with parameters {"hProv": "6d8190" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "@\"k"}, "powershell.exe" called "CryptImportKey" with parameters {"hProv": "6d8190", "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9", "dwDataLen": "148", "dwFlags": "0", "phKey": "002a6b0000000000"}, "powershell.exe" called "CryptImportKey" with parameters {"hProv": "6d8190", "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9", "dwDataLen": "148", "dwFlags": "0", "phKey": "80206b0000000000"}, "powershell.exe" called "CryptImportKey" with parameters {"hProv": "6d8190", "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9", "dwDataLen": "148", "dwFlags": "0", "phKey": "@(k"}, "powershell.exe" called "CryptImportKey" with parameters {"hProv": "6d8190", "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9", "dwDataLen": "148", "dwFlags": "0", "phKey": "002e6b0000000000"}29:T449,Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API "BCryptDecrypt" (Indicator: "CryptDecrypt"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API "BCryptEncrypt" (Indicator: "BCryptEncrypt"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API "BCryptEncrypt" (Indicator: "CryptEncrypt"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API "BCryptImportKey" (Indicator: "CryptImportKey"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API "BCryptGetProperty" (Indicator: "BCryptGetProperty"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API "BCryptSetProperty" (Indicator: "BCryptSetProperty"; File: "00001720.000006B8.11790014.00402000.wprm")2a:T412,Found string "PRIVATE KEY LOCATION: "{0}"]" (Indicator: "private key"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found string "http://www.w3.org/2001/04/xmlenc# EncryptedKey" (Indicator: "encryptedkey"; Source: "00000000-00001720.00000001.68938.02810000.00000004.mdmp, 00000000-00001720.00000002.70862.02810000.00000004.mdmp") Found string "System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" (Indicator: "encryptedkey"; Source: "00000000-00001720.00000001.68938.02810000.00000004.mdmp, 00000000-00001720.00000002.70862.02810000.00000004.mdmp") Found string "[PRIVATE KEY LOCATION: "{0}"]" (Indicator: "private key"; Source: "00000000-00001720.00000001.68938.02810000.00000004.mdmp, 00000000-00001720.00000002.70862.02810000.00000004.mdmp") Found string "ncrypted Private Key" (Indicator: "private key"; Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp, 00000000-00001720.00000002.70862.05FC0000.00000004.mdmp")2b:T5d3,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to encrypt/decrypt data using TripleDES Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains ability to decode base64 data Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains asymmetric cryptographic functions (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Sample file has high entropy (likely encrypted/compressed content)2c:T76f,"microzx.scr.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004432) "microzx.scr.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004432) "microzx.scr.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000007401b0000000000005000000002d00005001b000190000008003b4000000000019000000c4ef3c001400000050f13c0045581a77a55b3900feffffff00000000060000066877b2008d2d00a001000000eb59a5760000000080000000d8f03c008d2d00a08003b400010000008003b400020000000c00000018a8b30018a8b30013a8b30000000000ec81f8000000b0000000000144f03c00744af87264f63c0045581a77855b3900feffffff163416774134167794000000a000000012a8b30010a8b30094000000e8f13c00b914a5768cf13c0090f13c001000000001000000 (UID: 00000000-00004432)2d:T1f11,"microzx.scr.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100006e00330038005c00530063007200690070007400000000000000430000000000000000000000000000000000000000000000010042005700f0a5b3000c00000c25b200003877b20010feb2004c006f00630061006c005c00500072006f006700720061006d0073005c00500079007400 (UID: 00000000-00004432) "microzx.scr.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004432) "microzx.scr.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100003b021677257a1077f42e2d6d40a5b200a0352d6d757a1077e8e83c000881b200def51577457a1077f8e83c000000266d0000266d0000000054e83c00f0000000f000266d0000000064e83c0053000000f8e93c000000000001000000c8e83c006cf615770000000000000000b4e83c00 (UID: 00000000-00004432) "microzx.scr.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c47c073b879ba008c47c07300000000b879ba00d4e03c00fd3f1677d82023770000000088e13c0000000000de54177114e13c0045581a771d5a3900feffffff4de717776056ec75021000000000000000000100e8e03c00e24216778c47c0730000000000000000 (UID: 00000000-00004432) "microzx.scr.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004432) "microzx.scr.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb9776a0f2bc0000e0fd7ed30f17770060fa7eecc8130e44e0fd7e00000000400000003f0000002e00000000e0fd7ee0c8130efa0f1777504223772e00000000e0fd7ed30f17770060fa7e04c9130eb8831677002123779446ec75d8eb9776 (UID: 00000000-00004432) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb9776b8db680000e0fd7ed30f177700d0fd7eccbb230044e0fd7e00000000400000003f0000002000000000e0fd7ec0bb2300fa0f1777504223772000000000e0fd7ed30f177700d0fd7ee4bb2300b8831677002123779446ec75d8eb9776 (UID: 00000000-00004696) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b005c00760032002e0030002e00350030003700320037005c006d00730063006f00720077006b0073002e0064006c006c002e0032002e004d0061006e00690066006500730074000000 (UID: 00000000-00004696) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000636dd67200000002000000006c6dd672aab26c74d8d77e7170eb23006ceb230000000000000000000000000000000000d8d77e71c4ea23000000000034eb230070eb230004eb2300ff23d672c83bdf7244eb23003117d67208000000fafa147766b11677ffffffff240000002ceb2300 (UID: 00000000-00004696) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004696) "microzx.scr.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100006884920060fb6c00e7331677163416772cfc6c00010000009401900001000000e0fa6c00b4161777c02023779a161777073a40772cfc6c00010000000100000028ce920000000000b0fa6c00e0fa6c004cfb6c0045581a77377b3900feffffff9a161777a519ec750000837500000000 (UID: 00000000-00001720) "microzx.scr.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100006e00330038005c00530063007200690070007400000000000000430000000000000000000000000000000000000000000000010088d19300e89793000c00000cc6280000f0019400c0fe9200b10800009aa8600000200000b0080000580f00000d006100a2000000b1080000a1000000 (UID: 00000000-00001720) "microzx.scr.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007078f67705b29c247634374069000000000100000000000000010000009cf677050000000028128102d8f67705a0229b00a8f677058f9c24763437406902000000000000001800000001000000acf677052823e67200009000000000000c00000060428902b8f677052f9940690c000000 (UID: 00000000-00001720) "microzx.scr.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f2449e75bc763476d8d3980040e69700dcd39800d8d3980030000000000000005cec340050dca275d8d398003000000000000000cc674505300000000200000000000000180000009b69dd1684ec34002823e67200009000000000000c00000028c7366990ec34002f9940690c000000 (UID: 00000000-00001720) "microzx.scr.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000030ed34006a6f9c7000000000bc6f9c70000b4b74b0e8340000000000b0ee3400155eaa753496d601feffffff7501b375e2d8337628243f6902000000000000001800000030a54069f0ec34002823e67200009000000000000c00000030a54069fcec34002f9940690c000000 (UID: 00000000-00001720) "microzx.scr.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310005039bfc7258349c0000000000b0eec605f837fc7258349c00f8eec605d724fb7258349c0020000000000000001c39fb7228128102208289022812810202000000000000001800000000349c00fceec6052823e67200009000000000000c0000002082890208efc6052f9940690c000000 (UID: 00000000-00001720) "microzx.scr.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f2449e75bc763476a0469c0040e69700a4469c00a0469c0030000000000000005cec340050dca275a0469c00300000000000000024054605300000000200000000000000180000009b69dd1684ec34002823e67200009000000000000c00000028c7366990ec34002f9940690c000000 (UID: 00000000-00001720) "microzx.scr.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000008ed34006a6f9c7000000000bc6f9c70280b4b7488e8340000000000b0ee3400155eaa753496d601feffffff7501b375e2d8337628243f6902000000000000001800000030a54069c8ec34002823e67200009000000000000c00000030a54069d4ec34002f9940690c000000 (UID: 00000000-00001720) "microzx.scr.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310005039bfc72303e9c0000000000a0f1c605f837fc72303e9c00e8f1c605d724fb72303e9c0020000000000000001c39fb722812810220e2890228128102020000000000000018000000003e9c00ecf1c6052823e67200009000000000000c00000020e28902f8f1c6052f9940690c000000 (UID: 00000000-00001720) "microzx.scr.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f2449e75bc7634767882980040e697007c82980078829800800000000000000038ec340050dca27578829800500000000000000024054605500000000200000000000000180000007f69dd1660ec34002823e67200009000000000000c00000028c736696cec34002f9940690c000000 (UID: 00000000-00001720) "microzx.scr.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031001d3b0216779f281877f42e7371a8de9200a0357371af281877a0e83400a8cc9200def51577bf281877b0e8340000006c7100006c71000000000ce83400f0000000f0006c71000000001ce8340053000000b0e93400000000000100000080e834006cf6157700000000000000006ce83400 (UID: 00000000-00001720)2e:T42e,Found reference to API "11496134869,4820,3024,,RtlGetVersion,NTDLL.dll,"687:16:33.135",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00001720.00000000.67016.00900000.00000004.mdmp, 00000000-00001720.00000001.68938.00900000.00000004.mdmp, 00000000-00001720.00000002.70862.00900000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp")2f:T7e4,"microzx.scr.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "ENABLEDHCP"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTRATIONENABLED"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTERADAPTERNAME"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DOMAIN"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPDOMAIN"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")30:T70f,Found string "CT * FROM Win32_Processor" (Indicator: " Win32_Process"; File: "00001720.000006B8.11790014.00402000.wprm") Found string "ELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00001720.00000002.70862.00900000.00000004.mdmp, 00000000-00001720.00000002.70862.02810000.00000004.mdmp, 00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") file/memory contains long string with (Indicator: " Win32_Process"; Source: "00000000-00001720.00000002.70862.00900000.00000004.mdmp") Found string "instance of Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00001720.00000002.70862.05430000.00000004.mdmp, 00000000-00001720.00000002.70862.05620000.00000004.mdmp, 00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found string "nstance of Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00001720.00000002.70862.05430000.00000004.mdmp, 00000000-00001720.00000002.70862.05620000.00000004.mdmp") file/memory contains long string with (Indicator: " Win32_Process"; Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found string ""instance of Win32_Processor{AddressWidth = 64;Architecture = 9;Availability = 3;Caption = 'Intel64 Family 6 Model 79 Stepping 0';CpuStatus = 1;CreationClassName = 'Win32_Processor';Cu" (Indicator: " Win32_Process"; Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp"), Found string "'Win32_ComputerSystem';SystemName = 'HAPUBWS-PC';UpgradeMethod = 4;Version = '';VoltageCaps = 2;};","instance of Win32_Processor{AddressWidth = 64;Arc&U" (Indicator: " Win32_Process"; Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp")31:T8da,"microzx.scr.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "microzx.scr.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "microzx.scr.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "microzx.scr.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "microzx.scr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "microzx.scr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "microzx.scr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "microzx.scr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "microzx.scr.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "microzx.scr.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "microzx.scr.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "microzx.scr.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "microzx.scr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "microzx.scr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "microzx.scr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "microzx.scr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "microzx.scr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "microzx.scr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "microzx.scr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "microzx.scr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "microzx.scr.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "microzx.scr.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")32:T569,"microzx.scr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "microzx.scr.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "microzx.scr.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "microzx.scr.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "microzx.scr.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "microzx.scr.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4"; Key: "BLOB") "microzx.scr.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "microzx.scr.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "microzx.scr.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "microzx.scr.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "microzx.scr.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55"; Key: "BLOB")33:T40d,"microzx.scr.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00004432) "microzx.scr.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00004432) "microzx.scr.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00004432) "powershell.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00004696) "powershell.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Recent\CustomDestinations (UID: 00000000-00004696) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00004696) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00004696) "microzx.scr.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00001720) "microzx.scr.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00001720)34:T743a,"microzx.scr.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter C:\microzx.scr.exe (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter WindowsCodecs.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\ieframe.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00004432) "microzx.scr.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\shdocvw.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\199dd46435d7fdbbe590cccd8c8ae9cb\mscorlib.ni.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System\f3e2031575563c54b4bab372bbe1453f\System.ni.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\07b924d7e3b2e6344530aaa8514942aa\Microsoft.PowerShell.ConsoleH (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management.A#\bb568276b4a8b4d6f64d115294dd5c3d\System.Management.Automation. (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Core\8b5f9b59ed667a576d891eee157bf212\System.Core.ni.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\e17fd2e5fac93d8b9613bd5762bbd647\Microsoft.PowerShell.Commands (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\4342ed1aad046aa5ea9bb72bfbe99b8c\System.Configuration.Install. (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\e0652e0803f7a46306920b8043d23f52\Microsoft.WSMan.Management.ni (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Transactions\cedbdd073e0bcad91dbc5ddd921ffca0\System.Transactions.ni.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\e4fc372b5ff973eeac3dd6dac72e36b2\Microsoft.PowerShell.Commands (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\83076f46a06276b5a16ef0bc246d1bee\Microsoft.PowerShell.Commands (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\5509072e130e13708f7dcb8b5b527665\Microsoft.PowerShell.Security (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\culture.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\bd2e0a351b1495ed6e0f5eb45ba9f3fe\System.Xml.ni.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management\48155c7263ce0528f367ed4b3015cdc4\System.Management.ni.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\421ea4f1bcf6e3989b521d744a5b4a8f\System.DirectoryServices.ni.d (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data\5091f8e36728e57dcdfd74b464281728\System.Data.ni.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00004696) "powershell.exe" called "LoadLibrary" with a parameter netutils.dll (UID: 00000000-00004696) "microzx.scr.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter RASMAN.DLL (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter rtutils.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\bcryptprimitives.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter C:\vaultcli.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter vaultcli.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter C:\microzx.scr.exe (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00001720) "microzx.scr.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00001720)35:T14702,"microzx.scr.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter SystemParametersInfo (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetWindowInfo (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetAncestor (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesA (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter ExtTextOutW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GdipCreateFontFromLogfontW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyA (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter ND_RU1 (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter ND_RU1_RetAddr (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GdipGetFontUnit (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GdipGetFontSize (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GdipGetFontStyle (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GdipGetFamily (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GdipCreateFromHDC (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GdipGetDpiY (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GdipGetFontHeight (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GdipGetEmHeight (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GdipGetLineSpacing (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GdipCreateFont (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetThemeAppPropertiesW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter OpenThemeDataW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter MonitorFromRect (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetMonitorInfo (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CreateDC (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CreateDCW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GdipDeleteFont (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GdipLoadImageFromStream (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GdipImageForceValidation (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GdipGetImageType (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GdipGetImageRawFormat (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GdipGetImageWidth (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GdipGetImageHeight (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromScan0 (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GdipBitmapGetPixel (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GdipGetImagePixelFormat (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GdipBitmapSetPixel (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter Wow64SetThreadContext (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter Wow64GetThreadContext (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter ZwUnmapViewOfSection (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter ShellExecuteEx (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter SetClassLong (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter SetClassLongW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter UnregisterClass (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter UnregisterClassW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter DestroyWindowW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CloseThemeDataW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00004432) "microzx.scr.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadBSTR (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter IsCharAlphaW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CharPrevW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetNetResourceFromLocalPathW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter NetShareEnum (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CscNetApiGetInterface (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter SLGetWindowsInformationDWORD (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter PathRemoveFileSpecW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter _set_error_mode (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter ?set_terminate@@YAP6AXXZP6AXXZ@Z (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter _get_terminate (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter SetLoadedByMscoree (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetCLRFunction (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetTraceLoggerHandle (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetTraceEnableLevel (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetTraceEnableFlags (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter TraceEvent (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter IEE (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter IEE_RetAddr (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetStartupFlags (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetStartupFlags_RetAddr (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile_RetAddr (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetCORVersion_RetAddr (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetCORVersion (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory_RetAddr (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter RemoveVectoredContinueHandler (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetWriteWatch (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter ResetWriteWatch (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CreateMemoryResourceNotification (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter QueryMemoryResourceNotification (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetVersionEx (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter lstrlen (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter lstrlenW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter lstrcpy (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter lstrcpyW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CryptGenKey (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CryptSignHashA (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CryptGetUserKey (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CryptEnumProvidersA (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryShim_RetAddr (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryShim (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter ConvertLangIdToCultureName (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter ND_RI4 (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter ND_RI4_RetAddr (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter WinSqmIsOptedIn (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValue (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectory (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandleW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObject_RetAddr (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCPW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfo (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfoW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00004696) "powershell.exe" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00004696) "microzx.scr.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter TraceRegisterExA (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter TracePrintfExA (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter OpenSCManagerA (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter OpenServiceA (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter RtlConvertSidToUnicodeString (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter RegDeleteTreeA (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter RegDeleteTreeW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter NsiAllocateAndGetTable (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter CM_Open_Class_Key_ExW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter NsiFreeTable (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter SysAllocStringLen (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter SysAllocStringLenW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter SystemFunction041 (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter SystemFunction041W (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter RpcAsyncInitializeHandle (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter NotifyServiceStatusChangeW (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter NdrAsyncClientCall (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter RpcAsyncCompleteCall (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00001720) "microzx.scr.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00001720)36:T847f,Found reference to API (Indicator: "SendMessage"; File: "microzx.scr.exe") Found reference to API (Indicator: "ReleaseCapture"; File: "microzx.scr.exe") Found reference to API (Indicator: "GetAsyncKeyState"; File: "microzx.scr.exe") Found reference to API (Indicator: "GetKeyState"; File: "microzx.scr.exe") Found reference to API (Indicator: "GetObject"; File: "microzx.scr.exe") Found reference to API (Indicator: "UnhookWindowsHookEx"; File: "microzx.scr.exe") Found reference to API (Indicator: "SetWindowsHookEx"; File: "microzx.scr.exe") Found reference to API (Indicator: "CallNextHookEx"; File: "microzx.scr.exe") Found reference to API (Indicator: "MessageBox"; File: "microzx.scr.exe") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "CreateThread"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "QueryDosDevice"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "IsTextUnicode"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "GetEnvironmentVariable"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "SetEnvironmentVariable"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "GetModuleHandle"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "CloseHandle"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "DuplicateHandle"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "CreateFile"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "DeleteFile"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "WriteFile"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "MoveFile"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "MapViewOfFile"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "UnmapViewOfFile"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "GetModuleFileName"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "GetFileType"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "GetKeyboardState"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "CreateFileMapping"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "GetPrivateProfileString"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "GetTempPath"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "GetWindowTextLength"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "VaultGetItem"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "GetVolumeInformation"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "NtQuerySystemInformation"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "GetLastInputInfo"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "GetLastError"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "EnumProcessModules"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "GetLogicalDrives"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "VaultEnumerateItems"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "CreateProcess"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "OpenProcess"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "GetCurrentProcess"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "NtQueryObject"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "VaultOpenVault"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "GetParent"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "BCryptDecrypt"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "BCryptEncrypt"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "GetKeyboardLayout"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "GetWindowText"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "GetForegroundWindow"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "ToUnicodeEx"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "GetModuleFileNameEx"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "RegQueryValueEx"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "GetFileSizeEx"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "RegOpenKeyEx"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "RegCloseKey"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "BCryptImportKey"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "BCryptDestroyKey"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "BCryptGetProperty"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "BCryptSetProperty"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API (Indicator: "Local State"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "QueryDosDevice"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "IsTextUnicode"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "SendMessage"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp, 00000000-00001720.00000002.70862.01352000.00000020.mdmp") Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "SetEnvironmentVariable"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandle"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateFile"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "DeleteFile"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "MoveFile"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileName"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "GetKeyboardState"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp, 00000000-00001720.00000002.70862.01352000.00000020.mdmp") Found reference to API (Indicator: "CreateFileMapping"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "GetPrivateProfileString"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "GetWindowTextLength"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "VaultGetItem"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "GetVolumeInformation"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "GetLastInputInfo"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "EnumProcessModules"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "VaultEnumerateItems"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateProcess"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "NtQueryObject"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "VaultOpenVault"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "BCryptDecrypt"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "BCryptEncrypt"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "GetKeyboardLayout"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "GetWindowText"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "ToUnicodeEx"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameEx"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "RegQueryValueEx"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp, 00000000-00001720.00000002.70862.01352000.00000020.mdmp") Found reference to API (Indicator: "SetWindowsHookEx"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp, 00000000-00001720.00000002.70862.01352000.00000020.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp, 00000000-00001720.00000002.70862.01352000.00000020.mdmp") Found reference to API (Indicator: "RegOpenKeyEx"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "BCryptImportKey"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "BCryptDestroyKey"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "BCryptGetProperty"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "BCryptSetProperty"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API (Indicator: "GetErrorInfo"; Source: "00000000-00001720.00000001.68938.02810000.00000004.mdmp, 00000000-00001720.00000002.70862.02810000.00000004.mdmp") Found reference to API (Indicator: "InitializeSecurityContext"; Source: "00000000-00001720.00000001.68938.02810000.00000004.mdmp, 00000000-00001720.00000002.70862.02810000.00000004.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00001720.00000001.68938.02810000.00000004.mdmp, 00000000-00001720.00000002.70862.02810000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00001720.00000001.68938.02810000.00000004.mdmp, 00000000-00001720.00000002.70862.02810000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00001720.00000001.68938.02810000.00000004.mdmp, 00000000-00001720.00000002.70862.02810000.00000004.mdmp") Found reference to API (Indicator: "ReleaseCapture"; Source: "00000000-00001720.00000002.70862.01352000.00000020.mdmp") Found reference to API (Indicator: "GetAsyncKeyState"; Source: "00000000-00001720.00000002.70862.01352000.00000020.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00001720.00000002.70862.01352000.00000020.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00001720.00000002.70862.01352000.00000020.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "IsValidSid"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "InitializeSid"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "GetSidLengthRequired"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorOwner"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "MakeAbsoluteSD"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorGroup"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "AddAce"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "GetAclInformation"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "IsValidSecurityDescriptor"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "ProgIDFromCLSID"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "CommandLineToArgvW"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "GetSystemWindowsDirectoryW"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "UnregisterClassA"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "RtlFreeHeap"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "RtlAllocateHeap"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00004432.00000001.66743.003E0000.00000004.mdmp, 00000000-00004432.00000001.66743.005D0000.00000004.mdmp, 00000000-00004432.00000001.66743.01352000.00000020.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00004432.00000001.66743.003E0000.00000004.mdmp, 00000000-00004432.00000001.66743.005D0000.00000004.mdmp, 00000000-00004432.00000001.66743.01352000.00000020.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004432.00000001.66743.003E0000.00000004.mdmp, 00000000-00004432.00000001.66743.005D0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00004432.00000001.66743.00450000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004432.00000001.66743.00450000.00000004.mdmp, 00000000-00004432.00000001.66743.005D0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00004432.00000001.66743.005D0000.00000004.mdmp") Found reference to API (Indicator: "GetTempFileName"; Source: "00000000-00004432.00000001.66743.005D0000.00000004.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00004432.00000001.66743.005D0000.00000004.mdmp")37:T6925,"Software\Qualcomm\Eudora\CommandLine\" in Source: 00001720.000006B8.11790014.00402000.wprm "SOFTWARE\FTPWare\COREFTP\Sites" in Source: 00001720.000006B8.11790014.00402000.wprm "CURRENT_USER\Software\RimArts\B2\Settings" in Source: 00001720.000006B8.11790014.00402000.wprm "Y_CURRENT_USER\Software\Aerofox\FoxmailPreview" in Source: 00001720.000006B8.11790014.00402000.wprm "KEY_CURRENT_USER\Software\RimArts\B2\Settings" in Source: 00000000-00001720.00000000.67016.00400000.00000040.mdmp "KEY_CURRENT_USER\Software\Aerofox\FoxmailPreview" in Source: 00000000-00001720.00000000.67016.00400000.00000040.mdmp "KEY_CURRENT_USER\Software\Aerofox\Foxmail\V3.1" in Source: 00000000-00001720.00000000.67016.00400000.00000040.mdmp "pera Software\Opera Stable" in Source: 00000000-00001720.00000000.67016.00400000.00000040.mdmp "raveSoftware\Brave-Browser\User Data" in Source: 00000000-00001720.00000000.67016.00400000.00000040.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001720.00000001.68938.003B0000.00000004.mdmp 00000000-00001720.00000002.70862.003B0000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00001720.00000001.68938.003B0000.00000004.mdmp 00000000-00001720.00000002.70862.003B0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|LeaseT" in Source: 00000000-00001720.00000001.68938.00900000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|Lease" in Source: 00000000-00001720.00000001.68938.00900000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|DhcpServer" in Source: 00000000-00001720.00000001.68938.00900000.00000004.mdmp 00000000-00001720.00000001.68938.05620000.00000004.mdmp "32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Par" in Source: 00000000-00001720.00000001.68938.00900000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|Sear" in Source: 00000000-00001720.00000001.68938.00900000.00000004.mdmp 00000000-00001720.00000002.70862.00900000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcp*" in Source: 00000000-00001720.00000001.68938.00900000.00000004.mdmp 00000000-00001720.00000002.70862.00900000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcp4" in Source: 00000000-00001720.00000001.68938.00900000.00000004.mdmp 00000000-00001720.00000002.70862.00900000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Se}" in Source: 00000000-00001720.00000001.68938.00900000.00000004.mdmp 00000000-00001720.00000002.70862.00900000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|Hostname" in Source: 00000000-00001720.00000001.68938.00900000.00000004.mdmp 00000000-00001720.00000002.70862.00900000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parame" in Source: 00000000-00001720.00000001.68938.00900000.00000004.mdmp 00000000-00001720.00000001.68938.05465000.00000004.mdmp 00000000-00001720.00000002.70862.00900000.00000004.mdmp 00000000-00001720.00000002.70862.05430000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|SearchList" in Source: 00000000-00001720.00000001.68938.00900000.00000004.mdmp 00000000-00001720.00000001.68938.05620000.00000004.mdmp 00000000-00001720.00000002.70862.00900000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Netbt\PC" in Source: 00000000-00001720.00000001.68938.00900000.00000004.mdmp 00000000-00001720.00000002.70862.00900000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|DatabasePath" in Source: 00000000-00001720.00000001.68938.00900000.00000004.mdmp 00000000-00001720.00000001.68938.05620000.00000004.mdmp 00000000-00001720.00000002.70862.00900000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|Tcpip\Parameters\Interfaces|UDPAllowedPorts" in Source: 00000000-00001720.00000001.68938.00900000.00000004.mdmp 00000000-00001720.00000002.70862.00900000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|Tcpip\Parameters\Interfaces|RawIPAllowedProtocols" in Source: 00000000-00001720.00000001.68938.00900000.00000004.mdmp 00000000-00001720.00000002.70862.00900000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|Tcpip\Parameters\Interfaces" in Source: 00000000-00001720.00000001.68938.00900000.00000004.mdmp 00000000-00001720.00000002.70862.00900000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters|VirtualNetworkNumber" in Source: 00000000-00001720.00000001.68938.00900000.00000004.mdmp 00000000-00001720.00000002.70862.00900000.00000004.mdmp "Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" in Source: 00000000-00001720.00000001.68938.00900000.00000004.mdmp 00000000-00001720.00000002.70862.00900000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpUseRFC1122UrgentPoint" in Source: 00000000-00001720.00000001.68938.00900000.00000004.mdmp 00000000-00001720.00000002.70862.00900000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" in Source: 00000000-00001720.00000001.68938.00900000.00000004.mdmp 00000000-00001720.00000002.70862.00900000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tc" in Source: 00000000-00001720.00000001.68938.00900000.00000004.mdmp 00000000-00001720.00000002.70862.00900000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\'" in Source: 00000000-00001720.00000001.68938.00900000.00000004.mdmp 00000000-00001720.00000002.70862.00900000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00001720.00000001.68938.00900000.00000004.mdmp 00000000-00001720.00000002.70862.00900000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Opera Software\Opera Stable" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\Microsoft\Office\11.0\Outlook\Profiles" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\Microsoft\Office\12.0\Outlook\Profiles" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\Microsoft\Office\14.0\Outlook\Profiles" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\Microsoft\Office\11.0\Outlook\Pro4" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\Microsoft\Office\12.0\Outlook\Pro" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\Microsoft\Office\14.0\Outlook\Pro" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Pro" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Pro|" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Pro" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\Microsoft\ActiveSync\Partners" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\Microsoft\ActiveSync\Part" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "HKEY_CURRENT_USER\Software\RimArts\B2\Settings" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\RimArts\B2\Settings" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\RimArts\B2\Setth" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\IncrediMail\Identities\" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\IncrediMail\Ident" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\Qualcomm\Eudora\CommandLine\" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\Qualcomm\Eudora\Command" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "HKEY_CURRENT_USER\Software\Aerofox\FoxmailPreview" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "HKEY_CURRENT_USER\Software\Aerofox\Foxmail\V3.1" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\Aerofox\FoxmailPreview" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\Aerofox\FoxmailPrx" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\Aerofox\Foxmail\V3.1" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\Aerofox\FoxmailT" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "SOFTWARE\Martin Prikryl\WinSCP 2\Sessions" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "SOFTWARE\Martin Prikryl\WinSCP 2\Ses" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "SOFTWARE\FTPWare\COREFTP\Sites" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "SOFTWARE\FTPWare\COREFTP\S" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\OpenVPN-GUI\configs" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\OpenVPN-GUI\configs\" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\OpenVPN-GUI\con" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\TightVNC\Server" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "SOFTWARE\RealVNC\WinVNC4" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "SOFTWARE\Wow6432Node\RealVNC\WinVNC4" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\ORL\WinVNC3" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "SOFTWARE\RealVNC\vncserver" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\TigerVNC\Server" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "SOFTWARE\Wow6432Node\RealVNC\Win" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "SOFTWARE\RealVNC\vncse" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "SOFTWARE\RealVNC\Win" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\ORL\Win" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\TightVNC\Se" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\TigerVNC\Se" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\DownloadManager\Passwords\" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramd" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time\Dynamic DST" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time\Dynami\" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Default\Login Data" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Login Data" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Login Data" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Login Data" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services|Parameters\Tcpip|K9" in Source: 00000000-00001720.00000001.68938.05465000.00000004.mdmp 00000000-00001720.00000002.70862.05430000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services|Parameters\T" in Source: 00000000-00001720.00000001.68938.05465000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Se" in Source: 00000000-00001720.00000001.68938.05465000.00000004.mdmp 00000000-00001720.00000002.70862.05430000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Serv" in Source: 00000000-00001720.00000001.68938.05465000.00000004.mdmp 00000000-00001720.00000002.70862.05430000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Par" in Source: 00000000-00001720.00000001.68938.05465000.00000004.mdmp "Win32Registry|System\CurrentControlSet!8" in Source: 00000000-00001720.00000001.68938.05465000.00000004.mdmp 00000000-00001720.00000002.70862.05430000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwG8" in Source: 00000000-00001720.00000001.68938.05465000.00000004.mdmp 00000000-00001720.00000002.70862.05430000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Ser" in Source: 00000000-00001720.00000001.68938.05465000.00000004.mdmp 00000000-00001720.00000002.70862.05430000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpMaxConnectRetransmissions" in Source: 00000000-00001720.00000001.68938.05465000.00000004.mdmp 00000000-00001720.00000001.68938.0546A000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpMaxDataRetransmissions" in Source: 00000000-00001720.00000001.68938.05465000.00000004.mdmp 00000000-00001720.00000001.68938.0546A000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpNumConnections" in Source: 00000000-00001720.00000001.68938.05465000.00000004.mdmp 00000000-00001720.00000001.68938.0546A000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpUseRFC1122UrgentPointer" in Source: 00000000-00001720.00000001.68938.05465000.00000004.mdmp 00000000-00001720.00000001.68938.0546A000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpWindowSize" in Source: 00000000-00001720.00000001.68938.05465000.00000004.mdmp 00000000-00001720.00000001.68938.0546A000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnableLMHOSTS" in Source: 00000000-00001720.00000001.68938.05465000.00000004.mdmp 00000000-00001720.00000001.68938.0546A000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|ScopeID" in Source: 00000000-00001720.00000001.68938.05465000.00000004.mdmp 00000000-00001720.00000001.68938.0546A000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnablePMTUBHDetect" in Source: 00000000-00001720.00000001.68938.0546A000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnablePMTUDiscovery" in Source: 00000000-00001720.00000001.68938.0546A000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion\NetworkCards|ServiceName" in Source: 00000000-00001720.00000001.68938.0546A000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|ArpAlwaysSourceRoute" in Source: 00000000-00001720.00000001.68938.05620000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|ArpUseEtherSNAP" in Source: 00000000-00001720.00000001.68938.05620000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnableDeadGWDetect" in Source: 00000000-00001720.00000001.68938.05620000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services|Parameters|DefaultGateway" in Source: 00000000-00001720.00000001.68938.05620000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|DefaultTOS" in Source: 00000000-00001720.00000001.68938.05620000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|DefaultTTL" in Source: 00000000-00001720.00000001.68938.05620000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|EnableDHCP" in Source: 00000000-00001720.00000001.68938.05620000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|LeaseTerminatesTime" in Source: 00000000-00001720.00000001.68938.05620000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|LeaseObtainedTime" in Source: 00000000-00001720.00000001.68938.05620000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|Domain" in Source: 00000000-00001720.00000001.68938.05620000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnableDNS" in Source: 00000000-00001720.00000001.68938.05620000.00000004.mdmp 00000000-00001720.00000002.70862.05620000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00001720.00000002.70862.05430000.00000004.mdmp 00000000-00001720.00000002.70862.05620000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\PriorityControl|Win32PrioritySeparation" in Source: 00000000-00001720.00000002.70862.05430000.00000004.mdmp 00000000-00001720.00000002.70862.05620000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|RegisteredOrganization" in Source: 00000000-00001720.00000002.70862.05430000.00000004.mdmp 00000000-00001720.00000002.70862.05620000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\ProductOptions|ProductSuite" in Source: 00000000-00001720.00000002.70862.05430000.00000004.mdmp 00000000-00001720.00000002.70862.05620000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! ProductId" in Source: 00000000-00001720.00000002.70862.05430000.00000004.mdmp 00000000-00001720.00000002.70862.05620000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! VersionNumber" in Source: 00000000-00001720.00000002.70862.05430000.00000004.mdmp 00000000-00001720.00000002.70862.05620000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|RegisteredOwner" in Source: 00000000-00001720.00000002.70862.05430000.00000004.mdmp 00000000-00001720.00000002.70862.05620000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|ProductId" in Source: 00000000-00001720.00000002.70862.05430000.00000004.mdmp 00000000-00001720.00000002.70862.05620000.00000004.mdmp "GISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2EF29150-F243-4A1A-AC45-6410569F4F" in Source: 00000000-00003492.00000000.73362.003A0000.00000004.mdmp 00000000-00003492.00000001.74652.003F0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\W" in Source: 00000000-00003492.00000000.73362.003A0000.00000004.mdmp 00000000-00003492.00000001.74652.003F0000.00000004.mdmp 00000000-00004256.00000000.85402.00260000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BE33A527-42FE-43A4-AC5E-C1D059FC705F}" in Source: 00000000-00003492.00000000.73362.003A0000.00000004.mdmp "GISTRY\MACHINE\SOFTWARE\Classes\W`" in Source: 00000000-00003492.00000000.73362.003A0000.00000004.mdmp "HINE\SOFTWARE\Classes\Wow6432Node\C" in Source: 00000000-00003492.00000000.73362.003A0000.00000004.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00003492.00000001.74652.FF341000.00000020.mdmp 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp "GISTRY\MACHINE\SOFTWARE\Classes\W" in Source: 00000000-00004256.00000000.85402.00260000.00000004.mdmp "HINE\SOFTWARE\Classes\Wow6432Node\C@" in Source: 00000000-00004256.00000000.85402.00260000.00000004.mdmp "SOFTWARE\Classes\CLSID\{BE33A527-42FE-43A4-AC5E-C1D059FC705F}" in Source: 00000000-00004256.00000000.85402.00260000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004432.00000000.66256.00B00000.00000004.mdmp 00000000-00004432.00000001.66743.00B00000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00004432.00000000.66256.00B00000.00000004.mdmp38:T1406,"microzx.scr.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "microzx.scr.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "microzx.scr.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "microzx.scr.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "microzx.scr.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "microzx.scr.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "microzx.scr.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "microzx.scr.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "microzx.scr.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "microzx.scr.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "microzx.scr.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "microzx.scr.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "microzx.scr.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "microzx.scr.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "microzx.scr.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "microzx.scr.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "microzx.scr.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "microzx.scr.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "microzx.scr.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "microzx.scr.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "microzx.scr.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "microzx.scr.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "microzx.scr.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "microzx.scr.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "microzx.scr.exe" failed to load missing module "C:\vaultcli.dll" - [base:0; Status:c0000135] "microzx.scr.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "microzx.scr.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "microzx.scr.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135]39:T4f7a,"microzx.scr.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74730000 "microzx.scr.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "microzx.scr.exe" loaded module "KERNEL32" at base 76a40000 "microzx.scr.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "microzx.scr.exe" loaded module "ADVAPI32.DLL" at base 76800000 "microzx.scr.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72ed0000 "microzx.scr.exe" loaded module "SHLWAPI.DLL" at base 75960000 "microzx.scr.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "microzx.scr.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "microzx.scr.exe" loaded module "VERSION.DLL" at base 744e0000 "microzx.scr.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 71080000 "microzx.scr.exe" loaded module "USER32.DLL" at base 76c30000 "microzx.scr.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "microzx.scr.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "microzx.scr.exe" loaded module "MSCOREE.DLL" at base 73300000 "microzx.scr.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "microzx.scr.exe" loaded module "PSAPI.DLL" at base 75820000 "microzx.scr.exe" loaded module "KERNEL32.DLL" at base 76a40000 "microzx.scr.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 6fc70000 "microzx.scr.exe" loaded module "RPCRT4.DLL" at base 75a80000 "microzx.scr.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "microzx.scr.exe" loaded module "OLE32.DLL" at base 76200000 "microzx.scr.exe" loaded module "CRYPTBASE.DLL" at base 749c0000 "microzx.scr.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74230000 "microzx.scr.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 72e10000 "microzx.scr.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 72d80000 "microzx.scr.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6f210000 "microzx.scr.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 72940000 "microzx.scr.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 6e3a0000 "microzx.scr.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "microzx.scr.exe" loaded module "UXTHEME.DLL" at base 74230000 "microzx.scr.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 72d60000 "microzx.scr.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6db80000 "microzx.scr.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6da70000 "microzx.scr.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\URLMON.DLL" at base 0 "microzx.scr.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 759d0000 "microzx.scr.exe" loaded module "URLMON.DLL" at base 75f10000 "microzx.scr.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75f00000 "microzx.scr.exe" loaded module "SECUR32.DLL" at base 73c30000 "microzx.scr.exe" loaded module "SHELL32.DLL" at base 74a40000 "microzx.scr.exe" loaded module "OLEAUT32.DLL" at base 759e0000 "microzx.scr.exe" loaded module "CRYPTSP.DLL" at base 73fe0000 "microzx.scr.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 73cc0000 "microzx.scr.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "microzx.scr.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6d2f0000 "microzx.scr.exe" loaded module "NTDLL.DLL" at base 77130000 "microzx.scr.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76b50000 "microzx.scr.exe" loaded module "PROFAPI.DLL" at base 74a30000 "microzx.scr.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "microzx.scr.exe" loaded module "BCRYPT.DLL" at base 72d40000 "microzx.scr.exe" loaded module "IMM32.DLL" at base 76bd0000 "microzx.scr.exe" loaded module "COMCTL32.DLL" at base 6d260000 "microzx.scr.exe" loaded module "GDI32.DLL" at base 75780000 "microzx.scr.exe" loaded module "GDIPLUS.DLL" at base 73a90000 "microzx.scr.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 73a90000 "microzx.scr.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76a40000 "microzx.scr.exe" loaded module "AMSI.DLL" at base 0 "microzx.scr.exe" loaded module "WINDOWSCODECS.DLL" at base 73070000 "microzx.scr.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 6d070000 "microzx.scr.exe" loaded module "NTDLL" at base 77130000 "microzx.scr.exe" loaded module "PROPSYS.DLL" at base 740b0000 "microzx.scr.exe" loaded module "COMCTL32.DLL" at base 74300000 "microzx.scr.exe" loaded module "APPHELP.DLL" at base 74030000 "microzx.scr.exe" loaded module "CLBCATQ.DLL" at base 758d0000 "microzx.scr.exe" loaded module "%WINDIR%\SYSWOW64\IEFRAME.DLL" at base 6b630000 "microzx.scr.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 740b0000 "microzx.scr.exe" loaded module "SETUPAPI.DLL" at base 76060000 "microzx.scr.exe" loaded module "NTMARTA.DLL" at base 74080000 "microzx.scr.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 75f10000 "microzx.scr.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74030000 "microzx.scr.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 76b50000 "microzx.scr.exe" loaded module "RPCRTREMOTE.DLL" at base 73fd0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74730000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "powershell.exe" loaded module "KERNEL32" at base 76a40000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 76200000 "powershell.exe" loaded module "USERENV.DLL" at base 76470000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76b50000 "powershell.exe" loaded module "COMCTL32.DLL" at base 74300000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 76800000 "powershell.exe" loaded module "KERNEL32.DLL" at base 76a40000 "powershell.exe" loaded module "SHELL32.DLL" at base 74a40000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 759e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76a40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 740b0000 "powershell.exe" loaded module "SETUPAPI.DLL" at base 76060000 "powershell.exe" loaded module "NTMARTA.DLL" at base 74080000 "powershell.exe" loaded module "RPCRT4.DLL" at base 75a80000 "powershell.exe" loaded module "APPHELP.DLL" at base 74030000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 73c40000 "powershell.exe" loaded module "PROPSYS.DLL" at base 740b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 74a40000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 74a40000 "powershell.exe" loaded module "LINKINFO.DLL" at base 73460000 "powershell.exe" loaded module "PROFAPI.DLL" at base 74a30000 "powershell.exe" loaded module "USER32.DLL" at base 76c30000 "powershell.exe" loaded module "NTSHRUI.DLL" at base 73d90000 "powershell.exe" loaded module "SRVCLI.DLL" at base 73e50000 "powershell.exe" loaded module "CSCAPI.DLL" at base 73e40000 "powershell.exe" loaded module "SLC.DLL" at base 73e30000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 75960000 "powershell.exe" loaded module "CRYPTSP.DLL" at base 73fe0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 73cc0000 "powershell.exe" loaded module "CRYPTBASE.DLL" at base 749c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72ed0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "VERSION.DLL" at base 744e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL" at base 71280000 "powershell.exe" loaded module "MSCOREE.DLL" at base 73300000 "powershell.exe" loaded module "NTDLL" at base 77130000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 73300000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\199DD46435D7FDBBE590CCCD8C8AE9CB\MSCORLIB.NI.DLL" at base 6fdd0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\OLE32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\F3E2031575563C54B4BAB372BBE1453F\SYSTEM.NI.DLL" at base 6f620000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\07B924D7E3B2E6344530AAA8514942AA\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 72a60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT.A#\BB568276B4A8B4D6F64D115294DD5C3D\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 6eab0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "PSAPI.DLL" at base 75820000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 77130000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CORE\8B5F9B59ED667A576D891EEE157BF212\SYSTEM.CORE.NI.DLL" at base 6bb90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\E17FD2E5FAC93D8B9613BD5762BBD647\MICROSOFT.POWERSHELL.COMMANDS.DIAGNOSTICS.NI.DLL" at base 72980000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATIO#\4342ED1AAD046AA5EA9BB72BFBE99B8C\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 72cf0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.WSMAN.MAN#\E0652E0803F7A46306920B8043D23F52\MICROSOFT.WSMAN.MANAGEMENT.NI.DLL" at base 728f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.TRANSACTIONS\CEDBDD073E0BCAD91DBC5DDD921FFCA0\SYSTEM.TRANSACTIONS.NI.DLL" at base 6baf0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\2.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 71080000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\E4FC372B5FF973EEAC3DD6DAC72E36B2\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 6b950000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\83076F46A06276B5A16EF0BC246D1BEE\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 6b060000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\5509072E130E13708F7DCB8B5B527665\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 6b030000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL" at base 72d40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\BD2E0A351B1495ED6E0F5EB45BA9F3FE\SYSTEM.XML.NI.DLL" at base 6a260000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT\48155C7263CE0528F367ED4B3015CDC4\SYSTEM.MANAGEMENT.NI.DLL" at base 6a150000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DIRECTORYSER#\421EA4F1BCF6E3989B521D744A5B4A8F\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 6a030000 "powershell.exe" loaded module "SHFOLDER.DLL" at base 72d40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 73c30000 "powershell.exe" loaded module "SSPICLI.DLL" at base 749d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DATA\5091F8E36728E57DCDFD74B464281728\SYSTEM.DATA.NI.DLL" at base 699b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.DATA\2.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 696d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL" at base 69670000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DIASYMREADER.DLL" at base 69430000 "powershell.exe" loaded module "GDI32.DLL" at base 75780000 "powershell.exe" loaded module "NETUTILS.DLL" at base 73e20000 "microzx.scr.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 76bd0000 "microzx.scr.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72fb0000 "microzx.scr.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 708d0000 "microzx.scr.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 6d6a0000 "microzx.scr.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 73450000 "microzx.scr.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 729d0000 "microzx.scr.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6cc40000 "microzx.scr.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 710d0000 "microzx.scr.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 6bdd0000 "microzx.scr.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 728d0000 "microzx.scr.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6b130000 "microzx.scr.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6af20000 "microzx.scr.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6a7a0000 "microzx.scr.exe" loaded module "BCRYPT.DLL" at base 6a010000 "microzx.scr.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "microzx.scr.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "microzx.scr.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 69540000 "microzx.scr.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 69520000 "microzx.scr.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 72ce0000 "microzx.scr.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 69400000 "microzx.scr.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 693f0000 "microzx.scr.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 69350000 "microzx.scr.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "microzx.scr.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "microzx.scr.exe" loaded module "SSPICLI.DLL" at base 749d0000 "microzx.scr.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "microzx.scr.exe" loaded module "RASAPI32.DLL" at base 72da0000 "microzx.scr.exe" loaded module "RTUTILS.DLL" at base 72d70000 "microzx.scr.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 76b50000 "microzx.scr.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 76b50000 "microzx.scr.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "microzx.scr.exe" loaded module "WS2_32.DLL" at base 76420000 "microzx.scr.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 745c0000 "microzx.scr.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 72d60000 "microzx.scr.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 72d50000 "microzx.scr.exe" loaded module "RASMAN.DLL" at base 72d80000 "microzx.scr.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "microzx.scr.exe" loaded module "WINHTTP.DLL" at base 72cf0000 "microzx.scr.exe" loaded module "CREDSSP.DLL" at base 72a90000 "microzx.scr.exe" loaded module "IPHLPAPI.DLL" at base 742c0000 "microzx.scr.exe" loaded module "DHCPCSVC6.DLL" at base 74600000 "microzx.scr.exe" loaded module "DHCPCSVC.DLL" at base 74610000 "microzx.scr.exe" loaded module "NSI.DLL" at base 75760000 "microzx.scr.exe" loaded module "CFGMGR32.DLL" at base 76b70000 "microzx.scr.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 76b50000 "microzx.scr.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "microzx.scr.exe" loaded module "DNSAPI.DLL" at base 73d40000 "microzx.scr.exe" loaded module "RASADHLP.DLL" at base 72a80000 "microzx.scr.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72990000 "microzx.scr.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "microzx.scr.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 72940000 "microzx.scr.exe" loaded module "NCRYPT.DLL" at base 72900000 "microzx.scr.exe" loaded module "%WINDIR%\SYSWOW64\BCRYPTPRIMITIVES.DLL" at base 717f0000 "microzx.scr.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "microzx.scr.exe" loaded module "CRYPT32.DLL" at base 766d0000 "microzx.scr.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "microzx.scr.exe" loaded module "USERENV.DLL" at base 76470000 "microzx.scr.exe" loaded module "GPAPI.DLL" at base 72a60000 "microzx.scr.exe" loaded module "C:\VAULTCLI.DLL" at base 0 "microzx.scr.exe" loaded module "VAULTCLI.DLL" at base 73460000 "microzx.scr.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "microzx.scr.exe" loaded module "COMCTL32.DLL" at base 716c0000 "microzx.scr.exe" loaded module "C:\MICROZX.SCR.EXE" at base 400000 "microzx.scr.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 714d0000 "microzx.scr.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75eb0000 "microzx.scr.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 0 "microzx.scr.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 0 "microzx.scr.exe" loaded module "USER32" at base 76c300003a:T492,"0d000e002203347334f33c0039c5f672@ADVAPI32.dll" "0d000e00fe02347324f23c0039c5f672@ADVAPI32.dll" "0b000c00cc023473b4f53c0039c5f672@ADVAPI32.dll" "10001100da023473b8ec3c0039c5f672@ADVAPI32.dll" "150016003cdaf972a4ee3c006e00f872@ADVAPI32.dll" "0e000f00ecdaf972a4ee3c006e00f872@ADVAPI32.dll" "0e000f0048dbf972a4ee3c006e00f872@ADVAPI32.dll" "1100120024e3f972a4ee3c006e00f872@ADVAPI32.dll" "11001200c0e3f972a4ee3c006e00f872@ADVAPI32.dll" "1200130004e4f972a4ee3c006e00f872@ADVAPI32.dll" "120013005ce4f972a4ee3c006e00f872@ADVAPI32.dll" "140015008005fa72a4ee3c006e00f872@ADVAPI32.dll" "140015009805fa72a4ee3c006e00f872@ADVAPI32.dll" "14001500b005fa72a4ee3c006e00f872@ADVAPI32.dll" "17001800c805fa72a4ee3c006e00f872@ADVAPI32.dll" "0d000e00e005fa72a4ee3c006e00f872@ADVAPI32.dll" "0f0010000c07fa72a4ee3c006e00f872@ADVAPI32.dll" "140015004c07fa72a4ee3c006e00f872@ADVAPI32.dll" "140015006407fa72a4ee3c006e00f872@ADVAPI32.dll" "0c000d00ac07fa72a4ee3c006e00f872@ADVAPI32.dll" "0c000d00bc07fa72a4ee3c006e00f872@ADVAPI32.dll" "0e000f00cc07fa72a4ee3c006e00f872@ADVAPI32.dll" "180019003409fa72a4ee3c006e00f872@RPCRT4.dll" "130014006009fa72a4ee3c006e00f872@RPCRT4.dll"3b:T1634,"microzx.scr.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "microzx.scr.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "microzx.scr.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "microzx.scr.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "microzx.scr.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "microzx.scr.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "microzx.scr.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "microzx.scr.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "microzx.scr.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "microzx.scr.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "microzx.scr.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "microzx.scr.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "microzx.scr.exe" touched "Other Users Folder" (Path: "HKCU\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "microzx.scr.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "microzx.scr.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "microzx.scr.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "microzx.scr.exe" touched "Games Explorer" (Path: "HKCU\WOW6432NODE\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "microzx.scr.exe" touched "Computers and Devices" (Path: "HKCU\WOW6432NODE\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "microzx.scr.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "microzx.scr.exe" touched "Security Manager" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}") "powershell.exe" touched "Custom Destination List" (Path: "HKCU\WOW6432NODE\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}") "powershell.exe" touched "Start Menu Cache" (Path: "HKCU\WOW6432NODE\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}") "powershell.exe" touched "Start Menu Pin" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A2A9545D-A0C2-42B4-9708-A0B2BADD77C8}") "powershell.exe" touched "Taskband Pin" (Path: "HKCU\WOW6432NODE\CLSID\{90AA3A4E-1CBA-4233-B8BB-535773D48449}\TREATAS") "powershell.exe" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "Internet Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "User Pinned" (Path: "HKCU\WOW6432NODE\CLSID\{1F3427C8-5C10-4210-AA03-2EE45287D668}\SHELLFOLDER") "powershell.exe" touched "Shell File System Folder" (Path: "HKCU\WOW6432NODE\CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837}\INPROCSERVER32") "powershell.exe" touched "User Assist" (Path: "HKCU\WOW6432NODE\CLSID\{DD313E04-FEFF-11D1-8ECD-0000F87A470C}\TREATAS") "powershell.exe" touched "Shared Task Scheduler" (Path: "HKCU\WOW6432NODE\CLSID\{603D3801-BD81-11D0-A3A5-00C04FD706EC}\TREATAS") "powershell.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\WOW6432NODE\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\WOW6432NODE\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "microzx.scr.exe" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "microzx.scr.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "microzx.scr.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}") "microzx.scr.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}") "microzx.scr.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "microzx.scr.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "microzx.scr.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "microzx.scr.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS")3c:T5fc,"microzx.scr.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],inc edx,xor eax, 0x59463437,inc edi,push ebx,xor eax, 0x38354438,xor eax, 0x354f4741,aaa ,xor al, 0x47,cmp byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "DISMHOST.EXE.65E1AF00.bin" file has an entrypoint instructions - "sub rsp, 0x28,call 0x10000fcc0,add rsp, 0x28,jmp 0x10000f0b8,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],cmp rcx, qword ptr [rip + 0x6da9],jne 0x10000f40b,rol rcx, 0x10,test cx, 0xffff,jne 0x10000f407,ret 0,ror rcx, 0x10,jmp 0x10000fd7c,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x10], rbx,mov dword ptr [rsp + 0x18], r8d,mov qword ptr [rsp + 8], rcx,push rsi,push rdi,push r12,sub rsp, 0x40,"3d:T5b4,Observed system executable string:"/C:\ PROGRA~3 MICROS~1 WindowsSTARTM~1:((*ProgramsACCESS~1WINDOW~1:''*WINDOW~2.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPSmfutki7vv3/C:\ PROGRA~3 MICROS~1 WindowsSTARTM~1:((*ProgramsACCESS~1WINDOW~1:''*WINDOW~2.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPSmfutki7vv3/C:\WindowsSystem32WINDOW~1v1.0>;B*powershell_ise.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exe1SPS1SPSmfutki7vv3s,res,re/C:\Windowshh.exeC:\Windows\hh.exe%systemroot%\hh.exe1SPS1SPSmfutki7vv3m,rem,re" [Source: GW0R76LVV6Y4JLIZJ7FY.temp] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00004432-00000C41-27508765690] Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\microzx.scr.exe"" [Source: 00000000-00004432-00000C41-27508765690] Observed system executable string:"%WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe" [Source: 00000000-00004696-00000C28-5937890682]3e:T5b8,"microzx.scr.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "microzx.scr.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "microzx.scr.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "microzx.scr.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "microzx.scr.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "microzx.scr.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "microzx.scr.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "microzx.scr.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR") "microzx.scr.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR") "microzx.scr.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR-SA") "microzx.scr.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR-SA") "microzx.scr.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG")3f:Tfc9,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00004432-00000C25-46012568] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00004432-00000C25-46257206] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00004432-00000C25-47519314] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004432-00000C25-47612203] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00004432-00000C25-47767320] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00004432-00000C25-47826742] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00004432-00000C25-47905302] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00004432-00000C25-48120622] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00004432-00000C25-48194427] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00004432-00000C25-48250884] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00004432-00000C25-48312830] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00004432-00000C25-48462160] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00004432-00000C25-48604406] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00004432-00000C25-48674890] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00004432-00000C25-48949873] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" [Source: 00000000-00004432-00000C25-49129957] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00004432-00000C25-50524890] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00004432-00000C25-50866821] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00004432-00000C25-51206327] Observed system executable string:"%WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" [Source: 00000000-00004432-00000C25-51987442] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00004432-00000C25-52285559] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00004432-00000C25-52375937] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00004432-00000C25-52466517] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll" [Source: 00000000-00004432-00000C25-53344020] Observed system executable string:"%WINDIR%\SysWOW64\ieframe.dll" [Source: 00000000-00004432-00000C25-55561267]40:T6c2,"microzx.scr.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "") "microzx.scr.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: ""; Value: "") "microzx.scr.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES"; Key: ""; Value: "") "microzx.scr.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: ""; Value: "") "microzx.scr.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\PENDINGDELETE"; Key: ""; Value: "") "microzx.scr.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "microzx.scr.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "microzx.scr.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\SETTINGS\LANGUAGECONFIGURATION"; Key: ""; Value: "") "microzx.scr.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "microzx.scr.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "microzx.scr.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "microzx.scr.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "microzx.scr.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "microzx.scr.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "")41:Tce2,"microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "MICROZX.SCR"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESMYCOMPUTER"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESRECYCLEBIN"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCONTROLPANEL"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOSETFOLDERS"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOINTERNETICON"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCOMMONGROUPS"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{031E4825-7B94-4DC3-B131-E946B44C8DD5}"; Key: "SUPPRESSIONPOLICY"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{04731B67-D933-450A-90E6-4ACD2E9408FE}"; Key: "SUPPRESSIONPOLICY"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{11016101-E366-4D22-BC06-4ADA335C892B}"; Key: "SUPPRESSIONPOLICY"; Value: "")42:T508,"microzx.scr.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "microzx.scr.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "microzx.scr.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.windows.forms\c9a4cbc00f690a9e3cddfc400f6e85bb\system.windows.forms.ni.dll.aux" "microzx.scr.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "microzx.scr.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "microzx.scr.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.drawing\f7568d7f1b9d356f64779b4c0927cfb3\system.drawing.ni.dll.aux" "microzx.scr.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.configuration\96f7edb07b12303f0ec2595c7f3778c7\system.configuration.ni.dll.aux" "microzx.scr.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "microzx.scr.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.xml\15af16d373cf0528cb74fc73d365fdbf\system.xml.ni.dll.aux"43:T532,"microzx.scr.exe" trying to touch file "C:\Windows\SYSTEM32\wow64.dll" "microzx.scr.exe" trying to touch file "C:\Windows\SYSTEM32\wow64win.dll" "microzx.scr.exe" trying to touch file "C:\Windows\SYSTEM32\wow64cpu.dll" "microzx.scr.exe" trying to touch file "C:\Windows\system32\wow64log.dll" "microzx.scr.exe" trying to touch file "C:\Windows\SysWOW64\MSCOREE.DLL" "microzx.scr.exe" trying to touch file "C:\Windows\SysWOW64\sechost.dll" "microzx.scr.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "microzx.scr.exe" trying to touch file "C:\FLTLIB.DLL" "microzx.scr.exe" trying to touch file "C:\Windows\SysWOW64\FLTLIB.DLL" "microzx.scr.exe" trying to touch file "C:\Windows\SysWOW64\IMM32.DLL" "microzx.scr.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.DLL" "microzx.scr.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-1.DLL" "microzx.scr.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-1.DLL" "microzx.scr.exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" "microzx.scr.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "microzx.scr.exe" trying to touch file "C:\Windows\SysWOW64\MSCOREE.DLL.local" "microzx.scr.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll"44:T867,"microzx.scr.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "microzx.scr.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "microzx.scr.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "microzx.scr.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "microzx.scr.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "microzx.scr.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "microzx.scr.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "microzx.scr.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "powershell.exe" touched file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe.config" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" "powershell.exe" touched file "C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb" "powershell.exe" touched file "C:\Windows\System.Management.Automation.pdb" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\GW0R76LVV6Y4JLIZJ7FY.temp" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFfea9c.TMP" "powershell.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations"45:T5f9,"microzx.scr.exe" trying to access non-existent file "C:\Windows\system32\wow64log.dll" "microzx.scr.exe" trying to access non-existent file "C:\FLTLIB.DLL" "microzx.scr.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-1.DLL" "microzx.scr.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-1.DLL" "microzx.scr.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "microzx.scr.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "microzx.scr.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "microzx.scr.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "microzx.scr.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "microzx.scr.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-appmodel-runtime-l1-1-2.dll" "microzx.scr.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-appmodel-runtime-l1-1-0.dll" "microzx.scr.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "microzx.scr.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "microzx.scr.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-quirks-l1-1-0.dll"46:T58a,"microzx.scr.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.local" "microzx.scr.exe" trying to access non-existent file "C:\microzx.scr.exe.config" "microzx.scr.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "microzx.scr.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\Pnbn\" "microzx.scr.exe" trying to access non-existent file "C:\microzx.scr.INI" "microzx.scr.exe" trying to access non-existent file "C:\microzx.scr.exe:Zone.Identifier" "microzx.scr.exe" trying to access non-existent file "C:\microzx.scr.exe.Local\" "microzx.scr.exe" trying to access non-existent file "IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&2848384c&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" "microzx.scr.exe" trying to access non-existent file "IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&2848384c&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\" "microzx.scr.exe" trying to access non-existent file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe:Zone.Identifier" "microzx.scr.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "microzx.scr.exe" trying to access non-existent file "C:\MICROZX.SCR.EXE.CONFIG" "microzx.scr.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC"47:Tab6,Observed email domain:"smtp.gmail.com" [Source: PCAP] Observed email domain:"250-smtp.gmail.com at your service, [67.218.111.202]250-size 35882577250-8bitmime250-auth login plain xoauth2 plain-clienttoken oauthbearer xoauth250-enhancedstatuscodes250-pipelining250-chunking250 smtputf8" [Source: 00000000-00001720-00000C97-98061808] Observed email domain:"smtp.gmail.com" [Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.00900000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp 00000000-00001720.00000002.70862.05FC0000.00000004.mdmp] Observed email domain:"www.mail.google.com0" [Source: 00000000-00001720.00000001.68938.05FC0000.00000004.mdmp 00000000-00001720.00000002.70862.05FC0000.00000004.mdmp] Observed email domain:"byhost:smtp.gmail.com:587" [Source: 00000000-00001720.00000002.70862.02810000.00000004.mdmp] Observed email domain:"smtp.gmail.com:587" [Source: 00000000-00001720.00000002.70862.02810000.00000004.mdmp] Observed email domain:"http://smtp.gmail.com" [Source: 00000000-00001720.00000002.70862.02810000.00000004.mdmp] Observed email domain:"smtp." [Source: 00000000-00001720.00000002.70862.02810000.00000004.mdmp] Observed email domain:"smtp.gmail" [Source: 00000000-00001720.00000002.70862.02810000.00000004.mdmp] Observed email domain:"smtp.gmail." [Source: 00000000-00001720.00000002.70862.02810000.00000004.mdmp] Observed email domain:"smtp.gmail.com e" [Source: 00000000-00001720.00000002.70862.02810000.00000004.mdmp] Observed email domain:"smtp.gmail.com esmtp kr11-20020a170903080b00b001dcb560d7f0sm1992833plb.11 - gsmtp" [Source: 00000000-00001720.00000002.70862.02810000.00000004.mdmp] Observed email domain:"smtp.gmail.com a" [Source: 00000000-00001720.00000002.70862.02810000.00000004.mdmp] Observed email domain:"smtp.gmail.com at your service, [67.218.111.202]" [Source: 00000000-00001720.00000002.70862.02810000.00000004.mdmp] Observed email domain:"system.net.mail.smtppooledstream" [Source: 00000000-00001720.00000002.70862.02810000.00000004.mdmp] Observed email domain:"smtp.gmail.com esmtp lf7-20020a170902fb4700b001dcc97aa8fasm751plb.17 - gsmtp" [Source: 00000000-00001720.00000002.70862.02810000.00000004.mdmp] Observed email domain:"smtp.gmail.com esmtp y33-20020a17090a53a400b0029ab5abcbe1sm16560pjh.20 - gsmtp" [Source: 00000000-00001720.00000002.70862.02810000.00000004.mdmp] Observed email domain:"smtp.gmail.com0y0" [Source: 00000000-00001720.00000002.70862.02810000.00000004.mdmp 00000000-00001720.00000002.70862.05FC0000.00000004.mdmp] Observed email domain:"smtp.gmail.com0!" [Source: 00000000-00001720.00000002.70862.02810000.00000004.mdmp 00000000-00001720.00000002.70862.05FC0000.00000004.mdmp]48:Tf1e,"1.3.0.0" "16.0.0.0" "10.0.0.0" "2.0.0.0" "1.0.0.0" Potential IP "67.218.111.202" found in string "250-smtp.gmail.com at your service, [67.218.111.202]250-SIZE 35882577250-8BITMIME250-AUTH LOGIN PLAIN XOAUTH2 PLAIN-CLIENTTOKEN OAUTHBEARER XOAUTH250-ENHANCEDSTATUSCODES250-PIPELINING250-CHUNKING250 SMTPUTF8" Potential IP "4.0.0.0" found in string "ystem.Windows.Forms,4.0.0.0,,b77a5c561934e089" Potential IP "4.0.0.0" found in string "on=4.0.0.0, Culture=" "192.168.243.162" Potential IP "4.0.0.0" found in string ":4.0.0.0," Potential IP "4.0.0.0" found in string "n=4.0.0.0, C" Potential IP "4.0.0.0" found in string "4.0.0.0, Cul" Potential IP "0.0.0.0" found in string "0.0.0.0, Cul" Potential IP "4.0.0.0" found in string "4.0.0.0," "67.218.111.202" "255.255.252.0" "192.168.240.1" "8.8.8.8" "8.8.4.4" "2.5.29.16" "2.5.29.10" "2.5.29.19" "2.5.29.14" "2.5.29.15" "2.5.29.37" "2.5.29.31" Potential IP "4.0.0.0" found in string "Arithmetic operation resulted in an overflow.rsion=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" "255.255.255.255" Potential IP "2.5.29.37" found in string "%2.5.29.37" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.17" "2.5.29.32" "2.5.29.1" "2.5.4.3" "2.5.29.4" Potential IP "4.0.0.0" found in string "Cannot access a disposed object. an overflow.rsion=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" Potential IP "67.218.111.202" found in string "Time: 02/29/2024 04:52:05
User Name: sfy3RDQ
Computer Name: mFUTKI7vV3
OSFullName: Microsoft Windows 7 Professional
CPU: Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz
RAM: 8191 MB
IP Address: 67.218.111.202
" Potential IP "67.218.111.202" found in string "Time: 02/29/2024 04:52:05
User Name: sfy3RDQ
Computer Name: mFUTKI7vV3
OSFullName: Microsoft Windows 7 Professional
CPU: Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz
RAM: 8191 MB
IP Address: 67.218.111.202

" Potential IP "67.218.111.202" found in string "smtp.gmail.com at your service, [67.218.111.202]" Potential IP "67.218.111.202" found in string "t your service, [67.218.111.202]" Potential IP "67.218.111.202" found in string "Time: 02/29/2024 06:04:45
User Name: sfy3RDQ
Computer Name: mFUTKI7vV3
OSFullName: Microsoft Windows 7 Professional
CPU: Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz
RAM: 8191 MB
IP Address: 67.218.111.202
" Potential IP "67.218.111.202" found in string "Time: 02/29/2024 06:04:45
User Name: sfy3RDQ
Computer Name: mFUTKI7vV3
OSFullName: Microsoft Windows 7 Professional
CPU: Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz
RAM: 8191 MB
IP Address: 67.218.111.202

" Potential IP "67.218.111.202" found in string "Time: 02/29/2024 07:18:25
User Name: sfy3RDQ
Computer Name: mFUTKI7vV3
OSFullName: Microsoft Windows 7 Professional
CPU: Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz
RAM: 8191 MB
IP Address: 67.218.111.202
" Potential IP "67.218.111.202" found in string "Time: 02/29/2024 07:18:25
User Name: sfy3RDQ
Computer Name: mFUTKI7vV3
OSFullName: Microsoft Windows 7 Professional
CPU: Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz
RAM: 8191 MB
IP Address: 67.218.111.202

" Potential IP "67.218.111.202" found in string ", [67.218.111.202]" Potential IP "67.218.111.202" found in string "vice, [67.218.111.202]" Potential IP "67.218.111.202" found in string "at your service, [67.218.111.202]" Potential IP "67.218.111.202" found in string "IP Address: 67.218.111.202

" Potential IP "4.0.0.0" found in string "ystem.Numerics,4.0.0.0,,b77a5c561934e089,MSIL" Potential IP "4.0.0.0" found in string "on=4.0.0.0, Culture=neutral, PublicKey" Potential IP "4.0.0.0" found in string "=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" "3.0.1.0" "1.3.1.0" "0.0.0.7" "0.0.0.1"49:T3233,Heuristic match: "3W.lB" Heuristic match: "?'R[.ng" Heuristic match: "8{.Sl" Heuristic match: "shawnpick.com" Pattern match: "http://www.shawnpick.com" Heuristic match: "api.ipify.org" Heuristic match: "smtp.gmail.com" Heuristic match: "npick.com" Heuristic match: "ww.shawnpick.com" Heuristic match: "ttps://api.ipify.org" Heuristic match: "nternetaccess.com" Heuristic match: "%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\e0652e0803f7a46306920b8043d23f52\Microsoft.WSMan.Management.ni" Heuristic match: "C:\%SystemRoot%\system32\WindowsPowerShell\v1.0\Add-MpPreference.COM" Heuristic match: "%ALLUSERSPROFILE%\Oracle\Java\javapath\Add-MpPreference.COM" Heuristic match: "%WINDIR%\system32\Add-MpPreference.COM" Heuristic match: "%WINDIR%\Add-MpPreference.COM" Heuristic match: "%WINDIR%\System32\Wbem\Add-MpPreference.COM" Heuristic match: "%WINDIR%\System32\WindowsPowerShell\v1.0\Add-MpPreference.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python38\Scripts\Add-MpPreference.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python38\Add-MpPreference.COM" Heuristic match: "mtp.gmail.com" Heuristic match: "icromeqbd@gmail.com" Heuristic match: "rivateinternetaccess.com" Heuristic match: "altalk.com" Heuristic match: "rillian.im" Heuristic match: "iscord.com" Heuristic match: ".Http.Tr" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=42127" Heuristic match: "zation.Formatters.So" Heuristic match: "ntrust.net" Heuristic match: "CIM_System.Name" Pattern match: "www.digicert.com1$0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "7www.entrust.net/CPS_2048" Pattern match: "www.digicert.com1+0" Pattern match: "http://www.certplus.com/CRL/class2.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/STCA.crl0" Heuristic match: "/.NET/NetClasses/HttpWebRequest/CONNECT__Group$$/" Pattern match: "http://www.w3.org/2000/09/xmldsig#dsa-sha1" Pattern match: "http://www.w3.org/2000/09/xmldsig#rsa-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" Pattern match: "http://www.w3.org/2000/09/xmldsig#sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha256" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha512" Pattern match: "http://www.w3.org/2001/04/xmlenc#ripemd160" Pattern match: "http://www.w3.org/2001/04/xmlenc#des-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-tripledes" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes128-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes128" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes192-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes192" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes256-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes256" Pattern match: "http://www.w3.org/TR/2001/REC-xml-c14n-20010315" Pattern match: "http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#WithComments" Pattern match: "http://www.w3.org/2000/09/xmldsig#base64" Pattern match: "http://www.w3.org/TR/1999/REC-xpath-19991116" Pattern match: "http://www.w3.org/TR/1999/REC-xslt-19991116" Pattern match: "http://www.w3.org/2000/09/xmldsig#enveloped-signature" Pattern match: "http://www.w3.org/2002/07/decrypt#XML" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "http://www.w3.org/2001/04/xmlenc#" Pattern match: "http://www.w3.org/2000/09/xmldsig#hmac-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/XML/1998/namespace" Pattern match: "http://schemas.microsoft.com/.NetConfiguration/v2.0" Pattern match: "system.web/anonymousIdentification" Pattern match: "system.web/authentication" Pattern match: "system.web/authorization" Pattern match: "system.web/browserCaps" Pattern match: "system.web/clientTarget" Pattern match: "system.web/compilation" Pattern match: "system.web/customErrors" Pattern match: "system.web/deployment" Pattern match: "system.web/deviceFilters" Pattern match: "system.web/fullTrustAssemblies" Pattern match: "system.web/globalization" Pattern match: "system.web/healthMonitoring" Pattern match: "system.web/hostingEnvironment" Pattern match: "system.web/httpCookies" Pattern match: "system.web/httpHandlers" Pattern match: "system.web/httpModules" Pattern match: "system.web/httpRuntime" Pattern match: "system.web/identity" Pattern match: "system.web/machineKey" Pattern match: "system.web/membership" Pattern match: "system.web/mobileControls" Pattern match: "system.web/pages" Pattern match: "system.web/partialTrustVisibleAssemblies" Pattern match: "system.web/processModel" Pattern match: "system.web/profile" Pattern match: "system.web/protocols" Pattern match: "system.web/roleManager" Pattern match: "system.web/securityPolicy" Pattern match: "system.web/sessionPageState" Pattern match: "system.web/sessionState" Pattern match: "system.web/siteMap" Pattern match: "system.web/trace" Pattern match: "system.web/trust" Pattern match: "system.web/urlMappings" Pattern match: "system.web/webControls" Pattern match: "system.web/webParts" Pattern match: "system.web/webServices" Pattern match: "system.web/xhtmlConformance" Pattern match: "system.web/caching" Pattern match: "system.web/caching/cache" Pattern match: "system.web/caching/outputCache" Pattern match: "system.web/caching/outputCacheSettings" Pattern match: "system.web/caching/sqlCacheDependency" Pattern match: "https://api.ipify.org" Heuristic match: "micromeqbd@gmail.com" Pattern match: "http://schemas.microsoft.com/clr/" Pattern match: "http://schemas.microsoft.com/clr/assem/" Pattern match: "http://schemas.microsoft.com/clr/ns/" Pattern match: "http://schemas.microsoft.com/clr/nsassem/" Pattern match: "https://api.ipify.org/" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/XMLSchema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Heuristic match: "privateinternetaccess.com" Heuristic match: "discord.com" Heuristic match: "trillian.im" Pattern match: "https://api.ipif8" Pattern match: "http://api.ipify.org" Heuristic match: "Host: api.ipify.org" Pattern match: "http://ocsp.pki.goog/s/gts1p5/h5rSjB8akzs01" Pattern match: "http://pki.goog/repo/certs/gts1p5.der0" Heuristic match: "ipify.org" Pattern match: "http://crls.pki.goog/gts1p5/s4S0cWQvaPw.crl0" Pattern match: "http://ocsp.pki.goog/gtsr100" Pattern match: "http://pki.goog/repo/certs/gtsr1.der04" Pattern match: "http://crl.pki.goog/gtsr1/gtsr1.crl0M" Pattern match: "https://pki.goog/repository/0" Pattern match: "http://ocsp.pki.goog/gsr10" Pattern match: "http://pki.goog/gsr1/gsr1.crt02" Pattern match: "http://crl.pki.goog/gsr1/gsr1.crl0" Heuristic match: "MIF.DM" Heuristic match: ",sv2.sv" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q" Pattern match: "http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "www.digicert.com1" Pattern match: "http://ocsp.digicert.com0" Pattern match: "crl3.digicert.com/DigiCertGlobalRootCA.crl07" Pattern match: "crl4.digicert.com/DigiCertGlobalRootCA.crl0=" Pattern match: "https://www.digicert.com/CPS0" Pattern match: "http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v" Pattern match: "crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0F" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0L" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/AddTrustExternalCARoot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/CPS" Pattern match: "https://www.verisign.com/CPS04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "http://www.usertrust.com1" Pattern match: "https://secure.comodo.com/CPS0" Pattern match: "crl.comodoca.com/UTN-USERFirst-Hardware.crl06" Pattern match: "crl.comodo.net/UTN-USERFirst-Hardware.crl0q" Pattern match: "http://crt.comodoca.com/UTNAddTrustServerCA.crt0$" Pattern match: "http://ocsp.comodoca.com05" Heuristic match: "addons.mozilla.org" Pattern match: "www.addons.mozilla.org0" Pattern match: "www.google.com0" Pattern match: "http://ocsp.comodoca.com0%" Pattern match: "www.google.com" Pattern match: "http://www.public-trust.com/CPS/OmniRoot.html0" Pattern match: "www.public-trust.com/cgi-bin/CRL/2018/cdp.crl0" Pattern match: "http://ocsp.comodoca.com0/" Heuristic match: "login.skype.com" Pattern match: "www.login.skype.com0" Pattern match: "2www.entrust.net/CPS" Pattern match: "http://ocsp.entrust.net03" Pattern match: "http://crl.entrust.net/server1.crl0" Pattern match: "http://www.diginotar.nl/cps/pkioverheid0" Pattern match: "http://crl.pkioverheid.nl/DomOvLatestCRL.crl0" Pattern match: "http://cybertrust.omniroot.com/repository.cfm0" Pattern match: "crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0" Heuristic match: "login.yahoo.com" Pattern match: "www.login.yahoo.com0" Pattern match: "www.verisign.com/repository/CPS" Pattern match: "https://www.verisign.com/repository/CPS" Pattern match: "https://www.verisign.com" Pattern match: "www.verisign.com/repository/verisignlogo.gif0D" Pattern match: "https://www.verisign.com/rpa0" Heuristic match: "mail.google.com" Pattern match: "www.mail.google.com0" Pattern match: "http://ocsp.entrust.net0D" Pattern match: "http://www.digicert.com.my/cps.htm02" Pattern match: "http://crl.entrust.net/2048ca.crl0" Pattern match: "http://ocsp.comodoca.com0-" Heuristic match: "login.live.com" Pattern match: "www.login.live.com0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T" Pattern match: "www.microsoft.com/pki/certs/MicrosoftRootCert.crt0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/CPS" Pattern match: "www.digicert.com1!0" Pattern match: "crl.comodoca.com/AAACertificateServices.crl06" Pattern match: "crl.comodo.net/AAACertificateServices.crl0" Pattern match: "crl.usertrust.com/UTN-USERFirst-Object.crl0" Pattern match: "http://www.microsoft.com/windows0" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt07" Pattern match: "http://crl.pki.goog/gtsr1/gtsr1.crl0W" Heuristic match: "hawnpick.com" Pattern match: "www.shawnpick.com" Heuristic match: "gmail.com" Pattern match: "http://smtp.gmail.com" Pattern match: "http://ocsp.pki.goog/gts1c301" Pattern match: "http://pki.goog/repo/certs/gts1c3.der0" Pattern match: "http://crls.pki.goog/gts1c3/fVJxbV-Ktmk.crl0" Heuristic match: "From: micromeqbd@gmail.com" Heuristic match: "To: micromeqbd@gmail.com" Heuristic match: "CIM_ComputerSystem.Name" Heuristic match: "tp.gmail.com" Heuristic match: "SF;.WS" Heuristic match: "XT=.CO" Heuristic match: "stem.Co" Heuristic match: "s type=System.Web.Co"4a:T68bb,Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00001720.00000000.67016.00900000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn9iqmgvw,czcf*9v)" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;geotrust" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]izttpsalt" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/p1<92a@ef" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5osalt" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynslentrust.net1;092www.entrust.net/cps" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'ek" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,!!0iku>swinternet1verisign," - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0salt" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nki0!!salt" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!et/c6162x't,0a0" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?,%2+jo;8kbentrust.net1@0>7www.entrust.net/cps_2048" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:tqg.," - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0c[fd?bbmf89b$jd" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrussjcom1" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?suuuhhsmqdy32" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0990709183120z190709184036z0salt" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0;09071http://crl.usertrust.com/utn-userfirst-object.crl0)k%%-qcn>k't" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=.3.1.3.2/rf,/rf,q*iq=.3.8stem.stem.3.6.1.5.5.7.3.23.6.1.5.5.7.3.13.6.1.5.5.7.3.1%2+jo;8kbpijlf0" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0>^" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=1.3.6.1.4.1.311.10.1210316072924z0/^g(o-cejy" - Source: "00000000-00001720.00000001.68938.05FC0000.00000004.mdmp") Found URL "http://ocsp.pki.goog/gsr10)http://pki.goog/gsr1/gsr1.crt02+0)0'!http://crl.pki.goog/gsr1/gsr1.crl0;40207okzgm=" - Source: "00000000-00001720.00000002.70862.00900000.00000004.mdmp") Found URL "http://ocsp.pki.goog/gtsr100$http://pki.goog/repo/certs/gtsr1.der04-0+0)" - Source: "00000000-00001720.00000002.70862.00900000.00000004.mdmp") Found URL "http://crl.pki.goog/gtsr1/gtsr1.crl0wp0n080*0(https://pki.goog/repository/0fi_fd[*p" - Source: "00000000-00001720.00000002.70862.00900000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn9iqmgvw,czcf*9v)" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;geotrust" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]v4vpizttpsalt" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/p1<92a@ef" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5osalt" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynslentrust.net1;092www.entrust.net/cps" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'ek" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,!!0iku>swinternet1verisign," - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0salt" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nki0!!salt" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!et/c6162x't,0a0" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?,%2+jo;8kbentrust.net1@0>7www.entrust.net/cps_2048" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:tqg.," - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0c[fd?bbmf89b$jd" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrussjcom1" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?suuuhhsmqdy32" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0990709183120z190709184036z0salt" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0;09071http://crl.usertrust.com/utn-userfirst-object.crl0)k%%-qcn>k't" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=k.$+k.$'k.$" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0>^" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=1.3.6.1.4.1.311.10.1210316072924z0/^g(o-cejy" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://ocsp.pki.goog/gsr10)http://pki.goog/gsr1/gsr1.crt02+0)0'!http://crl.pki.goog/gsr1/gsr1.crl0;40207okzgm=" - Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00004432.00000001.66743.00B00000.00000004.mdmp")4b:T5d2,Found string "+ncalrpc:[OLECC33D02124054F8B952F2A49683D]" (Indicator: "ncalrpc"; Source: "00000000-00001720.00000001.68938.00900000.00000004.mdmp, 00000000-00001720.00000002.70862.00900000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00001720.00000001.68938.00900000.00000004.mdmp, 00000000-00001720.00000002.70862.00900000.00000004.mdmp") Found string "+ncalrpc:[OLE6EA6281334F84EE0AB16AB6CEDD3]" (Indicator: "ncalrpc"; Source: "00000000-00001720.00000001.68938.00900000.00000004.mdmp, 00000000-00001720.00000002.70862.00900000.00000004.mdmp") Found string "B+ncalrpc:[OLE6EA6281334F84EE0AB16AB6CEDD3]" (Indicator: "ncalrpc"; Source: "00000000-00001720.00000001.68938.00900000.00000004.mdmp, 00000000-00001720.00000002.70862.00900000.00000004.mdmp") Found string "+ncalrpc:[OLEFBB865D3A1634DEEAA2B08B7046C]" (Indicator: "ncalrpc"; Source: "00000000-00003492.00000000.73362.003A0000.00000004.mdmp") Found string "+ncalrpc:[OLE94265C41988945D1BF0515A04D79]" (Indicator: "ncalrpc"; Source: "00000000-00003492.00000000.73362.003A0000.00000004.mdmp, 00000000-00003492.00000001.74652.003F0000.00000004.mdmp") Found string "+ncalrpc:[OLE615AF02F3136418291EF9DDE5405]" (Indicator: "ncalrpc"; Source: "00000000-00004256.00000000.85402.00260000.00000004.mdmp") Found string "+ncalrpc:[OLE476DF64CEEDB4E3184DAE4DABA54]" (Indicator: "ncalrpc"; Source: "00000000-00004256.00000000.85402.00260000.00000004.mdmp")4c:T9b4,"microzx.scr.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004432) "microzx.scr.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00004432) "microzx.scr.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004432) "microzx.scr.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00004432) "microzx.scr.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00004432) "microzx.scr.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00004432) "microzx.scr.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00004432) "microzx.scr.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00004432) "microzx.scr.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00004432) "microzx.scr.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00004432) "microzx.scr.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00004432) "microzx.scr.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00004432) "microzx.scr.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00004432) "microzx.scr.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00004432) "microzx.scr.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00004432) "microzx.scr.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00004432) "microzx.scr.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00004432) "microzx.scr.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00004432) "microzx.scr.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00004432) "microzx.scr.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00004432) "microzx.scr.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00004432) "microzx.scr.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00004432) "microzx.scr.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00004432) "microzx.scr.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00004432)4d:T1031,Found string "BCRYPT_AES_ALGORITHM" (Indicator: "aes"; File: "00001720.000006B8.11790014.00402000.wprm") Found string "RijndaelManaged" (Indicator: "rijndael"; File: "00001720.000006B8.11790014.00402000.wprm") Found string "RijndaelManaged" (Indicator: "Rijndaelmanaged"; File: "00001720.000006B8.11790014.00402000.wprm") Found string "CryptoStreamMode" (Indicator: "cryptostream"; File: "00001720.000006B8.11790014.00402000.wprm") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; File: "00001720.000006B8.11790014.00402000.wprm") Found string "FromBase64String" (Indicator: "base64"; File: "00001720.000006B8.11790014.00402000.wprm") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "00001720.000006B8.11790014.00402000.wprm") Found string "ToBase64String" (Indicator: "base64"; File: "00001720.000006B8.11790014.00402000.wprm") Found string "ToBase64String" (Indicator: "ToBase64String"; File: "00001720.000006B8.11790014.00402000.wprm") Found string "Rijndael" (Indicator: "rijndael"; File: "00001720.000006B8.11790014.00402000.wprm") Found string "CryptoStream" (Indicator: "cryptostream"; File: "00001720.000006B8.11790014.00402000.wprm") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; File: "00001720.000006B8.11790014.00402000.wprm") Found string "RNGCryptoServiceProvider" (Indicator: "rngcryptoserviceprovider"; File: "00001720.000006B8.11790014.00402000.wprm") Found string "TripleDESCryptoServiceProvider" (Indicator: "tripledescryptoserviceprovider"; File: "00001720.000006B8.11790014.00402000.wprm") Found string "CreateDecryptor" (Indicator: "createdecryptor"; File: "00001720.000006B8.11790014.00402000.wprm") Found string "CreateEncryptor" (Indicator: "createencryptor"; File: "00001720.000006B8.11790014.00402000.wprm") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; File: "00001720.000006B8.11790014.00402000.wprm") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "00001720.000006B8.11790014.00402000.wprm") Found string "" (Indicator: "base64"; File: "00001720.000006B8.11790014.00402000.wprm") Found string "Pass encoding="base64">" (Indicator: "base64"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found string "BCRYPT_AES_ALGORITHM" (Indicator: "aes"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found string "RijndaelManaged" (Indicator: "rijndael"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found string "RijndaelManaged" (Indicator: "Rijndaelmanaged"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostream"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found string "ToBase64String" (Indicator: "base64"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found string "ToBase64String" (Indicator: "ToBase64String"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found string "Rijndael" (Indicator: "rijndael"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp, 00000000-00001720.00000001.68938.02810000.00000004.mdmp, 00000000-00001720.00000002.70862.02810000.00000004.mdmp") Found string "CryptoStream" (Indicator: "cryptostream"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found string "RNGCryptoServiceProvider" (Indicator: "rngcryptoserviceprovider"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp")4e:T7e6,Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00004432.00000001.66743.005D0000.00000004.mdmp")4f:T68d,Found reference to API "GetTempPath" (Indicator: "GetTempPath"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "00001720.000006B8.11790014.00402000.wprm") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found reference to API "Win32API|System Information Functions|GetSystemDirectory|\drivers\etc\lmhosts" (Indicator: "GetSystemDirectory"; Source: "00000000-00001720.00000001.68938.05465000.00000004.mdmp, 00000000-00001720.00000001.68938.0546A000.00000004.mdmp") Found reference to API "Win32API|System Information Functions|GetSystemDirectory" (Indicator: "GetSystemDirectory"; Source: "00000000-00001720.00000002.70862.05430000.00000004.mdmp, 00000000-00001720.00000002.70862.05620000.00000004.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API "GetTempFileName" (Indicator: "GetTempFileName"; Source: "00000000-00004432.00000001.66743.005D0000.00000004.mdmp") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; Source: "00000000-00004432.00000001.66743.005D0000.00000004.mdmp")50:Tce8,Found string "k__BackingField" (Indicator: "password"; File: "00001720.000006B8.11790014.00402000.wprm") Found string "get_password" (Indicator: "password"; File: "00001720.000006B8.11790014.00402000.wprm") Found string "set_password" (Indicator: "password"; File: "00001720.000006B8.11790014.00402000.wprm") Found string "passwordVaultPtr" (Indicator: "password"; File: "00001720.000006B8.11790014.00402000.wprm") Found string "password_value" (Indicator: "password"; File: "00001720.000006B8.11790014.00402000.wprm") Found string "\passwordstorerc" (Indicator: "password"; File: "00001720.000006B8.11790014.00402000.wprm") Found string "er_password>" (Indicator: "password"; File: "00001720.000006B8.11790014.00402000.wprm") Found string "cpassword" (Indicator: "password"; File: "00001720.000006B8.11790014.00402000.wprm") Found string "passwordstorerc" (Indicator: "password"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found string "*"password":"(.*?)"" (Indicator: "password"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found string "server_user_password>" (Indicator: "password"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found string "/server_user_password>" (Indicator: "password"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found string "yncpassword" (Indicator: "password"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found string "password>" (Indicator: "password"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found string "/password>" (Indicator: "password"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found string "k__BackingField" (Indicator: "password"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found string "get_password" (Indicator: "password"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found string "set_password" (Indicator: "password"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found string "passwordVaultPtr" (Indicator: "password"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found string "passwordStrengthRegularEx" (Indicator: "password"; Source: "00000000-00001720.00000001.68938.00900000.00000004.mdmp, 00000000-00001720.00000002.70862.00900000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00001720.00000001.68938.00900000.00000004.mdmp, 00000000-00001720.00000002.70862.00900000.00000004.mdmp") Found string "password_value" (Indicator: "password"; Source: "00000000-00001720.00000001.68938.02810000.00000004.mdmp, 00000000-00001720.00000002.70862.02810000.00000004.mdmp") Found string "syncpassword" (Indicator: "password"; Source: "00000000-00001720.00000001.68938.02810000.00000004.mdmp, 00000000-00001720.00000002.70862.02810000.00000004.mdmp") Found string "\passwordstorerc" (Indicator: "password"; Source: "00000000-00001720.00000001.68938.02810000.00000004.mdmp, 00000000-00001720.00000002.70862.02810000.00000004.mdmp") Found string "" (Indicator: "password"; Source: "00000000-00001720.00000001.68938.02810000.00000004.mdmp, 00000000-00001720.00000002.70862.02810000.00000004.mdmp")51:Td17,"\Claws-mail" in Source: 00001720.000006B8.11790014.00402000.wprm "oft\Office\12.0\Outlook\Profiles" in Source: 00001720.000006B8.11790014.00402000.wprm "oft\Office\15.0\Outlook\Profiles" in Source: 00001720.000006B8.11790014.00402000.wprm "irtualStore\Program Files\Foxmail\mail" in Source: 00001720.000006B8.11790014.00402000.wprm "il\Opera Mail\wand.dat" in Source: 00001720.000006B8.11790014.00402000.wprm "\Thunderbird\" in Source: 00001720.000006B8.11790014.00402000.wprm "oftware\Microsoft\Office\11.0\Outlook\Profiles" in Source: 00000000-00001720.00000000.67016.00400000.00000040.mdmp "oftware\Microsoft\Office\12.0\Outlook\Profiles" in Source: 00000000-00001720.00000000.67016.00400000.00000040.mdmp "oftware\Microsoft\Office\14.0\Outlook\Profiles" in Source: 00000000-00001720.00000000.67016.00400000.00000040.mdmp "oftware\Microsoft\Office\15.0\Outlook\Profiles" in Source: 00000000-00001720.00000000.67016.00400000.00000040.mdmp "oftware\Microsoft\Office\16.0\Outlook\Profiles" in Source: 00000000-00001720.00000000.67016.00400000.00000040.mdmp "VirtualStore\Program Files\Foxmail\mail" in Source: 00000000-00001720.00000000.67016.00400000.00000040.mdmp "VirtualStore\Program Files (x86)\Foxmail\mail" in Source: 00000000-00001720.00000000.67016.00400000.00000040.mdmp "Opera Mail\Opera Mail\wand.dat" in Source: 00000000-00001720.00000000.67016.00400000.00000040.mdmp "\Postbox\" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "\Thunderbird\" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Thunderbird\" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Postbox\" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Thunderbird\profiles.ini" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Thunderbird\profile" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Could not find a part of the path 'C:\Users\HAPUBWS\AppData\Roaming\Thunderbird\profiles.ini'." in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Postbox\profiles.ini" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Postbox\profile" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Could not find a part of the path 'C:\Users\HAPUBWS\AppData\Roaming\Postbox\profiles.ini'." in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp "Software\Microsoft\Office\11.0\Outlook\Profiles" in Source: 00000000-00001720.00000001.68938.02810000.00000004.mdmp 00000000-00001720.00000002.70862.02810000.00000004.mdmp52:Tb18,"SOFTWARE\FTPWare\COREFTP\Sites" (Indicator: "software\ftpware\coreftp\sites") "igator\Ftplist.txt" (Indicator: "ftplist.txt") "rtualStore\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftp commander") "rtualStore\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftplist.txt") "rogram Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftp commander") "rogram Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftplist.txt") "\Ftplist.txt" (Indicator: "ftplist.txt") "FTP Navigator\Ftplist.txt" (Indicator: "ftp navigator") "FTP Navigator\Ftplist.txt" (Indicator: "ftplist.txt") "pswitch\WS_FTP\Sites\ws_ftp.ini" (Indicator: "ws_ftp") "VirtualStore\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftp commander") "VirtualStore\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftplist.txt") "Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftp commander") "Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftplist.txt") "VirtualStore\Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftp commander") "VirtualStore\Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftplist.txt") "Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftp commander") "Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftplist.txt") "cftp\Ftplist.txt" (Indicator: "ftplist.txt") "FTP Navigator" (Indicator: "ftp navigator") "WS_FTP" (Indicator: "ws_ftp") "quick.dat" (Indicator: "quick.dat") "\FTP Navigator\Ftplist.txt" (Indicator: "ftp navigator") "\FTP Navigator\Ftplist.txt" (Indicator: "ftplist.txt") "Could not find a part of the path 'C:\FTP Navigator\Ftplist.txt'." (Indicator: "ftp navigator") "Could not find a part of the path 'C:\FTP Navigator\Ftplist.txt'." (Indicator: "ftplist.txt") "C:\FTP Navigator\Ftplist.txt" (Indicator: "ftp navigator") "C:\FTP Navigator\Ftplist.txt" (Indicator: "ftplist.txt") "C:\FTP Navigator\Ftplistl" (Indicator: "ftp navigator") "Ipswitch\WS_FTP\Sites\ws_ftp.ini" (Indicator: "ws_ftp") "\VirtualStore\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftp commander") "\VirtualStore\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftplist.txt") "\Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftp commander") "\Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftplist.txt") "\VirtualStore\Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftp commander") "\VirtualStore\Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftplist.txt") "\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftp commander") "\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftplist.txt") "\cftp\Ftplist.txt" (Indicator: "ftplist.txt")53:Tfd8,Found string "CT * FROM Win32_Processor" (Indicator: " Win32_Process"; File: "00001720.000006B8.11790014.00402000.wprm") Found string "CT * FROM Win32_Processor" (Indicator: " Win32_Processor"; File: "00001720.000006B8.11790014.00402000.wprm") Found string "ELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found string "ELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") Found string "select * from Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00001720.00000002.70862.00900000.00000004.mdmp, 00000000-00001720.00000002.70862.02810000.00000004.mdmp, 00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00001720.00000002.70862.00900000.00000004.mdmp, 00000000-00001720.00000002.70862.02810000.00000004.mdmp, 00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00001720.00000002.70862.00900000.00000004.mdmp, 00000000-00001720.00000002.70862.02810000.00000004.mdmp, 00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") file/memory contains long string with (Indicator: " Win32_Process"; Source: "00000000-00001720.00000002.70862.00900000.00000004.mdmp") file/memory contains long string with (Indicator: " Win32_Processor"; Source: "00000000-00001720.00000002.70862.00900000.00000004.mdmp") Found string "instance of Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00001720.00000002.70862.05430000.00000004.mdmp, 00000000-00001720.00000002.70862.05620000.00000004.mdmp, 00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found string "instance of Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00001720.00000002.70862.05430000.00000004.mdmp, 00000000-00001720.00000002.70862.05620000.00000004.mdmp, 00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found string "ance of Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00001720.00000002.70862.05430000.00000004.mdmp") Found string "nstance of Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00001720.00000002.70862.05430000.00000004.mdmp, 00000000-00001720.00000002.70862.05620000.00000004.mdmp") Found string "nstance of Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00001720.00000002.70862.05430000.00000004.mdmp, 00000000-00001720.00000002.70862.05620000.00000004.mdmp") file/memory contains long string with (Indicator: " Win32_Process"; Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") file/memory contains long string with (Indicator: " Win32_Processor"; Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found string ""instance of Win32_Processor{AddressWidth = 64;Architecture = 9;Availability = 3;Caption = 'Intel64 Family 6 Model 79 Stepping 0';CpuStatus = 1;CreationClassName = 'Win32_Processor';Cu" (Indicator: " Win32_Process"; Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp"), Found string ""instance of Win32_Processor{AddressWidth = 64;Architecture = 9;Availability = 3;Caption = 'Intel64 Family 6 Model 79 Stepping 0';CpuStatus = 1;CreationClassName = 'Win32_Processor';Cu" (Indicator: " Win32_Processor"; Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found string "'Win32_ComputerSystem';SystemName = 'HAPUBWS-PC';UpgradeMethod = 4;Version = '';VoltageCaps = 2;};" "instance of Win32_Processor{AddressWidth = 64;Arc&U" (Indicator: " Win32_Process"; Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found string "'Win32_ComputerSystem';SystemName = 'HAPUBWS-PC';UpgradeMethod = 4;Version = '';VoltageCaps = 2;};" "instance of Win32_Processor{AddressWidth = 64;Arc&U" (Indicator: " Win32_Processor"; Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp")54:T13a2,Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00001720.00000000.67016.00900000.00000004.mdmp, 00000000-00001720.00000001.68938.00900000.00000004.mdmp, 00000000-00001720.00000002.70862.00900000.00000004.mdmp") Found string "%SystemRoot%\System32\drivers\etc" (Indicator: "\drivers\"; Source: "00000000-00001720.00000001.68938.00900000.00000004.mdmp, 00000000-00001720.00000001.68938.05465000.00000004.mdmp, 00000000-00001720.00000002.70862.00900000.00000004.mdmp") Found string "%SystemRoot%\System32\drivers\etc" (Indicator: "system32\drivers"; Source: "00000000-00001720.00000001.68938.00900000.00000004.mdmp, 00000000-00001720.00000001.68938.05465000.00000004.mdmp, 00000000-00001720.00000002.70862.00900000.00000004.mdmp") Found string "\Device\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}" (Indicator: "\Device\"; Source: "00000000-00001720.00000001.68938.00900000.00000004.mdmp, 00000000-00001720.00000002.70862.00900000.00000004.mdmp") Found string "Win32API|System Information Functions|GetSystemDirectory|\drivers\etc\lmhosts" (Indicator: "\drivers\"; Source: "00000000-00001720.00000001.68938.05465000.00000004.mdmp, 00000000-00001720.00000001.68938.0546A000.00000004.mdmp") Found string "Microsoft Windows 7 Professional |C:\Windows|\Device\Harddisk0\Partition2" (Indicator: "\Device\"; Source: "00000000-00001720.00000002.70862.02810000.00000004.mdmp, 00000000-00001720.00000002.70862.05430000.00000004.mdmp, 00000000-00001720.00000002.70862.05620000.00000004.mdmp, 00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found string "BootDevice = "\\Device\\HarddiskVolume1";" (Indicator: "\Device\"; Source: "00000000-00001720.00000002.70862.05430000.00000004.mdmp") Found string "Name = "Microsoft Windows 7 Professional |C:\\Windows|\\Device\\Harddisk0\\Partition2";" (Indicator: "\Device\"; Source: "00000000-00001720.00000002.70862.05430000.00000004.mdmp, 00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found string "SystemDevice = "\\Device\\HarddiskVolume2";" (Indicator: "\Device\"; Source: "00000000-00001720.00000002.70862.05430000.00000004.mdmp, 00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found string "\Device\HarddiskVolume1" (Indicator: "\Device\"; Source: "00000000-00001720.00000002.70862.05430000.00000004.mdmp, 00000000-00001720.00000002.70862.05620000.00000004.mdmp, 00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00001720.00000002.70862.05430000.00000004.mdmp, 00000000-00001720.00000002.70862.05620000.00000004.mdmp, 00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found string "soft Windows 7 Professional |C:\Windows|\Device\Harddisk0\Partition2" (Indicator: "\Device\"; Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found string "temDevice = '\\Device\\HarddiskVolume2';SystemDirectory = 'C:\\Windows\\system" (Indicator: "\Device\"; Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found string "_OperatingSystem{BootDevice = '\\Device\\HarddiskVolume1';BuildNumber = '7601's$" (Indicator: "\Device\"; Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found string "dows|\\Device\\Harddisk0\\Partition2';NumberOfLicensedUsers = 0;NumberOfProces" (Indicator: "\Device\"; Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found string "272;SystemDevice = '\\Device\\HarddiskVolume2';SystemDirectory = 'C:\\Windows" (Indicator: "\Device\"; Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found string "{BootDevice = '\\Device\\HarddiskVolume1';BuildNumber = '7601';BuildType = 'Muv+" (Indicator: "\Device\"; Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found string "mDevice = '\\Device\\HarddiskVolume2';SystemDirectory = 'C:\" (Indicator: "\Device\"; Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found string "\Device\HarddiskVo" (Indicator: "\Device\"; Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Temp\6C4B1EF3-3361-48EC-A522-11ADE34F3D94\DismHost.exe" (Indicator: "\Device\"; Source: "00000000-00003492.00000000.73362.003A0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Temp\717A1CF7-3FEF-43E1-BD3A-63DA7C04CF9C\DismHost.exe" (Indicator: "\Device\"; Source: "00000000-00004256.00000000.85402.00260000.00000004.mdmp, 00000000-00004256.00000001.86152.00260000.00000004.mdmp") Found string "C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_neutral_3634f6f3865df877\vmci.inf" (Indicator: "system32\drivers"; Source: "00000000-00004256.00000001.86152.00260000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00004432.00000000.66256.00B00000.00000004.mdmp, 00000000-00004432.00000001.66743.00B00000.00000004.mdmp")55:T1016,Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API "InitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API "AddAce" (Indicator: "AddAce"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API "IsValidSecurityDescriptor" (Indicator: "IsValidSecurityDescriptor"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp")56:Td56,Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: DISMHOST.EXE.65E1AF00.bin] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: DISMHOST.EXE.65E1AF00.bin] Observed import api "GetAclInformation" which can "Retrieves information about an access control list (ACL)" [Source: DISMHOST.EXE.65E1AF00.bin] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: DISMHOST.EXE.65E1AF00.bin] Observed import api "GetSecurityDescriptorControl" which can "Retrieves a security descriptor control and revision information" [Source: DISMHOST.EXE.65E1AF00.bin] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: DISMHOST.EXE.65E1AF00.bin] Observed import api "GetSecurityDescriptorGroup" which can "Retrieves the primary group information from a security descriptor" [Source: DISMHOST.EXE.65E1AF00.bin] Observed import api "GetSecurityDescriptorOwner" which can "Retrieves the owner information from a security descriptor" [Source: DISMHOST.EXE.65E1AF00.bin] Observed import api "GetSecurityDescriptorSacl" which can "Retrieves a pointer to the system access control list (SACL) in a specified security descriptor" [Source: DISMHOST.EXE.65E1AF00.bin] Observed import api "GetSidLengthRequired" which can "Returns the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities" [Source: DISMHOST.EXE.65E1AF00.bin] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: DISMHOST.EXE.65E1AF00.bin] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: DISMHOST.EXE.65E1AF00.bin] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: DISMHOST.EXE.65E1AF00.bin] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: DISMHOST.EXE.65E1AF00.bin] Observed import api "IsValidSecurityDescriptor" which can "Determines whether the components of a security descriptor are valid" [Source: DISMHOST.EXE.65E1AF00.bin] Observed import api "IsValidSid" which can "Validates a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: DISMHOST.EXE.65E1AF00.bin] Observed import api "MakeAbsoluteSD" which can "Creates a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: DISMHOST.EXE.65E1AF00.bin] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: DISMHOST.EXE.65E1AF00.bin] Observed import api "SetSecurityDescriptorGroup" which can "Sets the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: DISMHOST.EXE.65E1AF00.bin] Observed import api "SetSecurityDescriptorOwner" which can "Sets the owner information of an absolute-format security descriptor" [Source: DISMHOST.EXE.65E1AF00.bin]57:T827,"microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGHEAPFLAGS"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "microzx.scr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "")58:Td14,"CT * FROM Win32_Processor" (Indicator: " win32_process"; File: "00001720.000006B8.11790014.00402000.wprm") "ELECT * FROM Win32_Processor" (Indicator: " win32_process"; Source: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") "select * from Win32_OperatingSystem" (Indicator: " win32_operatingsystem"; Source: "00000000-00001720.00000002.70862.00900000.00000004.mdmp, 00000000-00001720.00000002.70862.02810000.00000004.mdmp, 00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") "SELECT * FROM Win32_Processor" (Indicator: " win32_process"; Source: "00000000-00001720.00000002.70862.00900000.00000004.mdmp, 00000000-00001720.00000002.70862.02810000.00000004.mdmp, 00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") "anagementSupported = FALSE;ProcessorId = '0F8BFBFF000406F0';ProcessorType = 3;Revision = 20224;Role = 'CPU';SocketDesignation = 'CPU #000';Status = 'OK';StatusInfo = 3;SystemCreationClassName = 'Win32_ComputerSystem';SystemName = 'HAPUBWS-PC';UpgradeMethod = 4;Version = '';VoltageCaps = 2;};" "instance of Win32_Processor{AddressWidth = 64;Architecture = 9;Availability = 3;Caption = 'Intel64 Family 6 Model 79 Stepping 0';CpuStatus = 1;CreationClassName" (Indicator: " win32_process"; Source: "00000000-00001720.00000002.70862.00900000.00000004.mdmp") "instance of Win32_Processor" (Indicator: " win32_process"; Source: "00000000-00001720.00000002.70862.05430000.00000004.mdmp, 00000000-00001720.00000002.70862.05620000.00000004.mdmp, 00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") "ance of Win32_OperatingSystem" (Indicator: " win32_operatingsystem"; Source: "00000000-00001720.00000002.70862.05430000.00000004.mdmp") "nstance of Win32_Processor" (Indicator: " win32_process"; Source: "00000000-00001720.00000002.70862.05430000.00000004.mdmp, 00000000-00001720.00000002.70862.05620000.00000004.mdmp") "nstance of Win32_Processor{AddressWidth = 64;Architecture = 9;Availability = 3;Caption = 'Intel64 Family 6 Model 79 Stepping 0';CpuStatus = 1;CreationClassName = 'Win32_Processor';CurrentClockSpeed = 2400;CurrentVoltage = 33;DataWidth = 64;Description = 'Intel64 Family 6 Model 79 Stepping 0';DeviceID = 'CPU0';Family = 2;L2CacheSize = 0;L3CacheSize = 0;L3CacheSpeed = 0;Level = 6;LoadPercentage = 100;Manufacturer = 'GenuineIntel';MaxClockSpeed = 2400;Name = 'Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz';NumberOfCores = 1;NumberOfLogicalProcessors = 1;PowerManagementSupported = FALSE;ProcessorId = '0F8BFBFF000406F0';ProcessorType = 3;Revision = 20224;Role = 'CPU';SocketDesignation = 'CPU #000';Status = 'OK';StatusInfo = 3;SystemCreationClassName = 'Win32_ComputerSystem';SystemName = 'HAPUBWS-PC';UpgradeMethod = 4;Version = '';VoltageCaps = 2;};"" (Indicator: " win32_process"; Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp"), ""instance of Win32_Processor{AddressWidth = 64;Architecture = 9;Availability = 3;Caption = 'Intel64 Family 6 Model 79 Stepping 0';CpuStatus = 1;CreationClassName = 'Win32_Processor';Cu" (Indicator: " win32_process"; Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") "'Win32_ComputerSystem';SystemName = 'HAPUBWS-PC';UpgradeMethod = 4;Version = '';VoltageCaps = 2;};" "instance of Win32_Processor{AddressWidth = 64;Arc&U" (Indicator: " win32_process"; Source: "00000000-00001720.00000002.70862.05FC0000.00000004.mdmp")59:Te9b,Found string "\\HAPUBWS-PC\root\cimv2:Win32_NetworkAdapterConfiguration.Index=11" (Indicator: "root\cimv2"; in Source: "00000000-00001720.00000001.68938.00900000.00000004.mdmp, 00000000-00001720.00000002.70862.00900000.00000004.mdmp") Found string "root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00001720.00000001.68938.00900000.00000004.mdmp, 00000000-00001720.00000001.68938.05456000.00000004.mdmp, 00000000-00001720.00000001.68938.0545A000.00000004.mdmp, 00000000-00001720.00000001.68938.05465000.00000004.mdmp, 00000000-00001720.00000002.70862.00900000.00000004.mdmp, 00000000-00001720.00000002.70862.05430000.00000004.mdmp, 00000000-00001720.00000002.70862.05620000.00000004.mdmp") Found string "ROOT\CIMV2" (Indicator: "root\cimv2"; in Source: "00000000-00001720.00000001.68938.00900000.00000004.mdmp, 00000000-00001720.00000001.68938.05456000.00000004.mdmp, 00000000-00001720.00000001.68938.0545A000.00000004.mdmp, 00000000-00001720.00000002.70862.00900000.00000004.mdmp") Found string "\HAPUBWS-PC\ROOT\CIMV2:Win32_Processor" (Indicator: "root\cimv2"; in Source: "00000000-00001720.00000001.68938.05456000.00000004.mdmp, 00000000-00001720.00000002.70862.05430000.00000004.mdmp") Found string "\HAPUBWS-PC\root\cimv2:Win32_Processor.DeviceID="CPU0"" (Indicator: "root\cimv2"; in Source: "00000000-00001720.00000001.68938.05456000.00000004.mdmp, 00000000-00001720.00000002.70862.05430000.00000004.mdmp") Found string "\HAPUBWS-PC\root\cimv2:Win32_Processor.DeviceID="CPU1"" (Indicator: "root\cimv2"; in Source: "00000000-00001720.00000001.68938.05456000.00000004.mdmp, 00000000-00001720.00000002.70862.05430000.00000004.mdmp") Found string "\HAPUBWS-PC\ROOT\cimv2:Win32_NetworkAdapterConfiguration" (Indicator: "root\cimv2"; in Source: "00000000-00001720.00000001.68938.05456000.00000004.mdmp, 00000000-00001720.00000002.70862.05430000.00000004.mdmp") Found string "\HAPUBWS-PC\root\cimv2:Win32_BaseBoard.Tag="Base Board"" (Indicator: "root\cimv2"; in Source: "00000000-00001720.00000001.68938.0545A000.00000004.mdmp, 00000000-00001720.00000002.70862.05430000.00000004.mdmp") Found string "\.\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00001720.00000001.68938.0545A000.00000004.mdmp, 00000000-00001720.00000002.70862.05430000.00000004.mdmp") Found string "UBWS-PC\root\cimv2:Win32_NetworkAdapterConfiguration.Index=10" (Indicator: "root\cimv2"; in Source: "00000000-00001720.00000001.68938.05465000.00000004.mdmp") Found string "UBWS-PC\root\cimv2:Win32_NetworkAdapterConfiguration.Index=11" (Indicator: "root\cimv2"; in Source: "00000000-00001720.00000001.68938.05465000.00000004.mdmp") Found string "ROOT\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00001720.00000001.68938.05620000.00000004.mdmp") Found string "\\HAPUBWS-PC\root\cimv2:Win32_Processor.DeviceID="CPU0"" (Indicator: "root\cimv2"; in Source: "00000000-00001720.00000002.70862.00900000.00000004.mdmp, 00000000-00001720.00000002.70862.02810000.00000004.mdmp") Found string "\\.\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00001720.00000002.70862.02810000.00000004.mdmp") Found string "\\HAPUBWS-PC\root\cimv2:Win32_OperatingSystem=@" (Indicator: "root\cimv2"; in Source: "00000000-00001720.00000002.70862.02810000.00000004.mdmp") Found string "\HAPUBWS-PC\ROOT\cimv2:Win32_BaseBoard" (Indicator: "root\cimv2"; in Source: "00000000-00001720.00000002.70862.05430000.00000004.mdmp") Found string "UBWS-PC\root\cimv2:Win32_Processor.DeviceID="CPU0"" (Indicator: "root\cimv2"; in Source: "00000000-00001720.00000002.70862.05430000.00000004.mdmp") Found string "\HAPUBWS-PC\root\cimv2:Win32_OperatingSystem=@" (Indicator: "root\cimv2"; in Source: "00000000-00001720.00000002.70862.05430000.00000004.mdmp")5a:T489,"microzx.scr.exe wrote PE header bytes ("4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000504500004c0103006508d6650000000000000000e00002010b010b0000a003000008000000000000bebe03000020000000c003000000400000200000000200000400000000000000040000000000000000000400000200000000000002004085000010000010000000001000001000000000000010000000000000000000000068be03005300000000c00300460500000000000000000000000000000000000000e003000c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000080000000000000000000000082000004800000000000000000000002e74657874000000c49e03000020000000a0030000020000000000000000000000000000200000602e727372630000004605000000c003000006000000a20300000000000000000000000000400000402e72656c6f6300000c00000000e003000002000000a803000000000000000000000000004000004200000000000000000000000000000000") to a remote process "C:\microzx.scr.exe" which might be an injection preparation attempt ...5b:T470,"microzx.scr.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 984) "microzx.scr.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 984) "microzx.scr.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 984) "microzx.scr.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 984) "microzx.scr.exe" wrote 32 bytes to a remote process "C:\microzx.scr.exe" (Handle: 988) "microzx.scr.exe" wrote 52 bytes to a remote process "C:\microzx.scr.exe" (Handle: 988) "microzx.scr.exe" wrote 4 bytes to a remote process "C:\microzx.scr.exe" (Handle: 988) "microzx.scr.exe" wrote 8 bytes to a remote process "C:\microzx.scr.exe" (Handle: 988) "microzx.scr.exe" wrote 512 bytes to a remote process "C:\microzx.scr.exe" (Handle: 988) "microzx.scr.exe" wrote 237568 bytes to a remote process "C:\microzx.scr.exe" (Handle: 988) "microzx.scr.exe" wrote 1536 bytes to a remote process "C:\microzx.scr.exe" (Handle: 988)5c:T4b6,"api.ipify.org" (Indicator: "api.ipify.org"; File: "PCAP") "ttps://api.ipify.org" (Indicator: "api.ipify.org"; File: "00001720.000006B8.11790014.00402000.wprm") "ttps://api.ipify.org" (Indicator: "api.ipify.org"; File: "00000000-00001720.00000000.67016.00400000.00000040.mdmp") "https://api.ipify.org" (Indicator: "api.ipify.org"; File: "00000000-00001720.00000001.68938.02810000.00000004.mdmp, 00000000-00001720.00000002.70862.02810000.00000004.mdmp") "api.ipify.org" (Indicator: "api.ipify.org"; File: "00000000-00001720.00000001.68938.02810000.00000004.mdmp, 00000000-00001720.00000001.68938.05FC0000.00000004.mdmp, 00000000-00001720.00000002.70862.02810000.00000004.mdmp, 00000000-00001720.00000002.70862.05FC0000.00000004.mdmp") "https://api.ipify.org/" (Indicator: "api.ipify.org"; File: "00000000-00001720.00000001.68938.02810000.00000004.mdmp, 00000000-00001720.00000002.70862.02810000.00000004.mdmp") "http://api.ipify.org" (Indicator: "api.ipify.org"; File: "00000000-00001720.00000001.68938.02810000.00000004.mdmp") "Host: api.ipify.org" (Indicator: "api.ipify.org"; File: "00000000-00001720.00000001.68938.02810000.00000004.mdmp, 00000000-00001720.00000002.70862.02810000.00000004.mdmp")5d:T5da,"microzx.scr.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES") "microzx.scr.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS MESSAGING SUBSYSTEM\PROFILES\9375CFF0413111D3B88A00104B2A6676") "microzx.scr.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "microzx.scr.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "microzx.scr.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "EMAIL") "microzx.scr.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") "microzx.scr.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "EMAIL") "microzx.scr.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003") "microzx.scr.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003"; Key: "EMAIL") "microzx.scr.exe" (Path: "HKCU\SOFTWARE\INCREDIMAIL\IDENTITIES")5e:T10b2,"microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\UCBrowser\" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\YANDEX\YANDEXBROWSER\USER DATA" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\IRIDIUM\USER DATA" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\7STAR\7STAR\USER DATA" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TORCH\USER DATA" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\MAPLESTUDIO\CHROMEPLUS\USER DATA" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\KOMETA\USER DATA" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\AMIGO\USER DATA" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CENTBROWSER\USER DATA" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHEDOT\USER DATA" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\ORBITUM\USER DATA" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SPUTNIK\SPUTNIK\USER DATA" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\VIVALDI\USER DATA" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CATALINAGROUP\CITRIO\USER DATA" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\360CHROME\CHROME\USER DATA" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\UCOZMEDIA\URAN\USER DATA" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\LIEBAO\USER DATA" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\ELEMENTS BROWSER\USER DATA" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\EPIC PRIVACY BROWSER\USER DATA" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COCCOC\BROWSER\USER DATA" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\FENRIR INC\SLEIPNIR5\SETTING\MODULES\CHROMIUMVIEWER" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\QIP SURF\USER DATA" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COOWON\COOWON\USER DATA" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\DEFAULT\LOGIN DATA" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\LOGIN DATA" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\EDGE\USER DATA" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\profiles.ini" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\yo4f78ka.default-1692790522796\LOGINS.JSON" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\yo4f78ka.default-1692790522796\SIGNONS.SQLITE" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\SEAMONKEY\PROFILES.INI" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\THUNDERBIRD\PROFILES.INI" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\NETGATE TECHNOLOGIES\BLACKHAWK\PROFILES.INI" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\8PECXSTUDIOS\CYBERFOX\PROFILES.INI" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\K-MELEON\PROFILES.INI" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\ICECAT\PROFILES.INI" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\MOONCHILD PRODUCTIONS\PALE MOON\PROFILES.INI" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\COMODO\ICEDRAGON\PROFILES.INI" "microzx.scr.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\WATERFOX\PROFILES.INI"5f:T511,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp")60:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}61:T1413,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007048-43880-49-0123EE60 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007048-43880-92-0123E950 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007048-43880-92-0123E950 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007048-43880-126-0123D490 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007048-43880-126-0123D490 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007048-43880-129-0123985C Assembly shows XOR instruction xor esi dword ptr [01240394h] in Stream UID: 00000000-00007048-43880-129-0123985C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007048-43880-129-0123985C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007048-43880-133-0123995D Assembly shows XOR instruction xor esi dword ptr [01240390h] in Stream UID: 00000000-00007048-43880-133-0123995D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007048-43880-133-0123995D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007048-43880-135-0123DAD1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007048-43880-135-0123DAD1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007048-43880-137-0123DA34 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007048-43880-137-0123DA34 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007048-43880-141-0123D610 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007048-43880-141-0123D610 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007048-43880-149-0123D560 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007048-43880-149-0123D560 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007048-43880-151-0123D501 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007048-43880-151-0123D501 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007048-43880-158-0123A510 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007048-43880-161-0123A4E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007048-43880-162-0123A4B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007048-43880-182-01238190 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007048-43880-182-01238190 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00007048-43880-194-0123C4B6 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00007048-43880-194-0123C4B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007048-43880-195-01238AF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007048-43880-195-01238AF0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007048-43880-198-01238E30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007048-43880-198-01238E30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007048-43880-199-01237C30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007048-43880-199-01237C30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007048-43880-202-012385B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007048-43880-202-012385B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007048-43880-203-012389F0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007048-43880-203-012389F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007048-43880-204-01239030 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007048-43880-204-01239030 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007048-43880-211-0123D341 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007048-43880-211-0123D341 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007048-43880-214-0123C439 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007048-43880-214-0123C439 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007048-43880-215-012392C0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007048-43880-215-012392C0 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00007048-43880-217-01239F43 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00007048-43880-217-01239F43 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00007048-43880-217-01239F43 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00007048-43880-217-01239F43 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00007048-43880-217-01239F43 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00007048-43880-217-01239F4362:T581,Found reference to API "SendMessage" (Indicator: "sendmessage"; File: "63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0") Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00007476-00000C2B-1147309173") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00007476-00000C2B-1147309201") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00007048-00000C2B-1152034198") Found reference to API "EnumWindowsW" (Indicator: "enumwindows"; Source: "00000000-00007048-00000C2B-1152034225") Found reference to API "SendMessage" (Indicator: "sendmessage"; Source: "00000000-00006712.00000000.137636.009F2000.00000002.mdmp, 00000000-00006712.00000001.139556.00400000.00000040.mdmp") Found reference to API "sendMessageChannelCache" (Indicator: "sendmessage"; Source: "00000000-00006712.00000000.137636.04F50000.00000004.mdmp") Found reference to API "System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Indicator: "sendmessage"; Source: "00000000-00006712.00000000.137636.04F50000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00007476.00000000.137263.033D0000.00000004.mdmp")63:Ta8a,Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Variable to hold all default pairse used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp")64:Tf18,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00007476-00000C2A-1143186507] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00007476-00000C2A-1143475510] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00007476-00000C2A-1143567355] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007476-00000C2A-1143616865] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00007476-00000C2A-1143781047] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00007476-00000C2A-1143804926] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007476-00000C2A-1143851835] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00007476-00000C2A-1143917624] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00007476-00000C2A-1143953590] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00007476-00000C2A-1144015140] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00007476-00000C2A-1144120749] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00007476-00000C2A-1144218675] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00007476-00000C2A-1144243849] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" [Source: 00000000-00007476-00000C2A-1144309375] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00007476-00000C2A-1144503647] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00007476-00000C2A-1144710536] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00007476-00000C2A-1144846583] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00007476-00000C2A-1145672761] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00007476-00000C2A-1145696206] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00007476-00000C2A-1145719324] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00007476-00000C2A-1145945402] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00007476-00000C2A-1146140754] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00007476-00000C2A-1146243100] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00007048-00000C2A-1150485074] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00007048-00000C2A-1150700529]65:T712,Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp")66:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00007048.00000000.137632.05130000.00000004.mdmp")67:T486,Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00006712.00000000.137636.030C0000.00000004.mdmp, 00000000-00006712.00000001.139556.030C0000.00000004.mdmp, 00000000-00006712.00000001.139556.03198000.00000004.mdmp, 00000000-00006712.00000002.141476.030C0000.00000004.mdmp, 00000000-00006712.00000002.141476.03198000.00000004.mdmp") Found string ":\WINDOWS\SysWOW64\Kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00006712.00000001.139556.030C0000.00000004.mdmp, 00000000-00006712.00000002.141476.030C0000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00006712.00000001.139556.030C0000.00000004.mdmp, 00000000-00006712.00000002.141476.030C0000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00006712.00000001.139556.03190000.00000004.mdmp, 00000000-00006712.00000002.141476.03190000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00007048.00000000.137632.03450000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00007476.00000000.137263.033D0000.00000004.mdmp")68:T40f,Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00006712.00000000.137636.030C0000.00000004.mdmp, 00000000-00006712.00000000.137636.04F50000.00000004.mdmp") Found string "System.Data.SqlClient" (Indicator: "System.Data.SqlClient"; Source: "00000000-00006712.00000000.137636.04F50000.00000004.mdmp") Found string "=\" (Indicator: \"\"; File: \"microzx.scr.exe\")\n Found string \"=\" (Indicator: \"\"; Source: \"00000000-00001720.00000002.70862.01352000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"microzx.scr.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$53","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"System Destruction","name":"Marks file for deletion","description":"\"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RFfea9c.TMP\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\GW0R76LVV6Y4JLIZJ7FY.temp\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RFfea9c.TMP\" with delete access\n \"powershell.exe\" opened \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\SECURITY.CONFIG.CCH.4696.2474192105\" with delete access\n \"powershell.exe\" opened \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\ENTERPRISESEC.CONFIG.CCH.4696.2474192105\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\CLR SECURITY CONFIG\\V2.0.50727.312\\SECURITY.CONFIG.CCH.4696.2474192152\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004696)\n \"microzx.scr.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\SysWOW64\\cryptsp.dll\" (UID: 00000000-00001720)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$54","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFile\" (Indicator: \"DeleteFile\"; File: \"00001720.000006B8.11790014.00402000.wprm\")\n Found reference to API \"DeleteFile\" (Indicator: \"DeleteFile\"; Source: \"00000000-00001720.00000000.67016.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"microzx.scr.exe\")\n Found reference to API \"SetWindowsHookEx\" (Indicator: \"SetWindowsHook\"; File: \"microzx.scr.exe\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"microzx.scr.exe\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00001720.00000000.67016.00400000.00000040.mdmp, 00000000-00001720.00000002.70862.01352000.00000020.mdmp\")\n Found reference to API \"SetWindowsHookEx\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00001720.00000000.67016.00400000.00000040.mdmp, 00000000-00001720.00000002.70862.01352000.00000020.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00001720.00000000.67016.00400000.00000040.mdmp, 00000000-00001720.00000002.70862.01352000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00001720.00000001.68938.02810000.00000004.mdmp, 00000000-00001720.00000002.70862.02810000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003492.00000001.74652.FF341000.00000020.mdmp, 00000000-00004256.00000001.86152.FFFD1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"00001720.000006B8.11790014.00402000.wprm\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001720.00000000.67016.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"microzx.scr.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$56","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"microzx.scr.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$57","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"System Security","name":"Uses powershell with a add-mppreference commandline param","description":"Process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"C:\\\\microzx.scr.exe\"\" (UID: 00000000-00004696)","origin":"Monitored Target","mitre_attack_id":"T1562","relevance":3,"id":"target-236","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"GW0R76LVV6Y4JLIZJ7FY.temp\" - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\GW0R76LVV6Y4JLIZJ7FY.temp]- [targetUID: 00000000-00004696]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"microzx.scr.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"microzx.scr.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"microzx.scr.exe\" at 00000000-00004432-00000033-5066570\n \"microzx.scr.exe\" at 00000000-00001720-00000033-6609744","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"microzx.scr.exe\" queried SystemProcessInformation at 00000000-00001720-00000033-7562916 [PID: 1720]\n \"microzx.scr.exe\" queried SystemProcessInformation at 00000000-00001720-00000033-7563552 [PID: 1720]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .rsrc with unusual entropies 7.98176208625\n 7.34814709443","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Executes WMI queries known to be used for VM detection","description":"\"microzx.scr.exe\" issued a query \"select * from Win32_OperatingSystem\"\n \"microzx.scr.exe\" issued a query \"SELECT * FROM Win32_Processor\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-57","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"$58","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"microzx.scr.exe\" (Thread ID: 2908) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"microzx.scr.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"DISMHOST.EXE.65E1AF00.bin\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"- [targetUID: N/A]\n \"DISMHOST.EXE.65E09255.bin\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.26.13.205 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$59","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"microzx.scr.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"microzx.scr.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"DISMHOST.EXE.65E1AF00.bin\" claimed CRC 141269 while the actual is CRC 765497","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"SetSecurityDescriptorDacl\n OutputDebugStringW\n GetModuleFileNameW\n GetVersionExW\n OutputDebugStringA\n VirtualProtect\n GetVersionExA\n GetFileAttributesW\n GetCommandLineW\n UnhandledExceptionFilter\n LoadLibraryExW\n GetStartupInfoW\n GetTickCount\n MapViewOfFile\n GetProcAddress\n CreateFileMappingW\n CreateThread\n LoadLibraryW\n GetSystemDirectoryW\n FindResourceExW\n GetModuleHandleW\n TerminateProcess\n GetModuleHandleExW\n CreateFileW\n Sleep","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"microzx.scr.exe\" called \"CreateProcessA\" with parameter \"C:\\microzx.scr.exe\" - (UID: 00000000-00004432)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Writes PE header to memory","description":"$5a","origin":"API Call","mitre_attack_id":"T1055.002","relevance":7,"id":"api-83","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$5b","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"malicious","category":"Network Related","name":"Sends network traffic on a typical mail related ports","description":"Mail traffic to 142.250.142.108 on port 587 (SMTP)","origin":"Network Traffic","mitre_attack_id":"T1071.003","relevance":6,"id":"network-10","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"api.ipify.org\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - AgentTesla","description":"YARA signature Malware.AgentTesla matched on process \"00000000-00001720\"","origin":"YARA Signature","relevance":10,"id":"yara-4","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Found FTP credentials location strings","description":"\"eZilla\\recentservers.xml\" (Indicator: \"recentservers.xml\") in Source: 00001720.000006B8.11790014.00402000.wprm\n \"SOFTWARE\\FTPWare\\COREFTP\\Sites\" (Indicator: \"\\coreftp\\\") in Source: 00001720.000006B8.11790014.00402000.wprm\n \"igator\\Ftplist.txt\" (Indicator: \"ftplist.txt\") in Source: 00001720.000006B8.11790014.00402000.wprm\n \"rtualStore\\Program Files (x86)\\FTP Commander Deluxe\\Ftplist.txt\" (Indicator: \"ftplist.txt\") in Source: 00001720.000006B8.11790014.00402000.wprm\n \"rogram Files (x86)\\FTP Commander\\Ftplist.txt\" (Indicator: \"ftplist.txt\") in Source: 00001720.000006B8.11790014.00402000.wprm\n \"\\Ftplist.txt\" (Indicator: \"ftplist.txt\") in Source: 00001720.000006B8.11790014.00402000.wprm\n \"re\\DownloadManager\\Passwords\\\" (Indicator: \"\\downloadmanager\\passwords\") in Source: 00001720.000006B8.11790014.00402000.wprm\n \"dio\\ChromePlus\\User Data\" (Indicator: \"\\chromeplus\\\") in Source: 00001720.000006B8.11790014.00402000.wprm","origin":"File/Memory","mitre_attack_id":"T1552.001","relevance":6,"id":"string-11","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Reads FTP client related registry keys","description":"\"microzx.scr.exe\" (Path: \"HKCU\\SOFTWARE\\FTPWARE\\COREFTP\\SITES\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-31","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal FTP credentials from registry","description":"\"microzx.scr.exe opens key \" (Path: \"HKCU\\SOFTWARE\\FTPWARE\\COREFTP\\SITES\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":5,"id":"registry-100","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"$5d","origin":"Registry Access","mitre_attack_id":"T1114","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Putty/Winscp sessions from registry","description":"\"microzx.scr.exe opens key \" (Path: \"HKCU\\SOFTWARE\\MARTIN PRIKRYL\\WINSCP 2\\SESSIONS\")","origin":"Registry Access","mitre_attack_id":"T1552.002","relevance":10,"id":"registry-74","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$5e","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to delete items (Powershell command string)","description":"Found string \"Remove-Item\" (Indicator: \"Remove-Item\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-333","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00007476)\n \"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00007476)\n \"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00007476)\n \"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00007476)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe\" called \"LoadResource with parameter {'hModule': '133824513', 'hResInfo': '133825760'}\" (UID: 00000000-00007476)\n \"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe\" called \"LoadResource with parameter {'hModule': '133824513', 'hResInfo': '133825792'}\" (UID: 00000000-00007476)\n \"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe\" called \"LoadResource with parameter {'hModule': '133824513', 'hResInfo': '133825808'}\" (UID: 00000000-00007476)\n \"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe\" called \"LoadResource with parameter {'hModule': '133824513', 'hResInfo': '133825776'}\" (UID: 00000000-00007476)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to clear Powershell session command history (Powershell command string)","description":"Found string \"Clear-History\" (Indicator: \"Clear-History\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.003","relevance":1,"id":"string-243","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to clear content (Powershell command string)","description":"Found string \"Clear-Host\" (Indicator: \"Clear-Host\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")\n Found string \"Clear-Content\" (Indicator: \"Clear-Content\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")\n Found string \"Clear-ItemProperty\" (Indicator: \"Clear-ItemProperty\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")\n Found string \"Clear-Variable\" (Indicator: \"Clear-Variable\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-368","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution (Powershell command string)","description":"Found string \"Start-Sleep\" (Indicator: \"Start-Sleep\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-397","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load content from resource","description":"Observed function \"ResourceManager.GetObject\" in \"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-112","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007476.00000000.137263.033D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to rename items (Powershell command string)","description":"Found string \"Rename-ItemProperty\" (Indicator: \"Rename-ItemProperty\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1036.003","relevance":1,"id":"string-381","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to write/modify file content (Powershell command string)","description":"Found string \"Set-Content\" (Indicator: \"Set-Content\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1036.005","relevance":1,"id":"string-331","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00007048.00000000.137632.03450000.00000004.mdmp\n Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00007476.00000000.137263.033D0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$60","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$61","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"Keep\" in header \"GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Contacts server\n Matched sigs: Contacts domains\n Matched sigs: Spawned process connects to a network","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00006712.00000000.137636.04F50000.00000004.mdmp, 00000000-00006712.00000000.137636.05F50000.00000004.mdmp, 00000000-00006712.00000001.139556.05F50000.00000004.mdmp, 00000000-00006712.00000002.141476.05F50000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00006712.00000000.137636.04F50000.00000004.mdmp, 00000000-00006712.00000000.137636.05F50000.00000004.mdmp, 00000000-00006712.00000001.139556.05F50000.00000004.mdmp, 00000000-00006712.00000002.141476.05F50000.00000004.mdmp\")\n Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00007048.00000000.137632.04CA0000.00000004.mdmp, 00000000-00007048.00000000.137632.06130000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00007048.00000000.137632.04CA0000.00000004.mdmp, 00000000-00007048.00000000.137632.06130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007476-00000C2B-1144773518\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007048-00000C2B-1152155216\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006712.00000001.139556.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00006712.00000001.139556.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007048.00000000.137632.01241000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00006712-00000C2B-1154697547\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$62","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007476)\n \"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe\" called \"GetWriteWatch\" with parameters (UID: 00000000-00007476)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007476)\n \"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00007476)\n \"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00007476)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007476)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00007048.00000000.137632.01241000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00007048-00000C17-1154252126","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00007476)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00007048)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.133970654667457879.7048.DefaultAppDomain.powershell\" - (UID: 00000000-00007048)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00006712.00000001.139556.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"api.ipify.org\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"General","name":"Contains ability to add modules to the current session (Powershell command string)","description":"Found string \"Import-Module\" (Indicator: \"Import-Module\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-348","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"General","name":"Contains ability to call WMI method (Powershell command string)","description":"Found string \"Invoke-WMIMethod\" (Indicator: \"Invoke-WmiMethod\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-296","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"General","name":"Contains ability to run commands (Powershell command string)","description":"Found string \"Invoke-Command\" (Indicator: \"Invoke-Command\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-287","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"General","name":"Contains ability to run commands or expressions (Powershell command string)","description":"Found string \"Invoke-Expression\" (Indicator: \"Invoke-Expression\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-288","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Powershell command string)","description":"Found string \"Start-Process\" (Indicator: \"Start-Process\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-250","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"General","name":"Contains ability to start services (Powershell command string)","description":"Found string \"Start-Service\" (Indicator: \"Start-Service\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-332","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.133970654667457879.7048.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET / HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0\nHost: api.ipify.org\nConnection: Keep-Alive\" Response ==> HTTP/1.1 200 OK\nDate: Tue\n 15 Jul 2025 08:04:26 GMT\nContent-Type: text/plain\nContent-Length: 13\nConnection: keep-alive\nCF-RAY: 95f7bfc43cc1eb2e-SJC\nVary: Origin\ncf-cache-status: DYNAMIC\nServer: cloudflare\nserver-timing: cfL4;desc=\"?proto=TCP&rtt=1562&min_rtt=1543&rtt_var=617&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2819&recv_bytes=568&delivery_rate=1718658&cwnd=252&unsent_bytes=0&cid=d4a2d01477f498e8&ts=656&x=0\" with response body ==>33363A33343A32653A33313A33323A33343A32653A33313A33323A32653A33313A33363A3332.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 6F590000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 73380000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"$63","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$64","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=WE1, O=Google Trust Services, C=US\" (SHA1: 8A:D4:06:E3:DF:41:70:FA:F8:24:61:06:C6:AD:47:97:37:2F:30:94; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GTS Root R4, O=Google Trust Services LLC, C=US\" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE\" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_cqcsbyhe.f2o.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_vvatving.bup.psm1\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/modify Windows services (Powershell command string)","description":"$65","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-396","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/update instances of WMI classes (Powershell command string)","description":"Found string \"Set-WMIInstance\" (Indicator: \"Set-WmiInstance\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1546.003","relevance":1,"id":"string-336","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains reference to background jobs (Powershell command string)","description":"Found string \"Get-Job\" (Indicator: \"Get-Job\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")\n Found string \"Stop-Job\" (Indicator: \"Stop-Job\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")\n Found string \"Wait-Job\" (Indicator: \"Wait-Job\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")\n Found string \"Resume-Job\" (Indicator: \"Resume-Job\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")\n Found string \"Remove-Job\" (Indicator: \"Remove-Job\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")\n Found string \"Receive-Job\" (Indicator: \"Receive-Job\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")\n Found string \"Start-Job\" (Indicator: \"Start-Job\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")\n Found string \"Debug-Job\" (Indicator: \"Debug-Job\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1197","relevance":1,"id":"string-375","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe.log\"\n \"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe.log\"\n \"powershell.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log\"\n \"powershell.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to copy items (Powershell command string)","description":"Found string \"Copy-ItemProperty\" (Indicator: \"Copy-ItemProperty\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-377","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to get content from a webpage (Powershell command string)","description":"Found string \"Invoke-WebRequest\" (Indicator: \"Invoke-WebRequest\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-282","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to move items (Powershell command string)","description":"Found string \"Move-ItemProperty\" (Indicator: \"Move-ItemProperty\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-378","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"Observed string: \"curl\" (Indicator: \"curl\") in Source: 00000000-00007048.00000000.137632.05130000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-576","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET / HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0\nHost: api.ipify.org\nConnection: Keep-Alive\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"api.ipify.org\" (7 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://api.ipify.org/","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"api.ipify.org\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00006712\"\n YARA signature for RC4 encryption matched on process \"00000000-00007476\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to receive remote commands (Powershell command string)","description":"Found string \"Enable-PSRemoting\" (Indicator: \"Enable-PSRemoting\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-289","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Remote Access Related","name":"Contains reference to remote powershell session activity (Powershell command string)","description":"$66","origin":"File/Memory","mitre_attack_id":"T1021.006","relevance":1,"id":"string-154","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$67","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"$68","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve security-related event logs (PowerShell command string)","description":"Found string \"PowerShell -Command {Get-EventLog -LogName security}\" (Indicator: \"Get-EventLog\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")\n Found string \"PowerShell -Command \"& {Get-EventLog -LogName security}\"\" (Indicator: \"Get-EventLog\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1654","relevance":1,"id":"string-647","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$69","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00007048)\n \"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe\" called \"GetComputerNameW\" (UID: 00000000-00006712)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00007048)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe\" called \"GetUserNameW\" (UID: 00000000-00006712)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen information (Dotnet)","description":"Observed Namespace \"System.Windows.Forms::Screen\" and MemberReference \"get_PrimaryScreen\" in \"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0\"","origin":"Static Parser","mitre_attack_id":"T1113","relevance":1,"id":"static-164","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00007048.00000000.137632.01241000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"where the quotation marks indicate a string and the invoke operator (&)\" (Indicator: \"where \"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve processes (Powershell command string)","description":"Found string \"Get-Process\" (Indicator: \"Get-Process\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-291","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007476-00000C2B-1143296398\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007476-00000C2B-1144747863\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007048-00000C2B-1151343034\")\n Found string \"OpenProcessW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007048-00000C2B-1151343063\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006712.00000001.139556.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"System Security","name":"Contains ability to create/modify item values (Powershell command string)","description":"Found string \"Set-ItemProperty\" (Indicator: \"Set-ItemProperty\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-367","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete a property and its value from an item (Powershell command string)","description":"Found string \"Remove-Module\" (Indicator: \"Remove-Module\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")\n Found string \"Remove-Variable\" (Indicator: \"Remove-Variable\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")\n Found string \"Remove-PSBreakpoint\" (Indicator: \"Remove-PSBreakpoint\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")\n Found string \"Remove-PSDrive\" (Indicator: \"Remove-PSDrive\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")\n Found string \"Remove-ItemProperty\" (Indicator: \"Remove-ItemProperty\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")\n Found string \"Remove-PSSnapin\" (Indicator: \"Remove-PSSnapin\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")\n Found string \"Remove-WMIObject\" (Indicator: \"Remove-WmiObject\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-369","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00007048.00000000.137632.71D81000.00000020.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00007048.00000000.137632.71D81000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"System Security","name":"Contains ability to retrieve credential objects (Powershell command string)","description":"Found string \"Get-Credential\" (Indicator: \"Get-Credential\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1003","relevance":1,"id":"string-340","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00006712-00000C2B-1256432958","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"System Security","name":"Contains ability to stop a service (Powershell command string)","description":"Found string \"Stop-Service\" (Indicator: \"Stop-Service\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-274","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate services/features (Powershell command string)","description":"Found string \"Disable-PSBreakpoint\" (Indicator: \"Disable-PSBreakpoint\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")\n Found string \"Stop-Process\" (Indicator: \"Stop-Process\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")\n Found string \"Disable-PSRemoting\" (Indicator: \"Disable-PSRemoting\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-371","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to redirect output to specified device/utility (Powershell command string)","description":"Found string \"Out-Default\" (Indicator: \"Out-Default\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")\n Found string \"Out-File\" (Indicator: \"Out-File\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")\n Found string \"Out-Null\" (Indicator: \"Out-Null\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")\n Found string \"Out-String\" (Indicator: \"Out-String\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")\n Found string \".ForwardHelpTargetName Out-String\" (Indicator: \"Out-String\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")\n Found string \"Out-Host\" (Indicator: \"Out-Host\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")\n Found string \"Out-GridView\" (Indicator: \"Out-GridView\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")\n Found string \"Out-Printer\" (Indicator: \"Out-Printer\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-373","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to run commands from session history (Powershell command string)","description":"Found string \"Invoke-History\" (Indicator: \"Invoke-History\"; Source: \"00000000-00007048.00000000.137632.05130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-347","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"smss.exe,csrss.exe,wininit.exe,winlogon.exe,services.exe\" (Source: \"00000000-00006712.00000000.137636.04F50000.00000004.mdmp, 00000000-00006712.00000000.137636.05F50000.00000004.mdmp, 00000000-00006712.00000001.139556.05F50000.00000004.mdmp, 00000000-00006712.00000002.141476.05F50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00006712.00000001.139556.08960000.00000004.mdmp, 00000000-00006712.00000002.141476.08960000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 7476)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 7048)\n \"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 6712)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0\" has section name .text with entropy \"7.98176208624602\"\n \"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0\" has section name .rsrc with entropy \"7.348147094431369\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques using MAC address detection","description":"\"00:50:56:91:64:F3\" (Indicator: \"00:50:56\")\n \"0050569164F3\" (Indicator: \"005056\")\n \"None0F8BFBFF000006F00050569164F3\" (Indicator: \"005056\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":10,"id":"string-2","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"suspicious","category":"Network Related","name":"Uses a browser-related user-agent without launching browser","description":"Found user-agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid number of Rva and Size of PE process \"00000000-00007476\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"$6d","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLEFILETRACING\"; Value: \"00000000\")\n \"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLECONSOLETRACING\"; Value: \"00000000\")\n \"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"FILETRACINGMASK\"; Value: \"0000FFFF\")\n \"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"CONSOLETRACINGMASK\"; Value: \"0000FFFF\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe\" set thread context in remote process \"C:\\63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe\" (PID: 1a38)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - Agent Tesla","description":"YARA signature Malware.Agent Tesla matched on process \"00000000-00006712\"","origin":"YARA Signature","relevance":9,"id":"yara-4","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Attempts to obtain browser login credentials (file access)","description":"\"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\"\n \"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data\"\n \"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe\" trying to open a file \"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Login Data\"\n \"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe\" trying to open a file \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data\"","origin":"API Call","mitre_attack_id":"T1555.003","relevance":10,"id":"api-281","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]}],"incidents":[{"name":"Spyware","details_count":4,"details":[{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Found browser information locations related strings"},{"detail":"Found Putty/Winscp session related registry strings"}],"sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"name":"Stealer/Phishing","details_count":4,"details":[{"detail":"Reads FTP client related registry keys"},{"detail":"Tries to steal Mail credentials from registry"},{"detail":"Found FTP credentials location strings"},{"detail":"Tries to steal Putty/Winscp sessions from registry"}],"sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Tries to identify its external IP address"},{"detail":"Queries sensitive IE security settings"},{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Possibly tries to evade analysis by sleeping many times"},{"detail":"Executes WMI queries known to be used for VM detection"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":29,"imported_dlls_count":197,"dropped_files_count":0,"extracted_files_count":7,"files_written_count":18,"files_deleted_count":0,"registry_keys_created_count":9,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":9,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["evasive","windows-server-utility"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"sandbox_reports":[{"id":"68760b6061113f826d00ba7f","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0","analysis_start_time":"2025-07-15T08:03:45+00:00","indicators_count":{"informative":243,"suspicious":60,"malicious":14},"tags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"is_in_unified_schema":true},{"id":"65de560b275e111be80b823f","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"microzx.scr.exe","analysis_start_time":"2024-02-27T21:37:15+00:00","indicators_count":{"informative":188,"suspicious":55,"malicious":16},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.26.13.205","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"}]},{"address":"142.250.142.108","port":587,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"}]},{"address":"172.67.74.152","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]}],"dns_resolutions":[{"domain":"api.ipify.org","address":"104.26.13.205","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"domain":"smtp.gmail.com","address":"142.250.142.108","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"}]}],"http_requests":[{"host":"api.ipify.org","host_ip":"172.67.74.152:443","url":"/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET / HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0\nHost: api.ipify.org\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"}],"processes":[{"pid":4432,"ppid":0,"name":"microzx.scr.exe","command_line":"","sha256":"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0","normalized_path":"C:\\microzx.scr.exe","uid":"00000000-00004432","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAPElEQVR4Xu3ToQ3AMBAEQVedqtycK4j5AiOTRDPSspMe/RgA8HXPXO+p7q/rwdY98D/9+9b9dT3YugeoDVNKYkGhbBnwAAAAAElFTkSuQmCC"},{"pid":4696,"ppid":4432,"name":"powershell.exe","command_line":"Add-MpPreference -ExclusionPath \"C:\\microzx.scr.exe\"","sha256":"6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00004432","uid":"00000000-00004696"},{"pid":1720,"ppid":4432,"name":"microzx.scr.exe","command_line":"","sha256":"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0","normalized_path":"C:\\microzx.scr.exe","parent_uid":"00000000-00004432","uid":"00000000-00001720"}],"all_imported_dlls":["devobj.dll","slc.dll","wmiutils.dll","dhcpcsvc.dll","gpapi.dll","Microsoft.WSMan.Management.ni.dll","Microsoft.PowerShell.Commands.Diagnostics.ni.dll","wow64.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","winhttp.dll","rasadhlp.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","shfolder.dll","diasymreader.dll","sspicli.dll","shlwapi.dll","System.ni.dll","RpcRtRemote.dll","credssp.dll","Microsoft.PowerShell.Security.ni.dll","msasn1.dll","mscorjit.dll","rpcrt4.dll","kernel32.dll","normaliz.dll","mscorwks.dll","rasapi32.dll","mscorlib.ni.dll","System.Windows.Forms.dll","msvcrt.dll","usp10.dll","oleaut32.dll","fltLib.dll","bcrypt.dll","System.Management.Automation.dll","winnsi.dll","clr.dll","api-ms-win-downlevel-user32-l1-1-0.dll","srvcli.dll","mswsock.dll","WSHTCPIP.DLL","msctf.dll","vcruntime140_clr0400.dll","System.Drawing.ni.dll","apphelp.dll","wship6.dll","VxSSL32.dll","System.Configuration.ni.dll","rsaenh.dll","comctl32.dll","propsys.dll","cfgmgr32.dll","System.Windows.Forms.ni.dll","ntmarta.dll","ntshrui.dll","cryptbase.dll","nsi.dll","Microsoft.PowerShell.Commands.Management.ni.dll","tzres.dll","wbemprox.dll","sechost.dll","lpk.dll","clrjit.dll","System.Data.dll","rasman.dll","ws2_32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","mscorrc.dll","shdocvw.dll","linkinfo.dll","WMINet_Utils.dll","urlmon.dll","shell32.dll","cscapi.dll","IPHLPAPI.DLL","vaultcli.dll","ole32.dll","api-ms-win-downlevel-version-l1-1-0.dll","crypt32.dll","wbemcomn.dll","dnsapi.dll","FWPUCLNT.DLL","mscoreei.dll","psapi.dll","System.Data.ni.dll","iertutil.dll","wow64cpu.dll","KernelBase.dll","ucrtbase_clr0400.dll","System.Core.ni.dll","setupapi.dll","Microsoft.WSMan.Runtime.dll","userenv.dll","mscoree.dll","api-ms-win-core-xstate-l2-1-0.dll","ieframe.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","System.Management.Automation.ni.dll","System.Transactions.dll","ntdll.dll","wininet.dll","cryptsp.dll","ntdsapi.dll","rtutils.dll","webio.dll","netutils.dll","bcryptprimitives.dll","Wldap32.dll","msvcr80.dll","System.Xml.ni.dll","version.dll","uxtheme.dll","System.DirectoryServices.ni.dll","fastprox.dll","user32.dll","imm32.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","GdiPlus.dll","clbcatq.dll","nlssorting.dll","wbemsvc.dll","schannel.dll","ncrypt.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","System.Configuration.Install.ni.dll","wow64win.dll","gdi32.dll","WindowsCodecs.dll","atl.dll","System.Transactions.ni.dll","dhcpcsvc6.dll","advapi32.dll","secur32.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","System.Security.dll","profapi.dll","Microsoft.VisualBasic.ni.dll","System.Management.ni.dll","System.Configuration.Install.dll","MpOAV.dll","OneCoreUAPCommonProxyStub.dll","OnDemandConnRouteHelper.dll","xmllite.dll","ucrtbase.dll","ntasn1.dll","wldp.dll","cryptnet.dll","Microsoft.AppV.AppVClientPowerShell.dll","System.DirectoryServices.dll","msvcp_win.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","ncryptsslp.dll","imagehlp.dll","wintrust.dll","kernel.appcore.dll","Microsoft.PowerShell.ConsoleHost.dll","gdi32full.dll","dwmapi.dll","aepic.dll","dpapi.dll","wshext.dll","mi.dll","wmidcom.dll","windows.storage.dll","edputil.dll","OpcServices.dll","AppxSip.dll","System.Drawing.dll","Microsoft.PowerShell.Commands.Utility.dll","cldapi.dll","pwrshsip.dll","sppc.dll","combase.dll","Accessibility.dll","Microsoft.PowerShell.Security.dll","DWrite.dll","Microsoft.Management.Infrastructure.ni.dll","System.Management.dll","WinTypes.dll","Microsoft.VisualBasic.dll","Microsoft.BitLocker.Structures.dll","powrprof.dll","amsi.dll","MpClient.dll","win32u.dll","coml2.dll","msIso.dll","Microsoft.Management.Infrastructure.Native.dll","mskeyprotect.dll","System.Numerics.dll","Microsoft.AppV.AppvClientComConsumer.dll","Microsoft.PowerShell.Commands.Management.dll","SHCore.dll","miutils.dll","Windows.StateRepositoryPS.dll","msisip.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"DISMHOST.EXE.65E09255.bin","sha256":"9a4b735603297448841758b29d3c387a4ce84e5fd0dae05622f43ce53b8c85e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"}]},{"name":"GW0R76LVV6Y4JLIZJ7FY.temp","sha256":"77d168c6a1b8b97086f50c3b352677fa43bb15c9e318c82157634644eb453ebe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"}]},{"name":"dism.log","sha256":"5481104276fd1dce110a3727e9a72df6730891852a5a1a25544b8daad159dfbc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"}]},{"name":"DISMHOST.EXE.65E1AF00.bin","sha256":"9a4b735603297448841758b29d3c387a4ce84e5fd0dae05622f43ce53b8c85e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"}]},{"name":"63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe.log","sha256":"e44d9a2ed9c1a63c162a13d3e1906145766bb048baa3c87c17f15ddf00ce4982","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"name":"powershell.exe.log","sha256":"8013f6cd1a83fa23f56b9e4a135621af9feeb6ddbfd794ed0b7e7cb6b7ddd665","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"name":"StartupProfileData-NonInteractive","sha256":"3b2b93cf13375b75e286f2ac5eebf5dbdf7a9dc019a414c4280c112b07839954","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\GW0R76LVV6Y4JLIZJ7FY.temp","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RFfea9c.TMP","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{EDF90A16-5DC7-4102-B811-8837E23F5ADB}","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0.exe.log","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_cqcsbyhe.f2o.ps1","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_vvatving.bup.psm1","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"name":"Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"},{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"65de560b275e111be80b823f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7476:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7476:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"name":"Local\\SM0:7476:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"name":"SM0:7476:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"name":"Local\\SM0:7476:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"name":"SM0:7476:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7476:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7476:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7048:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7048:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7048:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"name":"Local\\SM0:7048:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"name":"Local\\SM0:7048:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"name":"SM0:7048:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"name":"SM0:7048:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7048:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]},{"name":"Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"68760b6061113f826d00ba7f"}]}]}},"report_ids":{"sandbox_job_ids":["68760b6061113f826d00ba7f","65de560b275e111be80b823f"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Genie.8DN.Generic Sample 63cbf8a0edc2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 63cbf8a0edc2…. Malware family: Genie.8DN.Generic. Threat score 100/100. 19/27 AV engines flagged this file. 18 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0"}],["$","meta","4",{"property":"og:title","content":"Malicious Genie.8DN.Generic Sample 63cbf8a0edc2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 63cbf8a0edc2…. Malware family: Genie.8DN.Generic. Threat score 100/100. 19/27 AV engines flagged this file. 18 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/63cbf8a0edc294245e2e379283862d7e87e13a559c5493bb1f217e2d660c30e0"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Genie.8DN.Generic Sample 63cbf8a0edc2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 63cbf8a0edc2…. Malware family: Genie.8DN.Generic. Threat score 100/100. 19/27 AV engines flagged this file. 18 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L6e","11",{}]]