24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 54:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T495,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 66e4e0b05fbe… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 66e4e0b05fbe…. Malware family: Trojan.Generic. Threat score 100/100. 11/26 AV engines flagged this file. 17 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/66e4e0b05fbe673afbd9f23ada369eaab823c2ce0285b5004068d6b03e3449e7","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","66e4e0b05fbe673afbd9f23ada369eaab823c2ce0285b5004068d6b03e3449e7"],"about":{"@type":"SoftwareApplication","name":"66e4e.Spy.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"66e4e0b05fbe673afbd9f23ada369eaab823c2ce0285b5004068d6b03e3449e7","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":11,"total":26},"behavioralIndicators":{"malicious":17,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T5a3,Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00001812.00000000.109493.02F70000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00001812.00000000.109493.02F70000.00000004.mdmp") Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp, 00000000-00001812.00000000.109493.6F321000.00000020.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00006136.00000000.109908.6F4B1000.00000020.mdmp")26:T494,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001812.00000000.109493.09680000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp")27:T511,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp")28:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}29:T13df,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006136-9295-151-00CAD501 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006136-9295-151-00CAD501 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006136-9295-202-00CA85B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006136-9295-202-00CA85B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006136-9295-195-00CA8AF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006136-9295-195-00CA8AF0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006136-9295-162-00CAA4B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006136-9295-133-00CA995D Assembly shows XOR instruction xor esi dword ptr [00CB0390h] in Stream UID: 00000000-00006136-9295-133-00CA995D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006136-9295-133-00CA995D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006136-9295-198-00CA8E30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006136-9295-198-00CA8E30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006136-9295-215-00CA92C0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006136-9295-215-00CA92C0 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00006136-9295-217-00CA9F43 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00006136-9295-217-00CA9F43 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00006136-9295-217-00CA9F43 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00006136-9295-217-00CA9F43 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00006136-9295-217-00CA9F43 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00006136-9295-217-00CA9F43 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006136-9295-199-00CA7C30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006136-9295-199-00CA7C30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006136-9295-137-00CADA34 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006136-9295-137-00CADA34 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006136-9295-214-00CAC439 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006136-9295-214-00CAC439 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006136-9295-182-00CA8190 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006136-9295-182-00CA8190 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006136-9295-211-00CAD341 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006136-9295-211-00CAD341 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006136-9295-49-00CAEE60 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006136-9295-149-00CAD560 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006136-9295-149-00CAD560 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006136-9295-126-00CAD490 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006136-9295-126-00CAD490 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006136-9295-158-00CAA510 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006136-9295-141-00CAD610 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006136-9295-141-00CAD610 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006136-9295-161-00CAA4E0 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00006136-9295-194-00CAC4B6 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00006136-9295-194-00CAC4B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006136-9295-135-00CADAD1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006136-9295-135-00CADAD1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006136-9295-203-00CA89F0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006136-9295-203-00CA89F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006136-9295-129-00CA985C Assembly shows XOR instruction xor esi dword ptr [00CB0394h] in Stream UID: 00000000-00006136-9295-129-00CA985C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006136-9295-129-00CA985C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006136-9295-204-00CA9030 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006136-9295-204-00CA9030 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006136-9295-92-00CAE950 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006136-9295-92-00CAE9502a:T4ad,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to decode base64 data Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: HTTP requests contain Base64 strings Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly]2b:T1b31,"66e4e.Spy.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000001800000038548ffd932fa671f800ef00687d9677a0f0ef00705fa6718499c88cfeffffffbcefef00e248a57160efef000000207658f0ef00fb48a571e0dfbb7408000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff3400000000000000e8efef00000000000800000000000000000000000000000000000000000000000000207650548ffd0000000028f0ef0069929c74ffffffff34000000e8efef0008000000000000000000207658f0ef0027949c74f0efef000b0000000000000040f0ef00 (UID: 00000000-00001812) "66e4e.Spy.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001812) "66e4e.Spy.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001812) "66e4e.Spy.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000048d2ef00ecd1ef00226eef7500000605000000002d6eef75d1058ec82d000000ecb73f7670d2ef000000f10268eafc025048fe021100000080000000b0d1ef000000f10234d2ef0070c8f075c5a594bdfeffffff2d000000d0cc4e762700000004d2ef00856af1751c23f67544d2ef00f85ff17508000000bb69f075b269f07579068ec82d000000ecb73f7627000000d0cc4e7618d2ef002d000000d0cc4e762700000048d2ef00856af1751c23f67590d2ef007e8a4d76ee8c4d76738a4d767494877c2d000000ecb73f7627000000d0cc4e766c280605002806057494877c58d2ef00fc528b7644d3ef00e0844d76dcb7e10afeffffff738a4d76 (UID: 00000000-00001812) "66e4e.Spy.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000676f187d676f00000000d0a97b740000747490117574284afd0230b1f802707efd0208e8ef00feffffffb0eaef00506abb7738a51af3feffffffc8e8ef00eaa9b777284afd0200000000707efd02a11400000a000b00b297676f5c76676f6876676f707efd02781bff02140000000000000000000000284afd02f0e8ef00cc2dbc77707efd02000000007c7efd0200000000f800606f00000000cc0d24385ce8ba776840b9770003000019000000110000001000000060bcf70228e9ef008d9a3e7418bcf7022467fe020000000048e9ef002c05f7022467fe0260e9ef000000606ffeffffff0400000020af3e7400000000000000000000606f50e9ef00 (UID: 00000000-00001812) "66e4e.Spy.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000001c0000000000060518deef000000000000000000a301b877688e3684104d3008d007960728000000000000000e000000000096070000000019270002000000000a020008f02f30086080060507000000000000002000000000009607cc0196070408960700000000000896070000000010deef005916b8771c000000000000000407316f00000605000000002800000000000000000000000500000002000000000006051c00000000000000ec5a060530deef00ee13b8771c000000ee13b87700000000000000001c000000ffffffff50deef005072ef7500000605000000001c0000000407316f (UID: 00000000-00001812) "66e4e.Spy.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000b777f80f3208f80f320800000000d05d320898c03108100c320811000000a8c031081100180050f5b777e8483108e848310800000000090a8ec820bd3008f03931082b00000030bd30080a002a0050f5b777103232081032320800000000f80f3208e8c03108202c32082e000000f8c0310801002e00700a960764000000410a8ec8e8483108e848310800000000feffffff8470ef75a8deef006570ef7500000605000000008470ef75950a8ec8103232081032320800000000e32e2d6fe8483108b5ce296f094ead4870deef00176f2a6f04dfef0070c8f0751da694bdfeffffff8470ef750a8e2c6f10323208f08d2c6fd0deef00a7ce296f01000000 (UID: 00000000-00001812) "66e4e.Spy.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000b777f0113208f0113208000000000000000098c03108100c32081a00000050f5b7773047310830473108000000008470ef7520bd3008f03931082600000030bd30080a002700e00c96076400000050f5b777103232081032320800000000f0113208e8c03108202c32082e000000f8c0310801002e00700a960764000000304731083047310800000000feffffff8470ef75a4deef006570ef7500000605000000008470ef75990a8ec8103232081032320800000000e32e2d6f30473108b5ce296f154ead486cdeef00176f2a6f04dfef0070c8f0751da694bdfeffffff8470ef750a8e2c6f10323208f08d2c6fccdeef00a7ce296f01000000504b2a6f (UID: 00000000-00001812) "66e4e.Spy.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000fd0250056073000000002a002774fc8620742a002774fb8cb8770000000000000000fc86207430dfef000000000000000000000000002a00277409000000e857fd0209000000fc86207400000000500560731800000080658ffd932fa67140f0ee0000000000b0e1ef00705fa6718499c88cfefffffff0deef001a67a571a0deef0000000000000000003367a5711cdfef000000000000000000000000000000000000000000000000000100000000000000010000000000000018dfef000000000028dfef00000000001cdfef000000000000000000000000004b00cd7498658ffd30dfef0084da9a74448e368434dfef00dab99a740000577328dfef00 (UID: 00000000-00001812) "66e4e.Spy.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000050c3fe0b38cfb8772426f702bcc3fe0b01000000d825f7022426f702d825f702040000000400000000e0a67400100000bcc3fe0b01000000d825f702cd97b8779c97b8776495278fb50f9d74d825f7020000b877000000003c1fa8680000000080eea3740100000000000000f8e2a674000000000400000080a93e744840a574f8e2a674c0c3fe0b80e83a75b846fd0280e83a75bcc3fe0b0000000080e83a7500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000deb40303f4b40303 (UID: 00000000-00001812) "66e4e.Spy.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000b691fc02ce91fc02 (UID: 00000000-00001812)2c:T1909,"66e4e.Spy.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000010000000c00000000000000000000000000000001000000010000000000000000000000720061006d00650000000000000000000000000000000000010000002f000000000000000000000063006f006e006600690067005c006d006100630000000000000065000000000000000000000000000000000000000000 (UID: 00000000-00001812) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000005c000000000063000000000000000100000074001400000050adb000000000000100000001000000000000002c000000c035b10000000000140000000a000000000000000000000000006f0080e6b00014000000000000000000000000000000000000000000000000006e000000000067000000f834af00 (UID: 00000000-00006136) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000a3008000000000000000a11400005cce3709ee13b87780000000ee13b877000000000000000080000000f062bb6e000000007cce37095072ef750000a3000000000080000000f062bb6e02000000002fbb6e98ce3709fb62bb6e010000008004bc6e885ff175000000009f67563bc8ce3709b864bb6ef42ebb6e (UID: 00000000-00006136) "66e4e.Spy.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000002812c2040000e202a3ad107318000000000000000000000003000000020000000000e2020c000000000000002000000024f22508ee13b8772812c204ee13b87700000000000000000c000000a823eb020023eb023cf2250828237c720000e202000000000c00000060c2cc0448f225082f995e6f0c000000 (UID: 00000000-00006912) "66e4e.Spy.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000e202d8b8eb0218000000000000000000000003000000020000000000e2020c0000000000000078a916761cf0b500ee13b8772812c204ee13b87700000000000000000c0000006f01546f2812c20434f0b50028237c720000e202000000000c000000b014516f40f0b5002f995e6f0c000000 (UID: 00000000-00006912) "66e4e.Spy.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000016b8770c00000000000000000000000000e202e0f0b50018000000000000000000000003000000020000000000e2020c0000000000000084f0b50088f0b500ee13b87700000000ee13b87700000000000000000c000000283671faa0f0b50028237c720000e202000000000c00000030a55e6facf0b5002f995e6f0c000000 (UID: 00000000-00006912) "66e4e.Spy.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000002812c2040000e202a3ad107318000000000000000000000003000000020000000000e2020c000000000000002000000034ef4508ee13b8772812c204ee13b87700000000000000000c000000c826eb020026eb024cef450828237c720000e202000000000c0000002022cd0458ef45082f995e6f0c000000 (UID: 00000000-00006912) "66e4e.Spy.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000e202c8bceb0218000000000000000000000003000000020000000000e2020c0000000000000078a916761cf0b500ee13b8772812c204ee13b87700000000000000000c0000006f01546f2812c20434f0b50028237c720000e202000000000c000000b014516f40f0b5002f995e6f0c000000 (UID: 00000000-00006912) "66e4e.Spy.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000016b8770c00000000000000000000000000e202b8f0b50018000000000000000000000003000000020000000000e2020c000000000000005cf0b50060f0b500ee13b87700000000ee13b87700000000000000000c000000283671fa78f0b50028237c720000e202000000000c00000030a55e6f84f0b5002f995e6f0c000000 (UID: 00000000-00006912) "66e4e.Spy.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000002812c2040000e202a3ad107318000000000000000000000003000000020000000000e2020c000000000000002000000034f04508ee13b8772812c204ee13b87700000000000000000c0000003028eb020028eb024cf0450828237c720000e202000000000c0000002062cd0458f045082f995e6f0c000000 (UID: 00000000-00006912) "66e4e.Spy.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000016b8770c00000000000000000000000000e2028baa167618000000000000000000000003000000020000000000e2020c00000000000000686ced02f8efb500ee13b8772812c204ee13b87700000000000000000c0000006f01546f10f0b50028237c720000e202000000000c000000b014516f1cf0b5002f995e6f0c000000 (UID: 00000000-00006912) "66e4e.Spy.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000002812c2040000e202a3ad107318000000000000000000000003000000020000000000e2020c000000000000002000000014eef608ee13b8772812c204ee13b87700000000000000000c00000058655808006558082ceef60828237c720000e202000000000c00000020e2d20438eef6082f995e6f0c000000 (UID: 00000000-00006912) "66e4e.Spy.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000016b8770c00000000000000000000000000e2021000000018000000000000000000000003000000020000000000e2020c00000000000000fcefb500e8efb500ee13b87700000000ee13b87700000000000000000c000000ffff536f00f0b50028237c720000e202000000000c000000b014516f0cf0b5002f995e6f0c000000 (UID: 00000000-00006912) "66e4e.Spy.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000016b8770c00000000000000000000000000e2029064580818000000000000000000000003000000020000000000e2020c00000000000000d7240f73a8f0b500ee13b87700000000ee13b87700000000000000000c00000060f2b500c0f0b50028237c720000e202000000000c00000030a55e6fccf0b5002f995e6f0c000000 (UID: 00000000-00006912) "66e4e.Spy.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000002812c2040000e202a3ad107318000000000000000000000003000000020000000000e2020c0000000000000020000000b4f21209ee13b8772812c204ee13b87700000000000000000c000000d867580800675808ccf2120928237c720000e202000000000c0000002022d304d8f212092f995e6f0c000000 (UID: 00000000-00006912) "66e4e.Spy.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000e20298aae80218000000000000000000000003000000020000000000e2020c00000000000000e8060df7e4efb500ee13b87700000000ee13b87700000000000000000c000000ffff536f2c685808fcefb50028237c720000e202000000000c000000b014516f08f0b5002f995e6f0c000000 (UID: 00000000-00006912) "66e4e.Spy.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000016b8770c00000000000000000000000000e202f86a580818000000000000000000000003000000020000000000e2020c00000000000000d7240f73a8f0b500ee13b87700000000ee13b87700000000000000000c00000060f2b500c0f0b50028237c720000e202000000000c00000030a55e6fccf0b5002f995e6f0c000000 (UID: 00000000-00006912)2d:T4eb,Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp")2e:Ta01,"66e4e.Spy.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "")2f:T1355,"66e4e.Spy.exe" queries volume information of "C:\66e4e.Spy.exe" at 00000000-00001812-00000C15-710628720 "66e4e.Spy.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00001812-00000C15-710806855 "66e4e.Spy.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00001812-00000C15-710957351 "66e4e.Spy.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00000000-00001812-00000C15-712115461 "66e4e.Spy.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00000000-00001812-00000C15-712138350 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll" at 00000000-00006136-00000C15-717677813 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00006136-00000C15-718005976 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00006136-00000C15-719874564 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll" at 00000000-00006136-00000C15-720057354 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00006136-00000C15-720106016 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006136-00000C15-720181395 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006136-00000C15-720217791 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006136-00000C15-720218058 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006136-00000C15-720233309 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll" at 00000000-00006136-00000C15-721573698 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00006136-00000C15-721791724 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00006136-00000C15-721803795 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00006136-00000C15-721804083 "powershell.exe" queries volume information of "C:\" at 00000000-00006136-00000C15-722326794 "powershell.exe" queries volume information of "C:\share" at 00000000-00006136-00000C15-722328075 "powershell.exe" queries volume information of "C:\share" at 00000000-00006136-00000C15-722587946 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006136-00000C15-724456563 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006136-00000C15-725371648 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006136-00000C15-725931242 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006136-00000C15-72632192730:T5bef,"66e4e.Spy.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001812) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001812) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e7f9e4af50c666b5fec85987c303915a\Microsoft.Management.Infrastr (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00006136) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00006136) "66e4e.Spy.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter C:\vaultcli.dll (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter vaultcli.dll (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00006912) "66e4e.Spy.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00006912)31:T173f,"insert into [book] (name, author, publish_year, category) values (@NAME, @AUTHOR, @PUBLISH, @CATEGORY)" (Source: 66e4e.Spy.exe, Indicator: "insert into [book] (name, author, publish_year, category) values (@name, @author, @publish, @category)"), "insert into [user] (username, password, full_name, phone, address) values (@USERNAME, @PASSWORD, @FULLNAME, @PHONE, @ADDRESS)" (Source: 66e4e.Spy.exe, Indicator: "insert into [user] (username, password, full_name, phone, address) values (@username, @password, @fullname, @phone, @address)"), "select id category name author YEAR(publish_year) as publish_year status from [book]" (Source: 66e4e.Spy.exe, Indicator: "select id category name author year(publish_year) as publish_year status from [book]"), "delete from [book] where id=@ID" (Source: 66e4e.Spy.exe, Indicator: "delete from [book] where id=@id"), "select id category name author YEAR(publish_year) as publish_year status from [book] where category=@CATEGORY" (Source: 66e4e.Spy.exe, Indicator: "select id category name author year(publish_year) as publish_year status from [book] where category=@category"), "delete from [category] where id=@ID" (Source: 66e4e.Spy.exe, Indicator: "delete from [category] where id=@id"), "select * from [user] where isadmin=0" (Source: 66e4e.Spy.exe, Indicator: "select * from [user] where isadmin=0"), "select * from [report] where username=@USERNAME" (Source: 66e4e.Spy.exe, Indicator: "select * from [report] where username=@username"), "delete from [user] where id=@ID" (Source: 66e4e.Spy.exe, Indicator: "delete from [user] where id=@id"), "select id name author category YEAR(publish_year) as publish_year status from [book] where status=1" (Source: 66e4e.Spy.exe, Indicator: "select id name author category year(publish_year) as publish_year status from [book] where status=1"), "select id name author category YEAR(publish_year) as publish_year status from [book] where category=@CATEGORY and status=1" (Source: 66e4e.Spy.exe, Indicator: "select id name author category year(publish_year) as publish_year status from [book] where category=@category and status=1"), "update [book] set status=0 where id=@ID" (Source: 66e4e.Spy.exe, Indicator: "update [book] set status=0 where id=@id"), "select r.id as id username book_id name category author receive_date deadline return_date fine r.status as status from [report] r inner join [book] b on r.book_id=b.id where username=@USERNAME" (Source: 66e4e.Spy.exe, Indicator: "select r.id as id username book_id name category author receive_date deadline return_date fine r.status as status from [report] r inner join [book] b on r.book_id=b.id where username=@username"), "update [report] set return_date=@RETURN_DATE fine=@FINE status=0 where id=@ID and status=1" (Source: 66e4e.Spy.exe, Indicator: "update [report] set return_date=@return_date fine=@fine status=0 where id=@id and status=1"), "update [book] set name=@NAME author=@AUTHOR publish_year=@PUBLISH category=@CATEGORY where id=@ID" (Source: 6000057-AdminAddBookRepository~AdminUpdateBook, Indicator: "update [book] set name=@name author=@author publish_year=@publish category=@category where id=@id"), "insert into [category] (name) values (@NAME)" (Source: 6000059-AdminAddCategoryRepository~AdminAddCategory, Indicator: "insert into [category] (name) values (@name)"), "update [category] set name=@NAME where id=@ID" (Source: 600005a-AdminAddCategoryRepository~AdminUpdateCategory, Indicator: "update [category] set name=@name where id=@id"), "update [user] set username=@USERNAME password=@PASSWORD full_name=@FULLNAME phone=@PHONE address=@ADDRESS where id=@ID" (Source: 600005d-AdminAddUserRepository~AdminUpdateUser, Indicator: "update [user] set username=@username password=@password full_name=@fullname phone=@phone address=@address where id=@id"), "select id category name author YEAR(publish_year) as publish_year status from [book] where name like @NAME or author like @AUTHOR" (Source: 6000061-AdminBooksRepository~AdminFindBookNameAuthor, Indicator: "select id category name author year(publish_year) as publish_year status from [book] where name like @name or author like @author"), "select * from [category]" (Source: 6000062-AdminBooksRepository~AdminAllCategory, Indicator: "select * from [category]"), "select id from [user] where username=@USERNAME and password=@PASSWORD and isadmin=@ISADMIN" (Source: 600006c-LoginRepository~Login, Indicator: "select id from [user] where username=@username and password=@password and isadmin=@isadmin"), "select id name author category YEAR(publish_year) as publish_year status from [book] where name like @NAME or author like @AUTHOR and status=1" (Source: 600006f-UserBooksRepository~UserFindBookNameAuthor, Indicator: "select id name author category year(publish_year) as publish_year status from [book] where name like @name or author like @author and status=1"), "insert into [report] (username, book_id, receive_date, deadline) values (@USERNAME, @BOOK_ID, @RECEIVE_DATE, @DEADLINE)" (Source: 6000072-UserBooksRepository~UserAddUserCard, Indicator: "insert into [report] (username, book_id, receive_date, deadline) values (@username, @book_id, @receive_date, @deadline)"), "select r.id as id username book_id name category author receive_date deadline return_date fine r.status as status from [report] r inner join [book] b on r.book_id=b.id where r.status=1 and username=@USERNAME" (Source: 6000074-UserUserCardRepository~UserAllUserCard, Indicator: "select r.id as id username book_id name category author receive_date deadline return_date fine r.status as status from [report] r inner join [book] b on r.book_id=b.id where r.status=1 and username=@username"), "update [book] set status=1 where id=@ID" (Source: 6000075-UserUserCardRepository~UserReturnBook, Indicator: "update [book] set status=1 where id=@id")32:Tb8a2,Found reference to API (Indicator: "GetObject"; File: "66e4e.Spy.exe") Found reference to API (Indicator: "MessageBox"; File: "66e4e.Spy.exe") Found reference to API (Indicator: "InitializeConditionVariable"; File: "00000000-00006136.00000000.109908.00CA1000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; File: "00000000-00006136.00000000.109908.00CA1000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "00000000-00006136.00000000.109908.00CA1000.00000020.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00001812.00000000.109493.02F70000.00000004.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00001812.00000000.109493.02F70000.00000004.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00001812.00000000.109493.02F70000.00000004.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00001812.00000000.109493.07990000.00000004.mdmp, 00000000-00001812.00000000.109493.09680000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001812.00000000.109493.07990000.00000004.mdmp, 00000000-00001812.00000000.109493.09680000.00000004.mdmp, 00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00001812.00000000.109493.09680000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001812.00000000.109493.09680000.00000004.mdmp, 00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00001812.00000000.109493.09680000.00000004.mdmp") Found reference to API (Indicator: "GetTempFileName"; Source: "00000000-00001812.00000000.109493.09680000.00000004.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00001812.00000000.109493.09680000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp, 00000000-00001812.00000000.109493.6F321000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp, 00000000-00001812.00000000.109493.6F321000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp, 00000000-00001812.00000000.109493.6F321000.00000020.mdmp") Found reference to API (Indicator: "EventWrite"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp, 00000000-00001812.00000000.109493.6F321000.00000020.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp, 00000000-00001812.00000000.109493.6F321000.00000020.mdmp") Found reference to API (Indicator: "InstallELAMCertificateInfo"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp") Found reference to API (Indicator: "WSACleanup"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp") Found reference to API (Indicator: "BCryptGetProperty"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp, 00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "BCryptCreateHash"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp, 00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "BCryptDestroyHash"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp, 00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "BCryptHashData"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp, 00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "BCryptFinishHash"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp, 00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp, 00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp, 00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp") Found reference to API (Indicator: "CryptGetHashParam"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp, 00000000-00001812.00000000.109493.6F321000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp, 00000000-00001812.00000000.109493.6F321000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp, 00000000-00001812.00000000.109493.6F321000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp, 00000000-00001812.00000000.109493.6F321000.00000020.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp, 00000000-00001812.00000000.109493.6F321000.00000020.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminCalcHashFromFileHandle"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminAcquireContext"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminEnumCatalogFromHash"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminReleaseContext"; Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp") Found reference to API (Indicator: "RpcBindingFromStringBindingW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetAuthInfoExW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetOption"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFree"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "RpcSmDestroyClientContext"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "RpcStringFreeW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "RpcStringBindingComposeW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "UnregisterWaitEx"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "DeleteTimerQueueTimer"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceConfigW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountSidW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSidToSidW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "IIDFromString"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "NdrClientCall2"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "UuidCreate"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "UuidToStringW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "UuidFromStringW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "OpenFileMappingW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "VirtualLock"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatus"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "DuplicateToken"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "RegNotifyChangeKeyValue"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "CoGetObject"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "CancelSynchronousIo"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpool"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "StartThreadpoolIo"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpool"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolIo"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolIoCallbacks"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "CancelThreadpoolIo"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWorkCallbacks"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMinimum"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWaitCallbacks"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMaximum"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolIo"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00001812.00000000.109493.6F321000.00000020.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00006136.00000000.109908.00CA1000.00000020.mdmp, 00000000-00006136.00000000.109908.6F4B1000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00006136.00000000.109908.00CA1000.00000020.mdmp, 00000000-00006136.00000000.109908.6F4B1000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00006136.00000000.109908.00CA1000.00000020.mdmp, 00000000-00006136.00000000.109908.6F4B1000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00006136.00000000.109908.070D0000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00006136.00000000.109908.070D0000.00000004.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00006136.00000000.109908.6F4B1000.00000020.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00006136.00000000.109908.6F4B1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00006136.00000000.109908.6F4B1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00006136.00000000.109908.6F4B1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00006136.00000000.109908.6F4B1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00006136.00000000.109908.6F4B1000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00006136.00000000.109908.6F4B1000.00000020.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00006136.00000000.109908.6F4B1000.00000020.mdmp")33:T452,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00001812.00000000.109493.6F311000.00000002.mdmp, 00000000-00001812.00000000.109493.6F335000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00006136.00000000.109908.00CB1000.00000002.mdmp, 00000000-00006136.00000000.109908.6F4C5000.00000002.mdmp")34:T171f,"SOFTWARE\Microsoft\PowerShell\3" in Source: 9295-184-00CABFA2 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 9295-202-00CA85B0 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 9295-202-00CA85B0 "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 9295-182-00CA8190 "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 9295-149-00CAD560 "SOFTWARE\Microsoft\PowerShell" in Source: 9295-195-00CA8AF0 "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001812.00000000.109493.02F70000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001812.00000000.109493.02F70000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001812.00000000.109493.02F70000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00001812.00000000.109493.6F281000.00000020.mdmp "Software\Microsoft\RemovalTools\MRT" in Source: 00000000-00001812.00000000.109493.6F281000.00000020.mdmp "HKLM\" in Source: 00000000-00001812.00000000.109493.6F281000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00001812.00000000.109493.6F281000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001812.00000000.109493.6F281000.00000020.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006136.00000000.109908.00AF0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006136.00000000.109908.00AF0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00006136.00000000.109908.00CA1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00006136.00000000.109908.00CA1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00006136.00000000.109908.00CA1000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00006136.00000000.109908.00CA1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00006136.00000000.109908.00CA1000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00006136.00000000.109908.00CA1000.00000020.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00006136.00000000.109908.04A50000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00006136.00000000.109908.04A50000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00006136.00000000.109908.04A50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00006136.00000000.109908.04A50000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00006136.00000000.109908.04A50000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00006136.00000000.109908.04A50000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00006136.00000000.109908.04A50000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00006136.00000000.109908.04A50000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00006136.00000000.109908.04A50000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00006136.00000000.109908.04A50000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00006136.00000000.109908.04A50000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00006136.00000000.109908.04A50000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00006136.00000000.109908.04A50000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00006136.00000000.109908.04A50000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00006136.00000000.109908.04A50000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00006136.00000000.109908.04A50000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00006136.00000000.109908.04A50000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00006136.00000000.109908.04A50000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00006136.00000000.109908.04A50000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00006136.00000000.109908.04A50000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00006136.00000000.109908.04A50000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00006136.00000000.109908.04A50000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00006136.00000000.109908.04A50000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00006136.00000000.109908.04A50000.00000004.mdmp35:T1d32,"66e4e.Spy.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "66e4e.Spy.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "66e4e.Spy.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "66e4e.Spy.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "66e4e.Spy.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "66e4e.Spy.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "66e4e.Spy.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "66e4e.Spy.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135] "66e4e.Spy.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "66e4e.Spy.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "66e4e.Spy.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "66e4e.Spy.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "66e4e.Spy.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "66e4e.Spy.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "66e4e.Spy.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "66e4e.Spy.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "66e4e.Spy.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "66e4e.Spy.exe" failed to load missing module "C:\vaultcli.dll" - [base:0; Status:c0000135]36:T4f81,"66e4e.Spy.exe" loaded module "KERNEL32" at base 75c00000 "66e4e.Spy.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 748c0000 "66e4e.Spy.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 748c0000 "66e4e.Spy.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 748c0000 "66e4e.Spy.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 77870000 "66e4e.Spy.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 748c0000 "66e4e.Spy.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 748c0000 "66e4e.Spy.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 748c0000 "66e4e.Spy.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 730f0000 "66e4e.Spy.exe" loaded module "ADVAPI32.DLL" at base 74660000 "66e4e.Spy.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72fe0000 "66e4e.Spy.exe" loaded module "SHLWAPI.DLL" at base 75e60000 "66e4e.Spy.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 75e10000 "66e4e.Spy.exe" loaded module "VERSION.DLL" at base 74190000 "66e4e.Spy.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72830000 "66e4e.Spy.exe" loaded module "USER32.DLL" at base 74740000 "66e4e.Spy.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 748c0000 "66e4e.Spy.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "66e4e.Spy.exe" loaded module "MSCOREE.DLL" at base 71a90000 "66e4e.Spy.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 759b0000 "66e4e.Spy.exe" loaded module "PSAPI.DLL" at base 75dc0000 "66e4e.Spy.exe" loaded module "KERNEL32.DLL" at base 75c00000 "66e4e.Spy.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70630000 "66e4e.Spy.exe" loaded module "RPCRT4.DLL" at base 778a0000 "66e4e.Spy.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "66e4e.Spy.exe" loaded module "OLE32.DLL" at base 76280000 "66e4e.Spy.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73f20000 "66e4e.Spy.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "66e4e.Spy.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 759b0000 "66e4e.Spy.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 748c0000 "66e4e.Spy.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 726d0000 "66e4e.Spy.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "66e4e.Spy.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 71c70000 "66e4e.Spy.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "66e4e.Spy.exe" loaded module "UXTHEME.DLL" at base 73f20000 "66e4e.Spy.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6fe10000 "66e4e.Spy.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 71b60000 "66e4e.Spy.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6f690000 "66e4e.Spy.exe" loaded module "NTDLL.DLL" at base 77b40000 "66e4e.Spy.exe" loaded module "SHELL32.DLL" at base 763d0000 "66e4e.Spy.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "66e4e.Spy.exe" loaded module "BCRYPT.DLL" at base 73240000 "66e4e.Spy.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 71b10000 "66e4e.Spy.exe" loaded module "IMM32.DLL" at base 77870000 "66e4e.Spy.exe" loaded module "COMCTL32.DLL" at base 6f600000 "66e4e.Spy.exe" loaded module "GDI32.DLL" at base 76200000 "66e4e.Spy.exe" loaded module "GDIPLUS.DLL" at base 74200000 "66e4e.Spy.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 74200000 "66e4e.Spy.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 748c0000 "66e4e.Spy.exe" loaded module "WLDP.DLL" at base 71af0000 "66e4e.Spy.exe" loaded module "AMSI.DLL" at base 6f370000 "66e4e.Spy.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 74190000 "66e4e.Spy.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 6f320000 "66e4e.Spy.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6f280000 "66e4e.Spy.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 75c00000 "66e4e.Spy.exe" loaded module "USERENV.DLL" at base 6f340000 "66e4e.Spy.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74660000 "66e4e.Spy.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\URLMON.DLL" at base 0 "66e4e.Spy.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 75c00000 "66e4e.Spy.exe" loaded module "URLMON.DLL" at base 73d60000 "66e4e.Spy.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 748c0000 "66e4e.Spy.exe" loaded module "SSPICLI.DLL" at base 74470000 "66e4e.Spy.exe" loaded module "MSISO.DLL" at base 6f1b0000 "66e4e.Spy.exe" loaded module "WINDOWSCODECS.DLL" at base 73570000 "66e4e.Spy.exe" loaded module "NTDLL" at base 77b40000 "66e4e.Spy.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "66e4e.Spy.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 6eed0000 "66e4e.Spy.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 75290000 "66e4e.Spy.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 739c0000 "66e4e.Spy.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 6eda0000 "66e4e.Spy.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 763d0000 "66e4e.Spy.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73d60000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 748c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 748c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 748c0000 "powershell.exe" loaded module "KERNEL32" at base 75c00000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 730f0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 74660000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72fe0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 75e60000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 75e10000 "powershell.exe" loaded module "VERSION.DLL" at base 74190000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72830000 "powershell.exe" loaded module "USER32.DLL" at base 74740000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 748c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 71a90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 759b0000 "powershell.exe" loaded module "PSAPI.DLL" at base 75dc0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 75c00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70630000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 76280000 "powershell.exe" loaded module "RPCRT4.DLL" at base 778a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 759b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 76150000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 71b10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 77ac0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 748c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 726d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 71c70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6fe10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 759b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 759b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 77b40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 763d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "AMSI.DLL" at base 6f500000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 74190000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 6f4b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 75f70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E7F9E4AF50C666B5FEC85987C303915A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 6f430000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 75f70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 75fc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6f690000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6f0b0000 "powershell.exe" loaded module "CRYPT32.DLL" at base 75fc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 759b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6ee80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 6ee70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 71b60000 "powershell.exe" loaded module "SSPICLI.DLL" at base 74470000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WLDP.DLL" at base 0 "powershell.exe" loaded module "WLDP.DLL" at base 6ede0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73f20000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6ec70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 75c00000 "powershell.exe" loaded module "USERENV.DLL" at base 6f4d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74660000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 6ebd0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 6ebb0000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 75c00000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 6eb80000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 6ea20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 6e8e0000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 6e8e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\URLMON.DLL" at base 0 "powershell.exe" loaded module "URLMON.DLL" at base 73d60000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 748c0000 "powershell.exe" loaded module "MSISO.DLL" at base 6e7f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 6e740000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 73240000 "powershell.exe" loaded module "OLEAUT32" at base 76150000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 748c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MSVCRT.DLL" at base 0 "powershell.exe" loaded module "MSVCRT.DLL" at base 75eb0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 0 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 6e460000 "powershell.exe" loaded module "MI.DLL" at base 6e440000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MI.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 748c0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WMIDCOM.DLL" at base 6e3b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 748c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6f610000 "powershell.exe" loaded module "GDI32.DLL" at base 76200000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6f5d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6f510000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 748c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 748c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 75c00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 748c0000 "66e4e.Spy.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6f610000 "66e4e.Spy.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 6f5e0000 "66e4e.Spy.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6f5d0000 "66e4e.Spy.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6f510000 "66e4e.Spy.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 748c0000 "66e4e.Spy.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 748c0000 "66e4e.Spy.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "66e4e.Spy.exe" loaded module "OLEAUT32.DLL" at base 76150000 "66e4e.Spy.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "66e4e.Spy.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "66e4e.Spy.exe" loaded module "RASAPI32.DLL" at base 6efd0000 "66e4e.Spy.exe" loaded module "RASMAN.DLL" at base 6efa0000 "66e4e.Spy.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "66e4e.Spy.exe" loaded module "WS2_32.DLL" at base 74b20000 "66e4e.Spy.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73170000 "66e4e.Spy.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "66e4e.Spy.exe" loaded module "WINHTTP.DLL" at base 6eed0000 "66e4e.Spy.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 6eeb0000 "66e4e.Spy.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "66e4e.Spy.exe" loaded module "IPHLPAPI.DLL" at base 74390000 "66e4e.Spy.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 6ee50000 "66e4e.Spy.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 6ee00000 "66e4e.Spy.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "66e4e.Spy.exe" loaded module "SECUR32.DLL" at base 6ee70000 "66e4e.Spy.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 6ed10000 "66e4e.Spy.exe" loaded module "MSKEYPROTECT.DLL" at base 6eda0000 "66e4e.Spy.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 6ebe0000 "66e4e.Spy.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "66e4e.Spy.exe" loaded module "CRYPT32.DLL" at base 75fc0000 "66e4e.Spy.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "66e4e.Spy.exe" loaded module "OLEAUT32" at base 76150000 "66e4e.Spy.exe" loaded module "C:\VAULTCLI.DLL" at base 0 "66e4e.Spy.exe" loaded module "VAULTCLI.DLL" at base 6e9e0000 "66e4e.Spy.exe" loaded module "COMCTL32.DLL" at base 6e85000037:T173f,"insert into [book] (name, author, publish_year, category) values (@NAME, @AUTHOR, @PUBLISH, @CATEGORY)" (Source: 66e4e.Spy.exe, Indicator: "insert into [book] (name, author, publish_year, category) values (@name, @author, @publish, @category)"), "insert into [user] (username, password, full_name, phone, address) values (@USERNAME, @PASSWORD, @FULLNAME, @PHONE, @ADDRESS)" (Source: 66e4e.Spy.exe, Indicator: "insert into [user] (username, password, full_name, phone, address) values (@username, @password, @fullname, @phone, @address)"), "select id category name author YEAR(publish_year) as publish_year status from [book]" (Source: 66e4e.Spy.exe, Indicator: "select id category name author year(publish_year) as publish_year status from [book]"), "delete from [book] where id=@ID" (Source: 66e4e.Spy.exe, Indicator: "delete from [book] where id=@id"), "select id category name author YEAR(publish_year) as publish_year status from [book] where category=@CATEGORY" (Source: 66e4e.Spy.exe, Indicator: "select id category name author year(publish_year) as publish_year status from [book] where category=@category"), "delete from [category] where id=@ID" (Source: 66e4e.Spy.exe, Indicator: "delete from [category] where id=@id"), "select * from [user] where isadmin=0" (Source: 66e4e.Spy.exe, Indicator: "select * from [user] where isadmin=0"), "select * from [report] where username=@USERNAME" (Source: 66e4e.Spy.exe, Indicator: "select * from [report] where username=@username"), "delete from [user] where id=@ID" (Source: 66e4e.Spy.exe, Indicator: "delete from [user] where id=@id"), "select id name author category YEAR(publish_year) as publish_year status from [book] where status=1" (Source: 66e4e.Spy.exe, Indicator: "select id name author category year(publish_year) as publish_year status from [book] where status=1"), "select id name author category YEAR(publish_year) as publish_year status from [book] where category=@CATEGORY and status=1" (Source: 66e4e.Spy.exe, Indicator: "select id name author category year(publish_year) as publish_year status from [book] where category=@category and status=1"), "update [book] set status=0 where id=@ID" (Source: 66e4e.Spy.exe, Indicator: "update [book] set status=0 where id=@id"), "select r.id as id username book_id name category author receive_date deadline return_date fine r.status as status from [report] r inner join [book] b on r.book_id=b.id where username=@USERNAME" (Source: 66e4e.Spy.exe, Indicator: "select r.id as id username book_id name category author receive_date deadline return_date fine r.status as status from [report] r inner join [book] b on r.book_id=b.id where username=@username"), "update [report] set return_date=@RETURN_DATE fine=@FINE status=0 where id=@ID and status=1" (Source: 66e4e.Spy.exe, Indicator: "update [report] set return_date=@return_date fine=@fine status=0 where id=@id and status=1"), "update [book] set name=@NAME author=@AUTHOR publish_year=@PUBLISH category=@CATEGORY where id=@ID" (Source: 6000057-AdminAddBookRepository~AdminUpdateBook, Indicator: "update [book] set name=@name author=@author publish_year=@publish category=@category where id=@id"), "insert into [category] (name) values (@NAME)" (Source: 6000059-AdminAddCategoryRepository~AdminAddCategory, Indicator: "insert into [category] (name) values (@name)"), "update [category] set name=@NAME where id=@ID" (Source: 600005a-AdminAddCategoryRepository~AdminUpdateCategory, Indicator: "update [category] set name=@name where id=@id"), "update [user] set username=@USERNAME password=@PASSWORD full_name=@FULLNAME phone=@PHONE address=@ADDRESS where id=@ID" (Source: 600005d-AdminAddUserRepository~AdminUpdateUser, Indicator: "update [user] set username=@username password=@password full_name=@fullname phone=@phone address=@address where id=@id"), "select id category name author YEAR(publish_year) as publish_year status from [book] where name like @NAME or author like @AUTHOR" (Source: 6000061-AdminBooksRepository~AdminFindBookNameAuthor, Indicator: "select id category name author year(publish_year) as publish_year status from [book] where name like @name or author like @author"), "select * from [category]" (Source: 6000062-AdminBooksRepository~AdminAllCategory, Indicator: "select * from [category]"), "select id from [user] where username=@USERNAME and password=@PASSWORD and isadmin=@ISADMIN" (Source: 600006c-LoginRepository~Login, Indicator: "select id from [user] where username=@username and password=@password and isadmin=@isadmin"), "select id name author category YEAR(publish_year) as publish_year status from [book] where name like @NAME or author like @AUTHOR and status=1" (Source: 600006f-UserBooksRepository~UserFindBookNameAuthor, Indicator: "select id name author category year(publish_year) as publish_year status from [book] where name like @name or author like @author and status=1"), "insert into [report] (username, book_id, receive_date, deadline) values (@USERNAME, @BOOK_ID, @RECEIVE_DATE, @DEADLINE)" (Source: 6000072-UserBooksRepository~UserAddUserCard, Indicator: "insert into [report] (username, book_id, receive_date, deadline) values (@username, @book_id, @receive_date, @deadline)"), "select r.id as id username book_id name category author receive_date deadline return_date fine r.status as status from [report] r inner join [book] b on r.book_id=b.id where r.status=1 and username=@USERNAME" (Source: 6000074-UserUserCardRepository~UserAllUserCard, Indicator: "select r.id as id username book_id name category author receive_date deadline return_date fine r.status as status from [report] r inner join [book] b on r.book_id=b.id where r.status=1 and username=@username"), "update [book] set status=1 where id=@ID" (Source: 6000075-UserUserCardRepository~UserReturnBook, Indicator: "update [book] set status=1 where id=@id")38:Ta8a,Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Press Enter to continue...me of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp")39:T178e,"66e4e.Spy.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "66e4e.Spy.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "66e4e.Spy.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "66e4e.Spy.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "66e4e.Spy.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "66e4e.Spy.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "66e4e.Spy.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "66e4e.Spy.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "66e4e.Spy.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "66e4e.Spy.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "66e4e.Spy.exe" touched "This Device" (Path: "HKCU\WOW6432NODE\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "66e4e.Spy.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\WOW6432NODE\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "66e4e.Spy.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "66e4e.Spy.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "66e4e.Spy.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "66e4e.Spy.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "66e4e.Spy.exe" touched "Other Users Folder" (Path: "HKCU\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "66e4e.Spy.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "66e4e.Spy.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "66e4e.Spy.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "66e4e.Spy.exe" touched "Games Explorer" (Path: "HKCU\WOW6432NODE\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "66e4e.Spy.exe" touched "StreamBackedFolder" (Path: "HKCU\WOW6432NODE\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "66e4e.Spy.exe" touched "Computers and Devices" (Path: "HKCU\WOW6432NODE\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "66e4e.Spy.exe" touched "Removable Drives" (Path: "HKCU\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "66e4e.Spy.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "66e4e.Spy.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "66e4e.Spy.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "66e4e.Spy.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "66e4e.Spy.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "66e4e.Spy.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "66e4e.Spy.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "66e4e.Spy.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "66e4e.Spy.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "powershell.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\WOW6432NODE\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\WOW6432NODE\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS") "66e4e.Spy.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "66e4e.Spy.exe" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32")3a:T83c,"66e4e.Spy.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],inc edi,aaa ,cmp byte ptr [edi], dh,inc edi,pop edx,dec edx,xor eax, 0x31554837,push ecx,inc edx,xor byte ptr [eax], bh,inc ebp,xor eax, 0x4a5135,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "NcnBt.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],inc edi,aaa ,cmp byte ptr [edi], dh,inc edi,pop edx,dec edx,xor eax, 0x31554837,push ecx,inc edx,xor byte ptr [eax], bh,inc ebp,xor eax, 0x4a5135,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"3b:T6cc,"66e4e.Spy.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "66e4e.Spy.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "66e4e.Spy.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "66e4e.Spy.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "66e4e.Spy.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "KO-KR") "66e4e.Spy.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "KO-KR") "66e4e.Spy.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN") "66e4e.Spy.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-CN") "66e4e.Spy.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HK") "66e4e.Spy.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HK") "66e4e.Spy.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "JA-JP") "66e4e.Spy.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "JA-JP") "66e4e.Spy.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "66e4e.Spy.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH")3c:Teff,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00001812-00000C25-710079918] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00001812-00000C25-710373855] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00001812-00000C25-710467435] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00001812-00000C25-710524776] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00001812-00000C25-710605389] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00001812-00000C25-710629719] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00001812-00000C25-710688730] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00001812-00000C25-710777729] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00001812-00000C25-710847613] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00001812-00000C25-710920359] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00001812-00000C25-711039773] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00001812-00000C25-711156262] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00001812-00000C25-711182148] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00001812-00000C25-711223741] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00001812-00000C25-711738357] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00001812-00000C25-712421261] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00001812-00000C25-712445499] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00001812-00000C25-712471093] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00001812-00000C25-712855147] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00001812-00000C25-712993637] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00001812-00000C25-713099417] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" [Source: 00000000-00001812-00000C25-713423340] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00001812-00000C25-714933490] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00006136-00000C25-717606599] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00006136-00000C25-717949582]3d:T712,Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp")3e:T49e,"NcnBt.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%APPDATA%\NcnBt\NcnBt.exe]- [targetUID: 00000000-00006912] "powershell.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log]- [targetUID: 00000000-00006136] "66e4e.Spy.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\66e4e.Spy.exe.log]- [targetUID: 00000000-00006912] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00006136] "tmp20B8.tmp" has type "XML 1.0 document ASCII text"- Location: [%TEMP%\tmp20B8.tmp]- [targetUID: 00000000-00001812] "XJRRUUSuj.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "XJRRUUSuj.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%APPDATA%\XJRRUUSuj.exe]- [targetUID: 00000000-00001812] "NcnBt.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A]3f:T92e,"66e4e.Spy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "66e4e.Spy.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "66e4e.Spy.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "66e4e.Spy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\66E4E.SPY.EXE"; Key: ""; Value: "") "66e4e.Spy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "66e4e.Spy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME"; Key: ""; Value: "") "66e4e.Spy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID"; Key: ""; Value: "") "66e4e.Spy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: ""; Value: "") "66e4e.Spy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\CUSTOMATTRIBUTES"; Key: ""; Value: "") "66e4e.Spy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\DIAGNOSIS"; Key: ""; Value: "") "66e4e.Spy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER"; Key: ""; Value: "") "66e4e.Spy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: ""; Value: "") "66e4e.Spy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\DEBUGINFORMATION"; Key: ""; Value: "") "66e4e.Spy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY\CUSTOMATTRIBUTES"; Key: ""; Value: "") "66e4e.Spy.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "66e4e.Spy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "66e4e.Spy.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "66e4e.Spy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "")40:Te37,"66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "IDLETIMERWINDOW"; Value: "") "66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATIONTYPE"; Value: "") "66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "SERVER"; Value: "") "66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "DLLPATH"; Value: "") "66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "THREADING"; Value: "") "66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "TRUSTLEVEL"; Value: "") "66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "REMOTESERVER"; Value: "") "66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEASUSER"; Value: "") "66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINSHAREDBROKER"; Value: "") "66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "PERMISSIONS"; Value: "") "66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXEPATH"; Value: "") "66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "COMMANDLINE"; Value: "") "66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITYTYPE"; Value: "") "66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "PERMISSIONS"; Value: "") "66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "ACTIVATABLECLASSES"; Value: "") "66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVERTYPE"; Value: "") "66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "APPID"; Value: "") "66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITY"; Value: "") "66e4e.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVICENAME"; Value: "")41:Ta37,"66e4e.Spy.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "66e4e.Spy.exe" trying to access non-existent file "C:\FLTLIB.DLL" "66e4e.Spy.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "66e4e.Spy.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "66e4e.Spy.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "66e4e.Spy.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "66e4e.Spy.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "66e4e.Spy.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "66e4e.Spy.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "66e4e.Spy.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" "66e4e.Spy.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "66e4e.Spy.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" "66e4e.Spy.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" "66e4e.Spy.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\OLE32.DLL" "66e4e.Spy.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" "66e4e.Spy.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "66e4e.Spy.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "66e4e.Spy.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "66e4e.Spy.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "66e4e.Spy.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.DLL" "66e4e.Spy.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" "66e4e.Spy.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\UXTHEME.DLL" "66e4e.Spy.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll"42:T7aa,"66e4e.Spy.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "66e4e.Spy.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "66e4e.Spy.exe" trying to access non-existent file "C:\66E4E.SPY.EXE.CONFIG" "66e4e.Spy.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "66e4e.Spy.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "66e4e.Spy.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\66E4E.SPY.EXE.LOG" "66e4e.Spy.exe" trying to access non-existent file "C:\66e4e.Spy.exe.config" "66e4e.Spy.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\ODPR" "66e4e.Spy.exe" trying to access non-existent file "C:\66E4E.SPY.INI" "66e4e.Spy.exe" trying to access non-existent file "C:\66e4e.Spy.INI" "66e4e.Spy.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "66e4e.Spy.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.WINDOWS.FORMS" "66e4e.Spy.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.WINDOWS.FORMS.INI" "66e4e.Spy.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.INI" "66e4e.Spy.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.DRAWING" "66e4e.Spy.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\SYSTEM.DRAWING.INI" "66e4e.Spy.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI"43:T400,"1.0.0.0" "16.0.0.0" "64.124.12.162" Potential IP "8.0.0.0" found in string "icrosoft.VisualBasic,8.0.0.0,,b03f5f7f11d50a3a" Potential IP "4.0.0.0" found in string "4.0.0.0, Cul" "1.3.1.0" "0.0.0.7" "0.0.0.1" Potential IP "1.0.0.0" found in string "icrosoft.Management.Infrastructure,1.0.0.0,,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" "192.168.0.2" Potential IP "4.0.0.0" found in string "ystem.Numerics,4.0.0.0,,b77a5c561934e089" Potential IP "4.0.0.0" found in string "n=4.0.0.0, C" "2.5.4.6" "2.5.4.8" "2.5.4.7" "2.5.4.10" "2.5.4.3" "2.5.29.10" "2.5.29.32" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.17" "2.5.29.15" "2.5.29.14" "2.5.29.31" "2.5.29.19" Potential IP "2.5.29.37" found in string "%2.5.29.37" "3.0.0.0" "1.1.0.1" "2.5.29.1" "2.5.29.16" "2.5.4.5" "2.5.4.11"44:T1c12,Heuristic match: "1R.Ma" Pattern match: "www.inkscape.org" Heuristic match: "u++@.bn" Heuristic match: "3/.wF" Heuristic match: "YY.TD" Pattern match: "http://schemas.microsoft.com/windows/2004/02/mit/task" Heuristic match: "ip-api.com" Heuristic match: "api.ipify.org" Heuristic match: "stem.Co" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Pattern match: "Microsoft.Net/assembly/GAC_MSIL/Microsoft.VisualBasic/v4.0_10.0.0.0__b03f5f7f11d50a3a/Microsoft.VisualBasic.dll" Heuristic match: "windows\microsoft.net" Heuristic match: "olicy.12.0.Microsoft.Office.Interop.Ac" Pattern match: "http://www.w3.org/2001/XMLSchema-instance" Pattern match: "https://fs.microsoft.com/fs/windows/config.json" Pattern match: "https://fs.microsoft.com/fs/windows/config.json,config,0" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitReport" Pattern match: "go.microsoft.com/fwlink/?LinkID=851034&clcid=0x409&" Heuristic match: "K!O.MZ" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74408&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%d" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=851034&clcid=0x409&" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Heuristic match: "E;.BA" Pattern match: "http://www.microsoft.com/windows" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0" Pattern match: "www.microsoft.com/PKI/docs/CPS/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0" Heuristic match: "icrosoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: ":\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "Microsoft-Windows-Client-Features-WOW64-Package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0" Pattern match: "www.digicert.com1+0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/ThawtePCA-G3.crl0" Pattern match: "http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q" Pattern match: "http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v" Pattern match: "crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0L" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "www.microsoft.com/pkiops/Docs/Repository.htm" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0" Pattern match: "http://schemas.microsoft.com/SMI/2016/WindowsSettings" Pattern match: "Microsoft.Net/assembly/GAC_MSIL/System.Management.Automation/v4.0_3.0.0.0__31bf3856ad364e35/System.Management.Automation.dll" Pattern match: "http://schemas.microsoft.com/powershell/Microsoft.PowerShell" Heuristic match: "Set-Location $MyInvocation.MyCommand.Name" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=225750" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=225747" Heuristic match: "Get-Content $file | more.com" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=113316" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=160712" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/XMLSchema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Pattern match: "Microsoft.Net/assembly/GAC_MSIL/Microsoft.PowerShell.ConsoleHost/v4.0_3.0.0.0__31bf3856ad364e35/Microsoft.PowerShell.ConsoleHost.dll" Heuristic match: "ntrust.net" Heuristic match: "9.15.cat" Heuristic match: "icrosoft.PowerShell.Co" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0F" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0K" Pattern match: "http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=" Pattern match: "https://www.digicert.com/CPS0" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=" Pattern match: "crl.usertrust.com/AddTrustExternalCARoot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/CPS" Pattern match: "https://www.verisign.com/CPS04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/CPS_2048" Pattern match: "http://www.certplus.com/CRL/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/STCA.crl0" Pattern match: "0www.entrust.net/CPS" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.comodoca.com/AAACertificateServices.crl06" Pattern match: "crl.comodo.net/AAACertificateServices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "http://www.microsoft.com0" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com/pki/certs/Mi" Pattern match: "http://www.microsofT"45:T6c18,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001812.00000000.109493.02F70000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json04/17" - Source: "00000000-00001812.00000000.109493.07950000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,004/17" - Source: "00000000-00001812.00000000.109493.07950000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00001812.00000000.109493.082F0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00001812.00000000.109493.6F281000.00000020.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00001812.00000000.109493.6F321000.00000020.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00006136.00000000.109908.00A30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006136.00000000.109908.00A30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006136.00000000.109908.00A30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f9iqmgvw,czcnew" - Source: "00000000-00006136.00000000.109908.00BD0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006136.00000000.109908.00BD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0ta[17iusai:" - Source: "00000000-00006136.00000000.109908.00BD0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006136.00000000.109908.070D0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006136.00000000.109908.070D0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006136.00000000.109908.070D0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006136.00000000.109908.070D0000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsa+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00006136.00000000.109908.070D0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00006136.00000000.109908.070D0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows$ozp0ozpxzp,xzplfzplfzp?zp$?zp$?zp8?zp8?zpazp,azp,azp@azp@azpczp$czp$czpxczpxczpczp$fzp$fzp8fzp8fzp8zp" - Source: "00000000-00006136.00000000.109908.070D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/miut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006136.00000000.109908.070D0000.00000004.mdmp") Found URL "http://crl.microsofi/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wwashington1redmond1microsoft" - Source: "00000000-00006136.00000000.109908.070D0000.00000004.mdmp") Found URL "http://www.microsoftndows0qst*&pj>e" - Source: "00000000-00006136.00000000.109908.070D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006136.00000000.109908.070D0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00006136.00000000.109908.6F4B1000.00000020.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryfile:http:\\?\globalroot" - Source: "00000000-00006912.00000000.109935.04C20000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00006912.00000000.109935.04C20000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00006912.00000000.109935.04C20000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00006912.00000001.111854.02EF6000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00006912.00000001.111854.02EF6000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006912.00000001.111854.08550000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006912.00000001.111854.08550000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006912.00000001.111854.08550000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006912.00000001.111854.08550000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006912.00000001.111854.08550000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006912.00000001.111854.08550000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006912.00000001.111854.08550000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006912.00000001.111854.08550000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00006912.00000001.111854.08550000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e2.5.4.3pkcsu" - Source: "00000000-00006912.00000001.111854.08550000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006912.00000001.111854.08550000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006912.00000001.111854.08550000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;digicert" - Source: "00000000-00006912.00000001.111854.08550000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006912.00000001.111854.08550000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006912.00000001.111854.08550000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006912.00000001.111854.08550000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006912.00000001.111854.08550000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006912.00000001.111854.08550000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006912.00000001.111854.08550000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006912.00000001.111854.08550000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006912.00000001.111854.08550000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00006912.00000001.111854.08550000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006912.00000001.111854.08550000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00006912.00000001.111854.08550000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006912.00000001.111854.08550000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006912.00000001.111854.08550000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006912.00000001.111854.08550000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006912.00000001.111854.08550000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006912.00000001.111854.08550000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006912.00000001.111854.08550000.00000004.mdmp") Found URL "http://crl.microsoft" - Source: "00000000-00006912.00000001.111854.08550000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00006912.00000002.113776.02EF6000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00006912.00000002.113776.02EF6000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006912.00000002.113776.08550000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006912.00000002.113776.08550000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006912.00000002.113776.08550000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006912.00000002.113776.08550000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006912.00000002.113776.08550000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006912.00000002.113776.08550000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006912.00000002.113776.08550000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006912.00000002.113776.08550000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00006912.00000002.113776.08550000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e2.5.4.3pkcsu" - Source: "00000000-00006912.00000002.113776.08550000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006912.00000002.113776.08550000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006912.00000002.113776.08550000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;digicert" - Source: "00000000-00006912.00000002.113776.08550000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006912.00000002.113776.08550000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006912.00000002.113776.08550000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006912.00000002.113776.08550000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006912.00000002.113776.08550000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006912.00000002.113776.08550000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006912.00000002.113776.08550000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006912.00000002.113776.08550000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006912.00000002.113776.08550000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00006912.00000002.113776.08550000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006912.00000002.113776.08550000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00006912.00000002.113776.08550000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006912.00000002.113776.08550000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006912.00000002.113776.08550000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006912.00000002.113776.08550000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006912.00000002.113776.08550000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006912.00000002.113776.08550000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006912.00000002.113776.08550000.00000004.mdmp") Found URL "http://crl.microsoft" - Source: "00000000-00006912.00000002.113776.08550000.00000004.mdmp")46:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp")47:T984,"66e4e.Spy.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00001812) "66e4e.Spy.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001812) "66e4e.Spy.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00001812) "66e4e.Spy.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00001812) "66e4e.Spy.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00001812) "66e4e.Spy.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00001812) "66e4e.Spy.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00001812) "66e4e.Spy.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00001812)48:Tdc4,Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00001812.00000000.109493.02F70000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00001812.00000000.109493.02F70000.00000004.mdmp") Found string "GZipStream" (Indicator: "GzipStream"; Source: "00000000-00001812.00000000.109493.07990000.00000004.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00001812.00000000.109493.09610000.00000004.mdmp, 00000000-00001812.00000000.109493.09680000.00000004.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00001812.00000000.109493.09610000.00000004.mdmp, 00000000-00001812.00000000.109493.09680000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00006136.00000000.109908.00AF0000.00000004.mdmp, 00000000-00006136.00000000.109908.00BD0000.00000004.mdmp, 00000000-00006136.00000000.109908.070D0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00006136.00000000.109908.00BD0000.00000004.mdmp") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00006136.00000000.109908.00CA1000.00000020.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006136.00000000.109908.00CA1000.00000020.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006136.00000000.109908.00CA1000.00000020.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006136.00000000.109908.00CA1000.00000020.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006136.00000000.109908.00CA1000.00000020.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006136.00000000.109908.00CA1000.00000020.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006136.00000000.109908.00CA1000.00000020.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006136.00000000.109908.00CA1000.00000020.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006136.00000000.109908.00CA1000.00000020.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00006136.00000000.109908.04A50000.00000004.mdmp") Found string "[-WindowStyle