26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 6fe1240f60f2… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6fe1240f60f2…. Malware family: Trojan.Generic. Threat score 100/100. 19/27 AV engines flagged this file. 9 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba"],"about":{"@type":"SoftwareApplication","name":"bounty-57581219411976028","applicationCategory":["peexe","assembly","executable"],"identifier":"6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":19,"total":27},"behavioralIndicators":{"malicious":9,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T53e,Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp")28:T511,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp")29:T1a3b,Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00004336.00000000.170830.02E31000.00000004.mdmp, 00000000-00004336.00000000.170830.074C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng" (Indicator: "SHA512"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.HMAC" (Indicator: "HMAC"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp")2a:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}2b:T1413,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004336-41163-49-0007EE60 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004336-41163-92-0007E950 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004336-41163-92-0007E950 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004336-41163-126-0007D490 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004336-41163-126-0007D490 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004336-41163-129-0007985C Assembly shows XOR instruction xor esi dword ptr [00080394h] in Stream UID: 00000000-00004336-41163-129-0007985C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004336-41163-129-0007985C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004336-41163-133-0007995D Assembly shows XOR instruction xor esi dword ptr [00080390h] in Stream UID: 00000000-00004336-41163-133-0007995D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004336-41163-133-0007995D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004336-41163-135-0007DAD1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004336-41163-135-0007DAD1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004336-41163-137-0007DA34 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004336-41163-137-0007DA34 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004336-41163-141-0007D610 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004336-41163-141-0007D610 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004336-41163-149-0007D560 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004336-41163-149-0007D560 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004336-41163-151-0007D501 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004336-41163-151-0007D501 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004336-41163-158-0007A510 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004336-41163-161-0007A4E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004336-41163-162-0007A4B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004336-41163-182-00078190 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004336-41163-182-00078190 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00004336-41163-194-0007C4B6 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00004336-41163-194-0007C4B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004336-41163-195-00078AF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004336-41163-195-00078AF0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004336-41163-198-00078E30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004336-41163-198-00078E30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004336-41163-199-00077C30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004336-41163-199-00077C30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004336-41163-202-000785B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004336-41163-202-000785B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004336-41163-203-000789F0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004336-41163-203-000789F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004336-41163-204-00079030 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004336-41163-204-00079030 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004336-41163-211-0007D341 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004336-41163-211-0007D341 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004336-41163-214-0007C439 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004336-41163-214-0007C439 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004336-41163-215-000792C0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004336-41163-215-000792C0 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00004336-41163-217-00079F43 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00004336-41163-217-00079F43 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00004336-41163-217-00079F43 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00004336-41163-217-00079F43 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00004336-41163-217-00079F43 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00004336-41163-217-00079F432c:T53f,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Found XOR operators (encryption/decryption) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to encrypt data Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to decode base64 data Matched sigs: Calls an API typically used to decrypt data Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to decrypt/decode data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match - RC4 Encryption2d:T1256,Found XOR loop in file "ctsdvwT.exe" at offset 37240; code bytes = 30d0 Found XOR loop in file "ctsdvwT.exe" at offset 136540; code bytes = 30d0 Found XOR loop in file "ctsdvwT.exe" at offset 401324; code bytes = 30d0 Found XOR loop in file "ctsdvwT.exe" at offset 504008; code bytes = 30d0 Found XOR loop in file "ctsdvwT.exe" at offset 516371; code bytes = 30d0 Found XOR loop in file "ctsdvwT.exe" at offset 525078; code bytes = 30d0 Found XOR loop in file "ctsdvwT.exe" at offset 573317; code bytes = 30d0 Found XOR loop in file "ctsdvwT.exe" at offset 596650; code bytes = 30d0 Found XOR loop in file "ctsdvwT.exe" at offset 636481; code bytes = 30d0 Found XOR loop in file "ctsdvwT.exe" at offset 642729; code bytes = 30d0 Found XOR loop in file "ctsdvwT.exe" at offset 695597; code bytes = 30d0 Found XOR loop in file "ctsdvwT.exe" at offset 107930; code bytes = 33c1 Found XOR loop in file "ctsdvwT.exe" at offset 126098; code bytes = 33c1 Found XOR loop in file "ctsdvwT.exe" at offset 152305; code bytes = 33c1 Found XOR loop in file "ctsdvwT.exe" at offset 239513; code bytes = 33c1 Found XOR loop in file "ctsdvwT.exe" at offset 288722; code bytes = 33c1 Found XOR loop in file "ctsdvwT.exe" at offset 382753; code bytes = 33c1 Found XOR loop in file "ctsdvwT.exe" at offset 413530; code bytes = 33c1 Found XOR loop in file "ctsdvwT.exe" at offset 576844; code bytes = 33c1 Found XOR loop in file "ctsdvwT.exe" at offset 662514; code bytes = 33c1 Found XOR loop in file "ctsdvwT.exe" at offset 58039; code bytes = 8030 Found XOR loop in file "ctsdvwT.exe" at offset 58381; code bytes = 8030 Found XOR loop in file "ctsdvwT.exe" at offset 64751; code bytes = 8030 Found XOR loop in file "ctsdvwT.exe" at offset 195751; code bytes = 8030 Found XOR loop in file "ctsdvwT.exe" at offset 219553; code bytes = 8030 Found XOR loop in file "ctsdvwT.exe" at offset 256488; code bytes = 8030 Found XOR loop in file "ctsdvwT.exe" at offset 303871; code bytes = 8030 Found XOR loop in file "ctsdvwT.exe" at offset 356755; code bytes = 8030 Found XOR loop in file "ctsdvwT.exe" at offset 372379; code bytes = 8030 Found XOR loop in file "ctsdvwT.exe" at offset 378977; code bytes = 8030 Found XOR loop in file "ctsdvwT.exe" at offset 544537; code bytes = 8030 Found XOR loop in file "ctsdvwT.exe" at offset 568824; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 37240; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 136540; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 401324; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 504008; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 516371; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 525078; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 573317; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 596650; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 636481; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 642729; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 695597; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 107930; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 126098; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 152305; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 239513; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 288722; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 382753; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 413530; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 576844; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 662514; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 58039; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 58381; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 64751; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 195751; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 219553; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 256488; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 303871; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 356755; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 372379; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 378977; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 544537; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 568824; code bytes = 80302e:T51c,Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00005356-00000C2B-1656345136") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00005356-00000C2B-1656345163") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00004336-00000C2B-1660548264") Found reference to API "EnumWindowsW" (Indicator: "enumwindows"; Source: "00000000-00004336-00000C2B-1660548303") Found reference to API "SendMessage" (Indicator: "sendmessage"; Source: "00000000-00005556-00000C2B-1662587263") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00005556-00000C2B-1662587296") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00005356.00000000.170386.02D30000.00000004.mdmp") Found reference to API "sendMessageChannelCache" (Indicator: "sendmessage"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found reference to API "System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Indicator: "sendmessage"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp")2f:T284e,"6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000018000000e5aecb12239b39732002cf00687ddd74c8f1cf00c0c83973e1fc3f61feffffffe4f0cf00c278387388f0cf000000857680f1cf00db783873e0df987508000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000010f1cf000000000008000000000000000000000000000000000000000000000000000000fdaecb120000000050f1cf0069921876ffffffff3400000010f1cf0008000000000000000000857680f1cf002794187618f1cf000b0000000000000068f1cf00 (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000078d3cf001cd3cf00226ef77400005403000000002d6ef7746d4794712d000000ecb78a76a0d3cf00000097007044d8024887da020300000080000000e0d2cf000000970064d3cf0070c8f87489e5a605feffffff2d000000d0cc99762700000034d3cf00856af9741c23fe7474d3cf00f85ff97408000000bb69f874b269f874054794712d000000ecb78a7627000000d0cc997648d3cf002d000000d0cc99762700000078d3cf00856af9741c23fe74c0d3cf007e8a9876ee8c9876738a98768635b9f82d000000ecb78a7627000000d0cc99767c295403102954038635b9f888d3cf00fc52d67674d4cf00e08498767e17a28efeffffff738a9876 (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000976f187d976f00000000d0a93f750000387590113975689ed50248a5d4022854d80238e9cf00feffffffe0ebcf00506acd77ecaf2beafefffffff8e9cf00eaa9c977689ed502000000002854d802a11400000a000b00b297976f5c76976f6876976f2854d802180adb02140000000000000000000000689ed50220eacf00cc2dce772854d802000000003454d80200000000f800906f00000000cc0d24385ce8cc776840cb77cc03000019000000110000001000000040bfd30258eacf008d9a5f7490bdd302ac4fdb020000000078eacf002c05d302ac4fdb0290eacf000000906ffeffffff0400000020af5f7400000000000000000000906f80eacf00 (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000001c00000000005403f8d8cf000000000000000000a301ca77dc83319da84d0408d00754072800000000000000690000000000540700000000ed0b000200000000f70300f4f02f0408388154031a000000000000002000000000005407cc01540704085407000000000008540700000000f0d8cf005916ca771c0000000000000004075f6f00005403000000002800000000000000000000000500000002000000000054031c00000000000000005c540310d9cf00ee13ca771c000000ee13ca7700000000000000001c000000ffffffff30d9cf005072f77400005403000000001c00000004075f6f (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000c977f8160608f816060800000000d85e060840c10508b80c06082e00000050c105081100280050f5c977503f0508503f050800000000654d9471b0bd0408a82f05082d000000c0bd04080900220050f5c977782d0608782d060800000000f816060890c10508c82c060804000000a0c1050801000400700a5407640000002d4d9471503f0508503f050800000000feffffff8470f77488d9cf006570f77400005403000000008470f774f94d9471782d0608782d060800000000e32e5b6f503f0508b5ce576fe30a452c50d9cf00176f586fe4d9cf0070c8f87451e6a605feffffff8470f7740a8e5a6f782d0608f08d5a6fb0d9cf00a7ce576f01000000 (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000c977401a0608401a0608000000000000000040c10508b80c06083d00000050f5c977e03b0508e03b0508000000008470f774b0bd0408a82f050823000000c0bd040809002500e00c54076400000050f5c977782d0608782d060800000000401a060890c10508c82c060804000000a0c1050801000400700a540764000000e03b0508e03b050800000000feffffff8470f77484d9cf006570f77400005403000000008470f774f54d9471782d0608782d060800000000e32e5b6fe03b0508b5ce576fff0a452c4cd9cf00176f586fe4d9cf0070c8f87451e6a605feffffff8470f7740a8e5a6f782d0608f08d5a6facd9cf00a7ce576f01000000504b586f (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000d50250058173000000002a004374fc863c742a004374fb8cca770000000000000000fc863c7430d9cf000000000000000000000000002a00437409000000d8b7d50209000000fc863c740000000050058173180000000586cb12239b397340eace0000000000b0dbcf00c0c83973e1fc3f61fefffffff0d8cf00fa963873a0d8cf000000000000000000139738731cd9cf000000000000000000000000000000000000000000000000000100000000000000010000000000000018d9cf000000000028d9cf00000000001cd9cf000000000000000000000000004b008b751d86cb1230d9cf0084da16769082319d34d9cf00dab916760000787328d9cf00 (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000078c50c0c38cfca77dc38d302e4c50c0c010000009038d302dc38d3029038d302040000000400000000e0227600100000e4c50c0c010000009038d302cd97ca779c97ca776892f291b50f19769038d3020000ca7700000000141d166a0000000080ee1f760100000000000000f8e22276000000000400000080a95f7448402176f8e22276e8c50c0c80e8bc7588add50280e8bc75e4c50c0c0000000080e8bc7500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000668cdf027c8cdf02 (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000002e47da024647da02 (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000764bdb028a4bdb02 (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000006e3eda02863eda02 (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000860be0029c0be002 (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001646da022e46da02 (UID: 00000000-00005356)30:T13d2,"6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000028f5cf00f8b0d402a8b1d402bc7cd302a07bd77700000000d80cd30201000000000000000050a1720010000001000000000000003452a17202000000a0679f723052a17200b00a0000000000ffffffff00000000750063007200740062006100730065005f0063006c00720030003400300030002e0064006c006c00 (UID: 00000000-00005356) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000007000000073005c006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d00610063000400000445b7000010aed502a052d50266006900670000004838d502 (UID: 00000000-00004336) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000009038000000000000000a11400003cd09e09ee13ca7780000000ee13ca77000000000000000080000000f062ff6e000000005cd09e095072f774000009030000000080000000f062ff6e02000000002fff6e78d09e09fb62ff6e010000008004006f885ff97400000000fdc9632fa8d09e09b864ff6ef42eff6e (UID: 00000000-00004336) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000281210050000240304d233731800000000000000000000000300000002000000000024030c0000000000000020000000e4f58b08ee13ca7728121005ee13ca7700000000000000000c00000078282d0300282d03fcf58b0828239d7200002403000000000c00000060821a0508f68b082f998c6f0c000000 (UID: 00000000-00005556) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000002403687b2d031800000000000000000000000300000002000000000024030c0000000000000078a9bd772cebfc00ee13ca7728121005ee13ca7700000000000000000c0000006f01826f2812100544ebfc0028239d7200002403000000000c000000b0147f6f50ebfc002f998c6f0c000000 (UID: 00000000-00005556) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000016ca770c000000000000000000000000002403982b2d031800000000000000000000000300000002000000000024030c00000000000000d724327398ebfc00ee13ca7700000000ee13ca7700000000000000000c00000070edfc00b0ebfc0028239d7200002403000000000c00000030a58c6fbcebfc002f998c6f0c000000 (UID: 00000000-00005556) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000281210050000240304d233731800000000000000000000000300000002000000000024030c0000000000000020000000a4f0b708ee13ca7728121005ee13ca7700000000000000000c000000181f2d03001f2d03bcf0b70828239d7200002403000000000c00000020e21a05c8f0b7082f998c6f0c000000 (UID: 00000000-00005556) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000240338792d031800000000000000000000000300000002000000000024030c0000000000000078a9bd772cebfc00ee13ca7728121005ee13ca7700000000000000000c0000006f01826f2812100544ebfc0028239d7200002403000000000c000000b0147f6f50ebfc002f998c6f0c000000 (UID: 00000000-00005556) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000016ca770c000000000000000000000000002403981c2d031800000000000000000000000300000002000000000024030c00000000000000d724327370ebfc00ee13ca7700000000ee13ca7700000000000000000c00000070edfc0088ebfc0028239d7200002403000000000c00000030a58c6f94ebfc002f998c6f0c000000 (UID: 00000000-00005556) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000281210050000240304d233731800000000000000000000000300000002000000000024030c000000000000002000000014f0b708ee13ca7728121005ee13ca7700000000000000000c000000a8202d0300202d032cf0b70828239d7200002403000000000c00000020221b0538f0b7082f998c6f0c000000 (UID: 00000000-00005556) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000016ca770c0000000000000000000000000024038baabd771800000000000000000000000300000002000000000024030c00000000000000588e2f0308ebfc00ee13ca7728121005ee13ca7700000000000000000c0000006f01826f20ebfc0028239d7200002403000000000c000000b0147f6f2cebfc002f998c6f0c000000 (UID: 00000000-00005556) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000016ca770c00000000000000000000000000240340242d031800000000000000000000000300000002000000000024030c00000000000000d724327398ebfc00ee13ca7700000000ee13ca7700000000000000000c00000070edfc00b0ebfc0028239d7200002403000000000c00000030a58c6fbcebfc002f998c6f0c000000 (UID: 00000000-00005556)31:T619,Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API "[System.Diagnostics.FileVersionInfo]::GetVersionInfo($this.FullName)" (Indicator: "GetVersion"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004336.00000000.170830.6F785000.00000002.mdmp")32:T14b8,"6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" queries volume information of "C:\6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" at 00000000-00005356-00000C17-1651362608 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00005356-00000C17-1651505210 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00005356-00000C17-1652187589 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00000000-00005356-00000C17-1653146220 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00000000-00005356-00000C17-1653445000 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll" at 00000000-00004336-00000C17-1658842969 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00004336-00000C17-1659053801 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004336-00000C17-1660472328 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00004336-00000C17-1661017909 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll" at 00000000-00004336-00000C17-1661090284 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00004336-00000C17-1661109829 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00004336-00000C17-1661178318 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00004336-00000C17-1661190265 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00004336-00000C17-1661190502 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll" at 00000000-00004336-00000C17-1661619123 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00004336-00000C17-1661702052 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00004336-00000C17-1661717254 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00004336-00000C17-1661717521 "powershell.exe" queries volume information of "C:\" at 00000000-00004336-00000C17-1662837827 "powershell.exe" queries volume information of "C:\share" at 00000000-00004336-00000C17-1662839137 "powershell.exe" queries volume information of "C:\share" at 00000000-00004336-00000C17-1663022510 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004336-00000C17-1664546651 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004336-00000C17-1665165423 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004336-00000C17-1665309943 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004336-00000C17-166549857033:T6405,"6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005356) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e7f9e4af50c666b5fec85987c303915a\Microsoft.Management.Infrastr (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00004336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00004336) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005556) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005556) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005556) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005556) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll (UID: 00000000-00005556) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005556) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005556) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005556) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005556) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005556) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005556) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00005556) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter C:\vaultcli.dll (UID: 00000000-00005556) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter vaultcli.dll (UID: 00000000-00005556) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005556) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005556) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00005556) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005556) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005556) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005556) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005556)34:T7af,"INSERT INTO CRUD_ALUNOS ([NOME],[IDADE],[ENDERECO],[TELEFONE],[EMAIL],[CIDADE],[UF],[NOME_PAI],[NOME_MAE])VALUES (@NOME, @IDADE ,@ENDERECO ,@TELEFONE ,@EMAIL ,@CIDADE ,@UF ,@NOME_PAI ,@NOME_MAE);" (Source: 6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba, Indicator: "insert into crud_alunos ([nome],[idade],[endereco],[telefone],[email],[cidade],[uf],[nome_pai],[nome_mae])values (@nome, @idade ,@endereco ,@telefone ,@email ,@cidade ,@uf ,@nome_pai ,@nome_mae);"), "SELECT [NOME] AS Nome [IDADE] [ENDERECO] [TELEFONE] [EMAIL] FROM CRUD_ALUNOS WHERE ID_ALUNO LIKE @VALOR" (Source: 6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba, Indicator: "select [nome] as nome [idade] [endereco] [telefone] [email] from crud_alunos where id_aluno like @valor"), "UPDATE CRUD_ALUNOS SET NOME = @NOME IDADE = @IDADE ENDERECO = @ENDERECO TELEFONE = @TELEFONE EMAIL = @EMAIL CIDADE = @CIDADE UF = @UF NOME_PAI = @NOME_PAI NOME_MAE = @NOME_MAE WHERE ID_ALUNO = @ID_ALUNO" (Source: 6000015-AdministracaoDEBanco~Update, Indicator: "update crud_alunos set nome = @nome idade = @idade endereco = @endereco telefone = @telefone email = @email cidade = @cidade uf = @uf nome_pai = @nome_pai nome_mae = @nome_mae where id_aluno = @id_aluno"), "DELETE FROM CRUD_ALUNOS WHERE ID_ALUNO = @ID_ALUNO" (Source: 6000016-AdministracaoDEBanco~Delete, Indicator: "delete from crud_alunos where id_aluno = @id_aluno"), "SELECT [ID_ALUNO] AS Código [NOME] AS Nome [IDADE] [ENDERECO] [TELEFONE] [EMAIL] FROM CRUD_ALUNOS" (Source: 6000017-AdministracaoDEBanco~ListaGrid, Indicator: "select [id_aluno] as código [nome] as nome [idade] [endereco] [telefone] [email] from crud_alunos"), "SELECT [NOME] AS Nome [IDADE] [ENDERECO] [TELEFONE] [EMAIL] FROM CRUD_ALUNOS WHERE NOME LIKE @VALOR" (Source: 600002c-frm_crud~btnPesquisar_Click, Indicator: "select [nome] as nome [idade] [endereco] [telefone] [email] from crud_alunos where nome like @valor")35:T6314,Found reference to API (Indicator: "GetObject"; File: "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba") Found reference to API (Indicator: "MessageBox"; File: "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba") Found reference to API (Indicator: "InitializeConditionVariable"; File: "00000000-00004336.00000000.170830.00071000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; File: "00000000-00004336.00000000.170830.00071000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "00000000-00004336.00000000.170830.00071000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00004336.00000000.170830.00071000.00000020.mdmp, 00000000-00004336.00000000.170830.6F771000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00004336.00000000.170830.00071000.00000020.mdmp, 00000000-00004336.00000000.170830.6F771000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00004336.00000000.170830.00071000.00000020.mdmp, 00000000-00004336.00000000.170830.6F771000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00004336.00000000.170830.02D50000.00000004.mdmp, 00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00004336.00000000.170830.6F771000.00000020.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00004336.00000000.170830.6F771000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00004336.00000000.170830.6F771000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00004336.00000000.170830.6F771000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00004336.00000000.170830.6F771000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00004336.00000000.170830.6F771000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00004336.00000000.170830.6F771000.00000020.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00004336.00000000.170830.6F771000.00000020.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00005356.00000000.170386.00812000.00000002.mdmp, 00000000-00005356.00000000.170386.050C0000.00000004.mdmp, 00000000-00005356.00000000.170386.07880000.00000004.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00005356.00000000.170386.00812000.00000002.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp, 00000000-00005356.00000000.170386.07880000.00000004.mdmp, 00000000-00005356.00000000.170386.6F5F1000.00000002.mdmp, 00000000-00005356.00000000.170386.6F615000.00000002.mdmp") Found reference to API (Indicator: "MoveFileEx"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp, 00000000-00005356.00000000.170386.07880000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp, 00000000-00005356.00000000.170386.07880000.00000004.mdmp, 00000000-00005356.00000000.170386.6F5F1000.00000002.mdmp, 00000000-00005356.00000000.170386.6F615000.00000002.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp, 00000000-00005356.00000000.170386.07880000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp, 00000000-00005356.00000000.170386.07880000.00000004.mdmp")36:Td24,Found reference to API "FindResourceExW" (Indicator: "FindResource"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004336.00000000.170830.00081000.00000002.mdmp, 00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00004336.00000000.170830.6F785000.00000002.mdmp") Found reference to API "11651105383,7000,3140,,LoadResource,kernel32.dll,"00:44:22.171",RX=0,PX=0" (Indicator: "LoadResource"; Source: "00000000-00005356.00000000.170386.02D30000.00000004.mdmp") Found reference to API "11650435867,7000,3140,,LoadResource,kernel32.dll,"00:44:22.171",RX=0,PX=0" (Indicator: "LoadResource"; Source: "00000000-00005356.00000000.170386.02D30000.00000004.mdmp") Found reference to API "11653824353,7000,3140,,LoadResource,kernel32.dll,"00:44:22.171",RX=0,PX=0" (Indicator: "LoadResource"; Source: "00000000-00005356.00000000.170386.02D30000.00000004.mdmp") Found reference to API "11652440697,7000,3140,,LoadResource,kernel32.dll,"00:44:22.171",RX=0,PX=0" (Indicator: "LoadResource"; Source: "00000000-00005356.00000000.170386.02D30000.00000004.mdmp") Found reference to API "11651799381,7000,3140,,LoadResource,kernel32.dll,"00:44:22.171",RX=0,PX=0" (Indicator: "LoadResource"; Source: "00000000-00005356.00000000.170386.02D30000.00000004.mdmp") Found reference to API "11639389075,7000,3140,,LoadResource,kernel32.dll,"00:44:22.171",RX=0,PX=0" (Indicator: "LoadResource"; Source: "00000000-00005356.00000000.170386.02D30000.00000004.mdmp") Found reference to API "11649462197,7000,3139,,FindResourceW,kernel32.dll,"00:44:22.171",RX=0,PX=0" (Indicator: "FindResource"; Source: "00000000-00005356.00000000.170386.02D30000.00000004.mdmp") Found reference to API "11636402505,7000,3140,,LoadResource,kernel32.dll,"00:44:22.171",RX=0,PX=0" (Indicator: "LoadResource"; Source: "00000000-00005356.00000000.170386.02D30000.00000004.mdmp") Found reference to API "11647838953,7000,3140,,LoadResource,kernel32.dll,"00:44:22.171",RX=0,PX=0" (Indicator: "LoadResource"; Source: "00000000-00005356.00000000.170386.02D30000.00000004.mdmp") Found reference to API "11646831021,7000,3139,,FindResourceW,kernel32.dll,"00:44:22.171",RX=0,PX=0" (Indicator: "FindResource"; Source: "00000000-00005356.00000000.170386.02D30000.00000004.mdmp") Found reference to API "11650137599,7000,3139,,FindResourceW,kernel32.dll,"00:44:22.171",RX=0,PX=0" (Indicator: "FindResource"; Source: "00000000-00005356.00000000.170386.02D30000.00000004.mdmp") Found reference to API "11650732615,7000,3139,,FindResourceW,kernel32.dll,"00:44:22.171",RX=0,PX=0" (Indicator: "FindResource"; Source: "00000000-00005356.00000000.170386.02D30000.00000004.mdmp")37:T1893,"Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 41163-149-0007D560 "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 41163-182-00078190 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 41163-182-00078190 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 41163-182-00078190 "SOFTWARE\Microsoft\PowerShell\3" in Source: 41163-184-0007BFA2 "SOFTWARE\Microsoft\PowerShell" in Source: 41163-195-00078AF0 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004336.00000000.170830.00071000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004336.00000000.170830.00071000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004336.00000000.170830.00071000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004336.00000000.170830.00071000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004336.00000000.170830.00071000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004336.00000000.170830.00071000.00000020.mdmp ":\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A07" in Source: 00000000-00004336.00000000.170830.02D50000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004336.00000000.170830.02D50000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004336.00000000.170830.02D50000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004336.00000000.170830.04DB0000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004336.00000000.170830.04DB0000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00004336.00000000.170830.04DB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004336.00000000.170830.04DB0000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00004336.00000000.170830.04DB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00004336.00000000.170830.04DB0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00004336.00000000.170830.04DB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00004336.00000000.170830.04DB0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00004336.00000000.170830.04DB0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004336.00000000.170830.04DB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004336.00000000.170830.04DB0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004336.00000000.170830.04DB0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004336.00000000.170830.04DB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004336.00000000.170830.04DB0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004336.00000000.170830.04DB0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004336.00000000.170830.04DB0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004336.00000000.170830.04DB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004336.00000000.170830.04DB0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004336.00000000.170830.04DB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004336.00000000.170830.04DB0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004336.00000000.170830.04DB0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004336.00000000.170830.04DB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004336.00000000.170830.04DB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004336.00000000.170830.04DB0000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00004336.00000000.170830.04DB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00004336.00000000.170830.04DB0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005356.00000000.170386.02D30000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005356.00000000.170386.02D30000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005356.00000000.170386.050C0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005356.00000000.170386.050C0000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00005356.00000000.170386.050C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00005356.00000000.170386.050C0000.00000004.mdmp38:T1e37,"6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:ffffffffc0000135] "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:ffffffffc0000135] "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:ffffffffc0000135] "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:ffffffffc0000135] "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:ffffffffc0000135] "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:ffffffffc0000135] "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:ffffffffc0000135] "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:ffffffffc0000135] "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:ffffffffc0000135] "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:ffffffffc0000135] "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" failed to load missing module "C:\vaultcli.dll" - [base:0; Status:ffffffffc0000135]39:T5c56,"6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "KERNEL32" at base 766c0000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76080000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76080000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76080000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 75a80000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76080000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76080000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76080000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "ADVAPI32.DLL" at base 76620000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 731f0000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "SHLWAPI.DLL" at base 76260000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 75370000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "VERSION.DLL" at base 743a0000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72a40000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "USER32.DLL" at base 75380000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 76080000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "MSCOREE.DLL" at base 733d0000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 74ad0000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "PSAPI.DLL" at base 762b0000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "RPCRT4.DLL" at base 76790000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "KERNEL32.DLL" at base 766c0000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 71560000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "OLE32.DLL" at base 75500000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74130000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 74ad0000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 76080000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 714d0000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 70a70000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "UXTHEME.DLL" at base 74130000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 70250000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 70140000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6f9c0000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "NTDLL.DLL" at base 77c60000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "SHELL32.DLL" at base 76880000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "BCRYPT.DLL" at base 73530000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 6f990000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "IMM32.DLL" at base 75a80000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "COMCTL32.DLL" at base 6f900000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "GDI32.DLL" at base 76850000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "GDIPLUS.DLL" at base 743c0000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 743c0000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76080000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "WLDP.DLL" at base 6f660000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "AMSI.DLL" at base 6f650000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 743a0000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 6f600000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6f560000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 766c0000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "USERENV.DLL" at base 6f620000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76620000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74ff0000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "WINDOWSCODECS.DLL" at base 73780000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "NTDLL" at base 77c60000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 6f210000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 75ab0000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73bd0000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 6f0e0000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 76880000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 766c0000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73f70000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "MSISO.DLL" at base 6f080000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "SSPICLI.DLL" at base 74680000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 76080000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76080000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76080000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76080000 "powershell.exe" loaded module "KERNEL32" at base 766c0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 76620000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 731f0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 76260000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 75370000 "powershell.exe" loaded module "VERSION.DLL" at base 743a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72a40000 "powershell.exe" loaded module "USER32.DLL" at base 75380000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 76080000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 733d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 74ad0000 "powershell.exe" loaded module "PSAPI.DLL" at base 762b0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 76790000 "powershell.exe" loaded module "KERNEL32.DLL" at base 766c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 71560000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 75500000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 74ad0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 77bc0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 6f990000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74ff0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 76080000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 714d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 70a70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 70250000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 74ad0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 74ad0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 77c60000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 76880000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 76480000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 76480000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 75070000 "powershell.exe" loaded module "CRYPT32.DLL" at base 75070000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6f9c0000 "powershell.exe" loaded module "AMSI.DLL" at base 6f7c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 743a0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 6f770000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E7F9E4AF50C666B5FEC85987C303915A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 6f6f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6f390000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 74ad0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6f340000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 70140000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 6f220000 "powershell.exe" loaded module "SSPICLI.DLL" at base 74680000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WLDP.DLL" at base 0 "powershell.exe" loaded module "WLDP.DLL" at base 6f130000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74130000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6f090000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 766c0000 "powershell.exe" loaded module "USERENV.DLL" at base 6f790000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76620000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 6f080000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 6eff0000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 766c0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 6efc0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 6ee60000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 6ee30000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 6ee30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\URLMON.DLL" at base 0 "powershell.exe" loaded module "URLMON.DLL" at base 73f70000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 76080000 "powershell.exe" loaded module "MSISO.DLL" at base 6edc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 6ed10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 73530000 "powershell.exe" loaded module "OLEAUT32" at base 77bc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 76080000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MSVCRT.DLL" at base 0 "powershell.exe" loaded module "MSVCRT.DLL" at base 74f30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 0 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 6ea30000 "powershell.exe" loaded module "MI.DLL" at base 6ea10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MI.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 76080000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WMIDCOM.DLL" at base 6e980000 "powershell.exe" loaded module "GDI32.DLL" at base 76850000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76080000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6f8f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6f8b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6f7f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 76080000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 76080000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 766c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 76080000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6f8f0000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 6f8c0000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6f8b0000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6f7f0000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 76080000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 76080000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "OLEAUT32.DLL" at base 77bc0000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "OLEAUT32" at base 77bc0000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "C:\VAULTCLI.DLL" at base 0 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "VAULTCLI.DLL" at base 6f300000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "USER32" at base 75380000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "COMCTL32.DLL" at base 6f150000 "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" loaded module "C:\6FE1240F60F2C861C5CEBBF1BCEB98553850BE3AC19624EA676A13480B2DD8BA.EXE" at base 4000003a:T7af,"INSERT INTO CRUD_ALUNOS ([NOME],[IDADE],[ENDERECO],[TELEFONE],[EMAIL],[CIDADE],[UF],[NOME_PAI],[NOME_MAE])VALUES (@NOME, @IDADE ,@ENDERECO ,@TELEFONE ,@EMAIL ,@CIDADE ,@UF ,@NOME_PAI ,@NOME_MAE);" (Source: 6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba, Indicator: "insert into crud_alunos ([nome],[idade],[endereco],[telefone],[email],[cidade],[uf],[nome_pai],[nome_mae])values (@nome, @idade ,@endereco ,@telefone ,@email ,@cidade ,@uf ,@nome_pai ,@nome_mae);"), "SELECT [NOME] AS Nome [IDADE] [ENDERECO] [TELEFONE] [EMAIL] FROM CRUD_ALUNOS WHERE ID_ALUNO LIKE @VALOR" (Source: 6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba, Indicator: "select [nome] as nome [idade] [endereco] [telefone] [email] from crud_alunos where id_aluno like @valor"), "UPDATE CRUD_ALUNOS SET NOME = @NOME IDADE = @IDADE ENDERECO = @ENDERECO TELEFONE = @TELEFONE EMAIL = @EMAIL CIDADE = @CIDADE UF = @UF NOME_PAI = @NOME_PAI NOME_MAE = @NOME_MAE WHERE ID_ALUNO = @ID_ALUNO" (Source: 6000015-AdministracaoDEBanco~Update, Indicator: "update crud_alunos set nome = @nome idade = @idade endereco = @endereco telefone = @telefone email = @email cidade = @cidade uf = @uf nome_pai = @nome_pai nome_mae = @nome_mae where id_aluno = @id_aluno"), "DELETE FROM CRUD_ALUNOS WHERE ID_ALUNO = @ID_ALUNO" (Source: 6000016-AdministracaoDEBanco~Delete, Indicator: "delete from crud_alunos where id_aluno = @id_aluno"), "SELECT [ID_ALUNO] AS Código [NOME] AS Nome [IDADE] [ENDERECO] [TELEFONE] [EMAIL] FROM CRUD_ALUNOS" (Source: 6000017-AdministracaoDEBanco~ListaGrid, Indicator: "select [id_aluno] as código [nome] as nome [idade] [endereco] [telefone] [email] from crud_alunos"), "SELECT [NOME] AS Nome [IDADE] [ENDERECO] [TELEFONE] [EMAIL] FROM CRUD_ALUNOS WHERE NOME LIKE @VALOR" (Source: 600002c-frm_crud~btnPesquisar_Click, Indicator: "select [nome] as nome [idade] [endereco] [telefone] [email] from crud_alunos where nome like @valor")3b:T101d,Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "split-path $_.Path" (Indicator: "Split-Path"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Variable to hold all default pairse used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string ",(new-object Microsoft.Powershell.Commands.EnhancedKeyUsageProperty -argumentlist $this).EnhancedKeyUsageList;" (Indicator: "New-Object"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string ",(new-object Microsoft.Powershell.Commands.DnsNameProperty -argumentlist $this).DnsNameList;" (Indicator: "New-Object"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "New-Object System.Version -ArgumentList @(" (Indicator: "New-Object"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "new-object datetime @([int]$matches[1], [int]$matches[2], [int]$matches[3])" (Indicator: "New-Object"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "$argumentsBuilder = new-object System.Text.StringBuilder" (Indicator: "New-Object"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "$private:sd = new-object System.Security.AccessControl.CommonSecurityDescriptor $false,$false,$this.SecurityDescriptorSddl" (Indicator: "New-Object"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "split-path $_.Path -leaf" (Indicator: "Split-Path"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp")3c:T1f03,"6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" touched "This Device" (Path: "HKCU\WOW6432NODE\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\WOW6432NODE\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" touched "Other Users Folder" (Path: "HKCU\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" touched "Games Explorer" (Path: "HKCU\WOW6432NODE\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" touched "StreamBackedFolder" (Path: "HKCU\WOW6432NODE\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" touched "Computers and Devices" (Path: "HKCU\WOW6432NODE\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" touched "Removable Drives" (Path: "HKCU\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}") "powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}") "powershell.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\WOW6432NODE\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\WOW6432NODE\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS")3d:T947,"6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "ctsdvwT.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"3e:T9bb,"6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "KO-KR") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "KO-KR") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-CN") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HK") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HK") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "JA-JP") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "JA-JP") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH")3f:Tf5a,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00005356-00000C2D-1214511037] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00005356-00000C2A-1650954076] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00005356-00000C2A-1651041462] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005356-00000C2A-1651187429] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00005356-00000C2A-1651338619] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00005356-00000C2A-1651363782] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00005356-00000C2A-1651411080] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00005356-00000C2A-1651478913] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00005356-00000C2A-1651516386] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00005356-00000C2A-1651579616] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00005356-00000C2A-1652259925] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00005356-00000C2A-1652391419] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00005356-00000C2A-1652413713] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00005356-00000C2A-1652463148] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00005356-00000C2A-1652652016] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00005356-00000C2A-1654216468] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00005356-00000C2A-1654239036] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00005356-00000C2A-1654263326] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00005356-00000C2A-1654526933] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00005356-00000C2A-1654723394] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00005356-00000C2A-1654827805] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00005356-00000C2A-1656076721] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00005356-00000C2A-1656088990] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00005356-00000C2A-1657040313] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00004336-00000C2A-1658792358]40:T9c4,"6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1792" "BaseAddress": "00A781E8" "Buffer": "0C0CF010" "NumberOfBytesToWrite": "00000004" "$name": "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe"} "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1336" "BaseAddress": "0051B1E8" "Buffer": "00CFCF08" "NumberOfBytesToWrite": "00000004" "$name": "C:\\6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe"} "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1236" "BaseAddress": "011751E8" "Buffer": "00CFCF08" "NumberOfBytesToWrite": "00000004" "$name": "C:\\6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe"} "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1236" "BaseAddress": "00400000" "Buffer": "063AE040" "NumberOfBytesToWrite": "00000200" "$name": "C:\\6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe"} "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1236" "BaseAddress": "00402000" "Buffer": "063E8C60" "NumberOfBytesToWrite": "0003A200" "$name": "C:\\6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe"} "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1236" "BaseAddress": "0043E000" "Buffer": "0512DA50" "NumberOfBytesToWrite": "00000600" "$name": "C:\\6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe"} "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1236" "BaseAddress": "00440000" "Buffer": "0512E05C" "NumberOfBytesToWrite": "00000200" "$name": "C:\\6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe"} "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1236" "BaseAddress": "01175008" "Buffer": "0512E268" "NumberOfBytesToWrite": "00000004" "$name": "C:\\6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe"}41:T712,Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp")42:T7c2,"6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}\"; Key: ""; Value: "") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}\"; Key: ""; Value: "") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELLCOMPATIBILITY\APPLICATIONS\6FE1240F60F2C861C5CEBBF1BCEB98553850BE3AC19624EA676A13480B2DD8BA.EXE"; Key: ""; Value: "") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "")43:T1369,"6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "DATA"; Value: "") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "GENERATION"; Value: "") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "DATA"; Value: "") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "GENERATION"; Value: "") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESMYCOMPUTER"; Value: "") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESMYCOMPUTER"; Value: "") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESRECYCLEBIN"; Value: "") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESRECYCLEBIN"; Value: "") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCONTROLPANEL"; Value: "") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCONTROLPANEL"; Value: "") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOSETFOLDERS"; Value: "") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOSETFOLDERS"; Value: "") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOINTERNETICON"; Value: "") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOINTERNETICON"; Value: "") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "VALIDATEREGITEMS"; Value: "") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "MONITORREGISTRY"; Value: "") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCOMMONGROUPS"; Value: "") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCOMMONGROUPS"; Value: "") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APPX"; Key: "ALLOWDEVELOPMENTWITHOUTDEVLICENSE"; Value: "") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODELUNLOCK"; Key: "ALLOWDEVELOPMENTWITHOUTDEVLICENSE"; Value: "") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\APPCOMPAT"; Key: "RAISEDEFAULTAUTHNLEVEL"; Value: "") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "DEFAULTACCESSPERMISSION"; Value: "") "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "ANONYMOUSAPPCONTAINERIMPERSONATIONLEVELCHECK"; Value: "")44:T47f,"6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.configuration\96f7edb07b12303f0ec2595c7f3778c7\system.configuration.ni.dll.aux" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.xml\15af16d373cf0528cb74fc73d365fdbf\system.xml.ni.dll.aux"45:T49c,"6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to touch file "C:\Windows\SysWOW64\mscoree.dll" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to touch file "C:\6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll"46:Tdf4,"6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\FLTLIB.DLL" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\OLE32.DLL" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.DLL" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.dll"47:Tc64,"6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\6FE1240F60F2C861C5CEBBF1BCEB98553850BE3AC19624EA676A13480B2DD8BA.EXE.CONFIG" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\6FE1240F60F2C861C5CEBBF1BCEB98553850BE3AC19624EA676A13480B2DD8BA.EXE.LOG" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe.config" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\JTQI" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\6FE1240F60F2C861C5CEBBF1BCEB98553850BE3AC19624EA676A13480B2DD8BA.INI" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.INI" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.WINDOWS.FORMS" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.WINDOWS.FORMS.INI" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.INI" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.DRAWING" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\SYSTEM.DRAWING.INI" "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI"48:T460,"1.2.0.0" "16.0.0.0" "0.0.0.0" "2.5.29.37" "2.5.29.35" "192.168.0.2" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "4.0.0.0" found in string "ystem.Configuration,4.0.0.0,,b03f5f7f11d50a3a" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "4.0.0.0" found in string "4.0.0.0, Cul" "2.5.29.17" "2.5.29.15" "2.5.29.19" "2.5.29.32" "2.5.29.31" Potential IP "2.5.29.35" found in string "#2.5.29.35" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.14" "2.5.4.3" "2.5.29.1" "2.5.29.16" "3.0.0.0" "1.1.0.1" Potential IP "4.0.0.0" found in string "Maximum number of drives allowed in a sessionnonon=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" "2.5.29.10" "2.5.4.5" "2.5.4.10" "2.5.4.11" "2.5.4.6" "2.5.4.8" "2.5.4.7" Potential IP "0.0.0.0" found in string "n=0.0.0.0, Culture=en, PublicKeyToken=null" Potential IP "2.0.0.0" found in string "ystem.Drawing,2.0.0.0,,b03f5f7f11d50a3a" "4.0.0.0" "0.0.0.6" "1.0.1.1"49:T2ba8,Heuristic match: "nzo-z.lt" Heuristic match: ".@.ug" Heuristic match: "=+>.dz" Heuristic match: ")9.il" Heuristic match: "teste@teste.com" Heuristic match: "teia@seila.com" Pattern match: "http://imgur.com/a/{0}/" Pattern match: "https://imgur.com/a/{0}/" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "microsoft.net/framework/v4.0.30319/" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "www.digicert.com1" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll" Pattern match: "http://schemas.microsoft.com/powershell/microsoft.powershell" Heuristic match: "set-location $myinvocation.mycommand.name" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225750" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225747" Heuristic match: "get-content $file | more.com" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113316" Pattern match: "https://go.microsoft.com/fwlink/?linkid=160712" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.powershell.consolehost/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.consolehost.dll" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/xmlschema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.powershell.security/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.security.dll" Heuristic match: "$this.userinfo.identity.name" Heuristic match: "$this.userinfo.windowsidentity.name" Heuristic match: "$_.subjectname.name" Heuristic match: "$_.issuername.name" Heuristic match: "$this.resolvedcommand.name" Heuristic match: "$this.name + -> + $this.resolvedcommand.name" Heuristic match: "$this.name" Heuristic match: "$commandname = $this.name" Heuristic match: "ntrust.net" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ll.sh" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "0www.entrust.net/cps" Pattern match: "www.digicert.com1!0" Pattern match: "tartcom.org/intermediate.pdf0" Pattern match: "crosoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/ce" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Heuristic match: "( .pg" Heuristic match: ".p@ .pk" Heuristic match: ".pd .pm" Heuristic match: ".pp .ps" Heuristic match: "l2.ph" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Heuristic match: "este@teste.com" Heuristic match: "eia@seila.com" Pattern match: "imgur.com/a/{0}/" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "kxm.ck" Heuristic match: "el.cx" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Pattern match: "http://www.w3.org/2000/09/xmldsig#dsa-sha1" Pattern match: "http://www.w3.org/2000/09/xmldsig#rsa-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" Pattern match: "http://www.w3.org/2000/09/xmldsig#sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha256" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha512" Pattern match: "http://www.w3.org/2001/04/xmlenc#ripemd160" Pattern match: "http://www.w3.org/2001/04/xmlenc#des-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-tripledes" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes128-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes128" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes192-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes192" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes256-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes256" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315#withcomments" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#withcomments" Pattern match: "http://www.w3.org/2000/09/xmldsig#base64" Pattern match: "http://www.w3.org/tr/1999/rec-xpath-19991116" Pattern match: "http://www.w3.org/tr/1999/rec-xslt-19991116" Pattern match: "http://www.w3.org/2000/09/xmldsig#enveloped-signature" Pattern match: "http://www.w3.org/2002/07/decrypt#xml" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "http://www.w3.org/2001/04/xmlenc#" Pattern match: "http://www.w3.org/2000/09/xmldsig#hmac-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://schemas.microsoft.com/.netconfiguration/v2.0" Pattern match: "system.web/anonymousidentification" Pattern match: "system.web/authentication" Pattern match: "system.web/authorization" Pattern match: "system.web/browsercaps" Pattern match: "system.web/clienttarget" Pattern match: "system.web/compilation" Pattern match: "system.web/customerrors" Pattern match: "system.web/deployment" Pattern match: "system.web/devicefilters" Pattern match: "system.web/fulltrustassemblies" Pattern match: "system.web/globalization" Pattern match: "system.web/healthmonitoring" Pattern match: "system.web/hostingenvironment" Pattern match: "system.web/httpcookies" Pattern match: "system.web/httphandlers" Pattern match: "system.web/httpmodules" Pattern match: "system.web/httpruntime" Pattern match: "system.web/identity" Pattern match: "system.web/machinekey" Pattern match: "system.web/membership" Pattern match: "system.web/mobilecontrols" Pattern match: "system.web/pages" Pattern match: "system.web/partialtrustvisibleassemblies" Pattern match: "system.web/processmodel" Pattern match: "system.web/profile" Pattern match: "system.web/protocols" Pattern match: "system.web/rolemanager" Pattern match: "system.web/securitypolicy" Pattern match: "system.web/sessionpagestate" Pattern match: "system.web/sessionstate" Pattern match: "system.web/sitemap" Pattern match: "system.web/trace" Pattern match: "system.web/trust" Pattern match: "system.web/urlmappings" Pattern match: "system.web/webcontrols" Pattern match: "system.web/webparts" Pattern match: "system.web/webservices" Pattern match: "system.web/xhtmlconformance" Pattern match: "system.web/caching" Pattern match: "system.web/caching/cache" Pattern match: "system.web/caching/outputcache" Pattern match: "system.web/caching/outputcachesettings" Pattern match: "system.web/caching/sqlcachedependency" Pattern match: "https://fs.microsoft.com/fs/windows/config.json" Pattern match: "https://fs.microsoft.com/fs/windows/config.json,config,0"4a:T3125,Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00004336.00000000.170830.02E31000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;se]l+>%y1.3.132.0.8ecdp1.3.132.0.9@eckp1.3.132.0.33@eckp1.3.132.0.33ecdp1.2.840.10045.3.1.1@eckp1.3.132.0.9ecdp1.3.132.0.31ecdp1.3.132.0.8@eckp1.3.132.0.35ecdp" - Source: "00000000-00004336.00000000.170830.02E31000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00004336.00000000.170830.02E31000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00004336.00000000.170830.02E31000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00004336.00000000.170830.02E31000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00004336.00000000.170830.02E31000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00004336.00000000.170830.02E31000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00004336.00000000.170830.02E31000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004336.00000000.170830.02E31000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00004336.00000000.170830.02E31000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00004336.00000000.170830.074C0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00004336.00000000.170830.074C0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004336.00000000.170830.074C0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004336.00000000.170830.074C0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004336.00000000.170830.074C0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004336.00000000.170830.074C0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004336.00000000.170830.074C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00004336.00000000.170830.074C0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004336.00000000.170830.074C0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004336.00000000.170830.074C0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004336.00000000.170830.074C0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004336.00000000.170830.074C0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004336.00000000.170830.074C0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0com/r0m00q" - Source: "00000000-00004336.00000000.170830.074C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004336.00000000.170830.074C0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?b0@0geotrust" - Source: "00000000-00004336.00000000.170830.074C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0nf:8" - Source: "00000000-00004336.00000000.170830.074C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004336.00000000.170830.074C0000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00004336.00000000.170830.074C0000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00004336.00000000.170830.074C0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00004336.00000000.170830.074C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/ceerlisca2011_2011-03-29.crt0nf:8" - Source: "00000000-00004336.00000000.170830.074C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004336.00000000.170830.074C0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00004336.00000000.170830.6F771000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005356.00000000.170386.02D30000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe.configc:\6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe.configfile:///c:/6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exec:/6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exec:\6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exehttphttpsfilegophernntpnewsmailtouuidtelnetldapnet.tcpnet.pipevsmacrostargetframeworkmoniker.netportablesilverlightwindowsphone71windowsphone8.netframeworkversion=v4.5versionv4.50123456789abcdefsystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configc:\windows\microsoft.net\framework\v4.0.30319\c:\windows\microsoft.net\framework\v4.0.30319\path2path1c:\windows\microsoft.net\framework\v4.0.30319\configc:\windows\microsoft.net\framework\v4.0.30319\config\machine.configc:\windows\microsoft.net\framework\v4.0.30319\config\machine.configmachine.config\\.\modeaccessrightssharec:\windows\microsoft.net\framework\v4.0.30319\config\machine.config\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json07/22" - Source: "00000000-00005356.00000000.170386.07530000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,007/22" - Source: "00000000-00005356.00000000.170386.07530000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00005356.00000000.170386.6F561000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00005356.00000000.170386.6F561000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00005356.00000000.170386.6F561000.00000020.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00005356.00000000.170386.6F601000.00000020.mdmp")4b:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp")4c:T4a4,Found string "System.Data.SqlClient" (Indicator: "System.Data.SqlClient"; File: "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba") Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00005356.00000000.170386.050C0000.00000004.mdmp")4d:T72b,Observed namespace "System.Data.SqlClient.SqlConnection" and TypeReference ".ctor" in "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference ".ctor" in "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference "get_Parameters" in "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba" Observed namespace "System.Data.SqlClient.SqlParameter" and TypeReference ".ctor" in "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba" Observed namespace "System.Data.SqlClient.SqlParameterCollection" and TypeReference "Add" in "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba" Observed namespace "System.Data.SqlClient.SqlParameterCollection" and TypeReference "AddWithValue" in "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba" Observed namespace "System.Data.SqlClient.SqlDataAdapter" and TypeReference ".ctor" in "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba" Observed namespace "System.Data.SqlClient.SqlConnection" and TypeReference ".ctor" in "ctsdvwT.exe" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference ".ctor" in "ctsdvwT.exe" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference "get_Parameters" in "ctsdvwT.exe" Observed namespace "System.Data.SqlClient.SqlParameter" and TypeReference ".ctor" in "ctsdvwT.exe" Observed namespace "System.Data.SqlClient.SqlParameterCollection" and TypeReference "Add" in "ctsdvwT.exe" Observed namespace "System.Data.SqlClient.SqlParameterCollection" and TypeReference "AddWithValue" in "ctsdvwT.exe" Observed namespace "System.Data.SqlClient.SqlDataAdapter" and TypeReference ".ctor" in "ctsdvwT.exe"4e:Teac,"6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00005356) "6fe1240f60f2c861c5cebbf1bceb98553850be3ac19624ea676a13480b2dd8ba.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00005356)4f:T12c4,Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; File: "00000000-00004336.00000000.170830.00071000.00000020.mdmp") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00004336.00000000.170830.00071000.00000020.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004336.00000000.170830.00071000.00000020.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004336.00000000.170830.00071000.00000020.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004336.00000000.170830.00071000.00000020.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004336.00000000.170830.00071000.00000020.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004336.00000000.170830.00071000.00000020.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004336.00000000.170830.00071000.00000020.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004336.00000000.170830.00071000.00000020.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004336.00000000.170830.00071000.00000020.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00004336.00000000.170830.02E31000.00000004.mdmp, 00000000-00004336.00000000.170830.074C0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004336.00000000.170830.02E31000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "System.Security.Cryptography.X509Certificates.X509Certificate2" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "System.Security.Cryptography.X509Certificates.X509Store" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "System.Security.Cryptography.X509Certificates.X509CertificateEx" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00004336.00000000.170830.04DB0000.00000004.mdmp") Found string "[-WindowStyle