24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 71:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Mardom.MN.Generic Sample 8f085b0c0abc… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 8f085b0c0abc…. Malware family: Trojan.Mardom.MN.Generic. Threat score 100/100. 10/27 AV engines flagged this file. 19 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8f085b0c0abca741f2f1254d6d089a686f3864d407acb9ba843f74afa827cbec","keywords":["Malicious","Trojan.Mardom.MN.Generic","malware analysis","sandbox report","threat intelligence","8f085b0c0abca741f2f1254d6d089a686f3864d407acb9ba843f74afa827cbec"],"about":{"@type":"SoftwareApplication","name":"Purchase order.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"8f085b0c0abca741f2f1254d6d089a686f3864d407acb9ba843f74afa827cbec","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Mardom.MN.Generic","antivirusDetections":{"malicious":10,"total":27},"behavioralIndicators":{"malicious":19,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T468,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003396.00000000.90310.03A90000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00003396.00000001.91228.02A90000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00003396.00000001.91228.02A90000.00000004.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00003396.00000001.91228.02A90000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003720.00000000.66801.038E0000.00000004.mdmp, 00000000-00003720.00000001.67816.006C0000.00000004.mdmp")26:T474,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003396.00000000.90310.02A90000.00000004.mdmp, 00000000-00003396.00000001.91228.02A90000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003396.00000000.90310.02A90000.00000004.mdmp, 00000000-00003396.00000001.91228.02A90000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003720.00000000.66801.028E0000.00000004.mdmp, 00000000-00003720.00000001.67816.028E0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003720.00000000.66801.028E0000.00000004.mdmp, 00000000-00003720.00000001.67816.028E0000.00000004.mdmp")27:T1603,file/memory contains long string with (Indicator: "Oid"; File: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157") Found reference to "HMACSHA1" (Indicator: "HMAC"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to "HMACSHA512" (Indicator: "HMAC"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to "HMACSHA512" (Indicator: "HMACSHA512"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to "HMACSHA512" (Indicator: "SHA512"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to "HMACSHA256" (Indicator: "HMAC"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to "SHA1Managed" (Indicator: "SHA1Managed"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to "Rijndael" (Indicator: "Rijndael"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to "KeyedHashAlgorithm" (Indicator: "HashAlgorithm"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to "KeyedHashAlgorithm" (Indicator: "KeyedHashAlgorithm"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to "CryptographicException" (Indicator: "CryptographicException"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to "SHA1CryptoServiceProvider" (Indicator: "SHA1CryptoServiceProvider"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to "RNGCryptoServiceProvider" (Indicator: "RNGCryptoServiceProvider"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDES"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDESCryptoServiceProvider"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to "TripleDES" (Indicator: "TripleDES"; Source: "00000000-00003396.00000000.90310.02A90000.00000004.mdmp, 00000000-00003396.00000001.91228.02A90000.00000004.mdmp") Found reference to "Rijndael" (Indicator: "Rijndael"; Source: "00000000-00003396.00000000.90310.02A90000.00000004.mdmp, 00000000-00003396.00000001.91228.02A90000.00000004.mdmp, 00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00003396.00000000.90310.02A90000.00000004.mdmp, 00000000-00003396.00000001.91228.02A90000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00003396.00000000.90310.02A90000.00000004.mdmp, 00000000-00003396.00000001.91228.02A90000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00003396.00000000.90310.02A90000.00000004.mdmp, 00000000-00003396.00000001.91228.02A90000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00003396.00000000.90310.02A90000.00000004.mdmp, 00000000-00003396.00000001.91228.02A90000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00003396.00000000.90310.02A90000.00000004.mdmp, 00000000-00003396.00000001.91228.02A90000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00003396.00000000.90310.02A90000.00000004.mdmp, 00000000-00003396.00000001.91228.02A90000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00003396.00000000.90310.02A90000.00000004.mdmp, 00000000-00003396.00000001.91228.02A90000.00000004.mdmp")28:T442,Found PE header "MZ" - Source: "00000000-00003396.00000000.90310.02A90000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003396.00000000.90310.03A90000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003396.00000001.91228.02A90000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003720.00000000.66801.00530000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003720.00000000.66801.028E0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003720.00000000.66801.038E0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003720.00000001.67816.006C0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003720.00000001.67816.00720000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003720.00000001.67816.00810000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003720.00000001.67816.028E0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003720.00000001.67816.038E0000.00000004.mdmp")29:T4bb,Found reference to API "CryptAcquireContextFlags" (Indicator: "CryptAcquireContext"; File: "Purchase order.exe") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API "BCryptDecrypt" (Indicator: "CryptDecrypt"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API "BCryptEncrypt" (Indicator: "BCryptEncrypt"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API "BCryptEncrypt" (Indicator: "CryptEncrypt"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API "BCryptImportKey" (Indicator: "CryptImportKey"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API "BCryptGetProperty" (Indicator: "BCryptGetProperty"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API "BCryptSetProperty" (Indicator: "BCryptSetProperty"; File: "00003064.00000BF8.19231311.00402000.wprm")2a:T4d2,Found string "http://www.w3.org/2001/04/xmlenc# EncryptedKey" (Indicator: "encryptedkey"; Source: "00000000-00003396.00000000.90310.02A90000.00000004.mdmp, 00000000-00003396.00000001.91228.02A90000.00000004.mdmp") Found string "System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" (Indicator: "encryptedkey"; Source: "00000000-00003396.00000000.90310.02A90000.00000004.mdmp, 00000000-00003396.00000001.91228.02A90000.00000004.mdmp") Found string "PRIVATE KEY LOCATION: "{0}"]" (Indicator: "private key"; Source: "00000000-00003396.00000001.91228.02A90000.00000004.mdmp, 00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found string "http://www.w3.org/2001/04/xmlenc# EncryptedKey" (Indicator: "encryptedkey"; Source: "00000000-00003720.00000000.66801.028E0000.00000004.mdmp, 00000000-00003720.00000001.67816.028E0000.00000004.mdmp") Found string "System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" (Indicator: "encryptedkey"; Source: "00000000-00003720.00000000.66801.028E0000.00000004.mdmp, 00000000-00003720.00000001.67816.028E0000.00000004.mdmp")2b:T1d94,Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEEYEdcdvM%2B0BEMsDuQBqQWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEEYEdcdvM%2B0BEMsDuQBqQWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEEYEdcdvM%2B0BEMsDuQBqQWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEEYEdcdvM%2B0BEMsDuQBqQWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog"2c:T513,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Decrypted SSL network traffic Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to encrypt/decrypt data using TripleDES Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains asymmetric cryptographic functions (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Calls an API typically used to decrypt data Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Found encryption key used by malware in binary Matched sigs: HTTP requests contain Base64 strings Matched sigs: YARA signature match - AES Encryption2d:T9f2,"Purchaseorder.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000c500a5010000000000000000000000000000000000000c00c000a501000000000000000000005876e00000000000200000000000000000000000d053e2004873e0006874e000b0a4e2001078e000000000007cf37b0000000000d8f57b004558c57763200100feffffff0ce4c07772e1c07764c51d77d042c177000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000064c51d77b0a4e20064c51d77 (UID: 00000000-00003720) "Purchaseorder.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003720) "Purchaseorder.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003720) "Purchaseorder.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000e000000000007401e0000000000003000000000000005001e00017000000a8e5e30000000000170000001800010114000000432ac27310f43a004558c5776b3a01000000000003000003c0bde2004827006fa8e5e300010000000000000080000000a0e5e3004827006fa8e5e3000100000000000000020000000c000000689de300689de300639de30000000000bcf33a000000e000a8e5e30100f33a00c8f33a0020f93a004558c5774b3a0100feffffff1634c1774134c17794000000a0000000629de300609de30094000000a4f43a00b914cd76e00c00004cf43a0050f43a00 (UID: 00000000-00003720)2e:T1a7a,"Purchaseorder.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000b05ee200ecf57b00e733c1771634c177b8f67b00010000009401e000010000006cf57b00b416c277c020ce779a16c2774706ba77b8f67b000100000001000000d8cde200000000003cf57b006cf57b00d8f57b004558c577fb480100feffffff9a16c277a51967770000187700000000 (UID: 00000000-00003720) "Purchaseorder.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100006e00330038005c005300630072006900700074000000000000004300000000000000000000000000000000000000000000000100b0d0e300409be3000a00000ac13e00007801e400c0bde2004c006f00630061006c005c00500072006f006700720061006d0073005c00500079007400 (UID: 00000000-00003720) "Purchaseorder.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003720) "Purchaseorder.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb8f751842ed0000e0fd7ed30fc2770090fa7ef4c34b0544e0fd7e00000000400000003f0000002b00000000e0fd7ee8c34b05fa0fc2775042ce772b00000000e0fd7ed30fc2770090fa7e0cc44b05b883c1770021ce7794466777d8eb8f75 (UID: 00000000-00003720) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb8f7588dc9e0000e0fd7ed30fc27700d0fd7e24bc1e0044e0fd7e00000000400000003f0000001f00000000e0fd7e18bc1e00fa0fc2775042ce771f00000000e0fd7ed30fc27700d0fd7e3cbc1e00b883c1770021ce7794466777d8eb8f75 (UID: 00000000-00002556) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b005c00760032002e0030002e00350030003700320037005c006d00730063006f00720077006b0073002e0064006c006c002e0032002e004d0061006e00690066006500730074000000 (UID: 00000000-00002556) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000636dd26e00006602000000006c6dd26e296e1845d8d7326fc8eb1e00c4eb1e0000000000000000000000000000000000d8d7326f1ceb1e00000000008ceb1e00c8eb1e005ceb1e00ff23d26ec83bdb6e9ceb1e003117d26e08000000fafabf7766b1c177ffffffff2400000084eb1e00 (UID: 00000000-00002556) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002556) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002556) "RegAsm.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100342c2c4973576f77363450726f636573732c6b65726e656c33322e646c6c2c223638373a31373a30362e303837222c52583d302c50583d30003000310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e00660069006700000043006f00 (UID: 00000000-00004724) "RegAsm.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031004438f2e605b29c52773437606c000000000100000000000000010000005cf2e605000000002812d70298f2e605004d9b0068f2e6058f9c52773437606c020000000000000018000000010000006cf2e60528239c7200008e00000000000c0000006062df0278f2e6052f99606c0c000000 (UID: 00000000-00004724) "RegAsm.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f244ec76bc76627750fd9a008096920054fd9a0050fd9a0030000000000000007cf0310050dcf07650fd9a003000000000000000cc67a70530000000020000000000000018000000c1e95397a4f0310028239c7200008e00000000000c00000028c7356cb0f031002f99606c0c000000 (UID: 00000000-00004724) "RegAsm.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000050f131006a6fb27200000000bc6fb272e63d1641d0ec310000000000d0f23100155e7576b2bc5337feffffff75017e76e2d861772824be7102000000000000001800000030a5606c10f1310028239c7200008e00000000000c00000030a5606c1cf131002f99606c0c000000 (UID: 00000000-00004724) "RegAsm.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310005338abc73500a9a000000000070f1d8052827bc73500a9a00b8f1d8050723bb73500a9a0020000000000000005c37bb732812d70220c2df022812d702020000000000000018000000000a9a00bcf1d80528239c7200008e00000000000c00000020c2df02c8f1d8052f99606c0c000000 (UID: 00000000-00004724) "RegAsm.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f244ec76bc766277e0fc9a0080969200e4fc9a00e0fc9a0030000000000000007cf0310050dcf076e0fc9a0030000000000000002405a80530000000020000000000000018000000c1e95397a4f0310028239c7200008e00000000000c00000028c7356cb0f031002f99606c0c000000 (UID: 00000000-00004724) "RegAsm.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000028f131006a6fb27200000000bc6fb2728e3d1641a8ec310000000000d0f23100155e7576b2bc5337feffffff75017e76e2d861772824be7102000000000000001800000030a5606ce8f0310028239c7200008e00000000000c00000030a5606cf4f031002f99606c0c000000 (UID: 00000000-00004724) "RegAsm.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310006338abc73501f9c0000000000f0f007062827bc73501f9c0038f107060723bb73501f9c0020000000000000005c37bb732812d7022022e0022812d702020000000000000018000000001f9c003cf1070628239c7200008e00000000000c0000002022e00248f107062f99606c0c000000 (UID: 00000000-00004724) "RegAsm.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f244ec76bc76627710589700809692001458970010589700800000000000000058f0310050dcf0761058970050000000000000002405a80550000000020000000000000018000000e5e9539780f0310028239c7200008e00000000000c00000028c7356c8cf031002f99606c0c000000 (UID: 00000000-00004724)2f:T6e6,Found string "SELECT * FROM Win32_Processor" (Indicator: "select * from "; File: "00003064.00000BF8.19231311.00402000.wprm") Found string "select * from Win32_BIOS" (Indicator: "select * from "; Source: "00000000-00003396.00000000.90310.02A90000.00000004.mdmp, 00000000-00003396.00000001.91228.02A90000.00000004.mdmp") Found string "select * from Win32_ComputerSystem" (Indicator: "select * from "; Source: "00000000-00003396.00000000.90310.02A90000.00000004.mdmp, 00000000-00003396.00000001.91228.02A90000.00000004.mdmp") Found string "VMware|VIRTUAL|A M I|Xen"select * from Win32_ComputerSystem" (Indicator: "select * from "; Source: "00000000-00003396.00000000.90310.02A90000.00000004.mdmp 00000000-00003396.00000001.91228.02A90000.00000004.mdmp"), Found string "select * from Win32_" (Indicator: "select * from "; Source: "00000000-00003396.00000000.90310.02A90000.00000004.mdmp 00000000-00003396.00000001.91228.02A90000.00000004.mdmp"), Found string "select * from Win32_BIOS" (Indicator: "select * from "; Source: "00000000-00003720.00000000.66801.028E0000.00000004.mdmp 00000000-00003720.00000001.67816.028E0000.00000004.mdmp"), Found string "select * from Win32_ComputerSystem" (Indicator: "select * from "; Source: "00000000-00003720.00000000.66801.028E0000.00000004.mdmp 00000000-00003720.00000001.67816.028E0000.00000004.mdmp"), Found string "VMware|VIRTUAL|A M I|Xen"select * from Win32_ComputerSystem" (Indicator: "select * from "; Source: "00000000-00003720.00000000.66801.028E0000.00000004.mdmp, 00000000-00003720.00000001.67816.028E0000.00000004.mdmp") Found string "select * from Win32_" (Indicator: "select * from "; Source: "00000000-00003720.00000000.66801.028E0000.00000004.mdmp, 00000000-00003720.00000001.67816.028E0000.00000004.mdmp")30:T5c9,"Purchaseorder.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Purchaseorder.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "ipconfig.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "RegAsm.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS")31:T7c3,"ipconfig.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "ipconfig.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "ENABLEDHCP"; Value: "") "ipconfig.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTRATIONENABLED"; Value: "") "ipconfig.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTERADAPTERNAME"; Value: "") "ipconfig.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DOMAIN"; Value: "") "ipconfig.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPDOMAIN"; Value: "") "ipconfig.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "ipconfig.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "ipconfig.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "ipconfig.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "ipconfig.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")32:T608,"Purchaseorder.exe" queries volume information of "C:\Purchaseorder.exe" at 00000000-00003720-00000046-1186824 "Purchaseorder.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Http\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.Http.dll" at 00000000-00003720-00000046-19912121 "Purchaseorder.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Http\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.Http.dll" at 00000000-00003720-00000046-19929726 "RegAsm.exe" queries volume information of "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" at 00000000-00004724-00000046-2316799 "RegAsm.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll" at 00000000-00004724-00000046-8013692 "RegAsm.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll" at 00000000-00004724-00000046-8025631 "pdf.exe" queries volume information of "C:\Users\%OSUSER%\Documents\pdf.exe" at 00000000-00003396-00000046-1743820 "pdf.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Http\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.Http.dll" at 00000000-00003396-00000046-18886785 "pdf.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Http\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.Http.dll" at 00000000-00003396-00000046-1889093733:T59f,"powershell.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" "powershell.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AD05CI7MFTFLU5ILR9M4.TEMP" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AD05CI7MFTFLU5ILR9M4.temp" "powershell.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF101841.TMP" "powershell.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MTZ1DSHHYGIPFQDYYHKB.TEMP" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MTZ1DSHHYGIPFQDYYHKB.temp" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF15b27d.TMP"34:T79f,"Purchaseorder.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003720) "Purchaseorder.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00003720) "Purchaseorder.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003720) "powershell.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00002556) "powershell.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Recent\CustomDestinations (UID: 00000000-00002556) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002556) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00002556) "RegAsm.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00004724) "RegAsm.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00004724) "WScript.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00000476) "pdf.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003396) "pdf.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00003396) "pdf.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003396) "powershell.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00001712) "powershell.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Recent\CustomDestinations (UID: 00000000-00001712) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00001712) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00001712)35:T701,"Purchaseorder.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\cmd.exe" /c ipconfig /release" - (UID: 00000000-00003720) "Purchaseorder.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACcAaAB0AHQAcABzADoALwAvAGcAb" - (UID: 00000000-00003720) "Purchaseorder.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\cmd.exe" /c ipconfig /renew" - (UID: 00000000-00003720) "Purchaseorder.exe" called "CreateProcessA" with parameter "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" - (UID: 00000000-00003720) "cmd.exe" called "CreateProcessW" with parameter "ipconfig /release" - (UID: 00000000-00002676) "powershell.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Internet Explorer\iexplore.exe" https://google.com/" - (UID: 00000000-00002556) "cmd.exe" called "CreateProcessW" with parameter "ipconfig /renew" - (UID: 00000000-00002632) "WScript.exe" called "CreateProcessW" with parameter ""%USERPROFILE%\documents\pdf.exe"" - (UID: 00000000-00000476) "pdf.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\cmd.exe" /c ipconfig /release" - (UID: 00000000-00003396) "pdf.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACcAaAB0AHQAcABzADoALwAvAGcAb" - (UID: 00000000-00003396) "pdf.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\cmd.exe" /c ipconfig /renew" - (UID: 00000000-00003396) "pdf.exe" called "CreateProcessA" with parameter "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" - (UID: 00000000-00003396) "cmd.exe" called "CreateProcessW" with parameter "ipconfig /release" - (UID: 00000000-00001524)36:Tac5d,"Purchaseorder.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\ieframe.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Net.Http\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.Http.dll (UID: 00000000-00003720) "Purchaseorder.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\shdocvw.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\199dd46435d7fdbbe590cccd8c8ae9cb\mscorlib.ni.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System\f3e2031575563c54b4bab372bbe1453f\System.ni.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\07b924d7e3b2e6344530aaa8514942aa\Microsoft.PowerShell.ConsoleH (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management.A#\bb568276b4a8b4d6f64d115294dd5c3d\System.Management.Automation. (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Core\8b5f9b59ed667a576d891eee157bf212\System.Core.ni.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\e17fd2e5fac93d8b9613bd5762bbd647\Microsoft.PowerShell.Commands (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\4342ed1aad046aa5ea9bb72bfbe99b8c\System.Configuration.Install. (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\e0652e0803f7a46306920b8043d23f52\Microsoft.WSMan.Management.ni (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Transactions\cedbdd073e0bcad91dbc5ddd921ffca0\System.Transactions.ni.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\e4fc372b5ff973eeac3dd6dac72e36b2\Microsoft.PowerShell.Commands (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\83076f46a06276b5a16ef0bc246d1bee\Microsoft.PowerShell.Commands (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\5509072e130e13708f7dcb8b5b527665\Microsoft.PowerShell.Security (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\culture.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\bd2e0a351b1495ed6e0f5eb45ba9f3fe\System.Xml.ni.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management\48155c7263ce0528f367ed4b3015cdc4\System.Management.ni.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\421ea4f1bcf6e3989b521d744a5b4a8f\System.DirectoryServices.ni.d (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data\5091f8e36728e57dcdfd74b464281728\System.Data.ni.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Internet Explorer\ieproxy.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00002556) "powershell.exe" called "LoadLibrary" with a parameter netutils.dll (UID: 00000000-00002556) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002632) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002632) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002632) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002632) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\vaultcli.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter vaultcli.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004724) "RegAsm.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00004724) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00000476) "WScript.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00000476) "WScript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000476) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WScript.exe (UID: 00000000-00000476) "WScript.exe" called "LoadLibrary" with a parameter SXS.DLL (UID: 00000000-00000476) "WScript.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00000476) "WScript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000476) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00000476) "WScript.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00000476) "WScript.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00000476) "WScript.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000476) "WScript.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00000476) "WScript.exe" called "LoadLibrary" with a parameter MSISIP.DLL (UID: 00000000-00000476) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00000476) "WScript.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00000476) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wshext.dll (UID: 00000000-00000476) "WScript.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00000476) "WScript.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00000476) "WScript.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00000476) "WScript.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00000476) "WScript.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00000476) "WScript.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00000476) "WScript.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000476) "WScript.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00000476) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00000476) "WScript.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00000476) "WScript.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00000476) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00000476) "pdf.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Net.Http\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.Http.dll (UID: 00000000-00003396) "pdf.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003396) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001524) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001524) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001524) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001524) "ipconfig.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004312) "ipconfig.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004312) "ipconfig.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004312) "ipconfig.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004312) "ipconfig.exe" called "LoadLibrary" with a parameter dhcpcsvc.dll (UID: 00000000-00004312) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\shdocvw.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\199dd46435d7fdbbe590cccd8c8ae9cb\mscorlib.ni.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System\f3e2031575563c54b4bab372bbe1453f\System.ni.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\07b924d7e3b2e6344530aaa8514942aa\Microsoft.PowerShell.ConsoleH (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management.A#\bb568276b4a8b4d6f64d115294dd5c3d\System.Management.Automation. (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Core\8b5f9b59ed667a576d891eee157bf212\System.Core.ni.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\e17fd2e5fac93d8b9613bd5762bbd647\Microsoft.PowerShell.Commands (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\4342ed1aad046aa5ea9bb72bfbe99b8c\System.Configuration.Install. (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\e0652e0803f7a46306920b8043d23f52\Microsoft.WSMan.Management.ni (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Transactions\cedbdd073e0bcad91dbc5ddd921ffca0\System.Transactions.ni.dll (UID: 00000000-00001712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00001712) "ipconfig.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002892) "ipconfig.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002892) "ipconfig.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002892) "ipconfig.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002892) "ipconfig.exe" called "LoadLibrary" with a parameter dhcpcsvc.dll (UID: 00000000-00002892) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003064) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003064) "RegAsm.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003064) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003064) "RegAsm.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003064) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003064) "RegAsm.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003064) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003064) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003064) "RegAsm.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003064) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0\clr.dll (UID: 00000000-00003064) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003064)37:T50a,"SELECT * FROM Win32_Processor" (Source: 00003064.00000BF8.19231311.00402000.wprm, Indicator: "select * from win32_processor") "select * from Win32_BIOS" (Source: 00000000-00003396.00000000.90310.02A90000.00000004.mdmp, 00000000-00003396.00000001.91228.02A90000.00000004.mdmp, Indicator: "select * from win32_bios") "select * from Win32_ComputerSystem" (Source: 00000000-00003396.00000000.90310.02A90000.00000004.mdmp, 00000000-00003396.00000001.91228.02A90000.00000004.mdmp, Indicator: "select * from win32_computersystem") "select * from Win32_" (Source: 00000000-00003396.00000000.90310.02A90000.00000004.mdmp, 00000000-00003396.00000001.91228.02A90000.00000004.mdmp, Indicator: "select * from win32_") "select * from Win32_BIOS" (Source: 00000000-00003720.00000000.66801.028E0000.00000004.mdmp, 00000000-00003720.00000001.67816.028E0000.00000004.mdmp, Indicator: "select * from win32_bios") "select * from Win32_ComputerSystem" (Source: 00000000-00003720.00000000.66801.028E0000.00000004.mdmp, 00000000-00003720.00000001.67816.028E0000.00000004.mdmp, Indicator: "select * from win32_computersystem") "select * from Win32_" (Source: 00000000-00003720.00000000.66801.028E0000.00000004.mdmp, 00000000-00003720.00000001.67816.028E0000.00000004.mdmp, Indicator: "select * from win32_")38:T4cb,Found reference to API "Failed to GetDefaultCandidateConfigFilePaths in CreateFileNotFoundMessage: {0}" (Indicator: "CreateFile"; File: "Purchase order.exe") Found reference to API "CreateFile" (Indicator: "CreateFile"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API "CreateFileMapping" (Indicator: "CreateFile"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API "CreateFile" (Indicator: "CreateFile"; Source: "00000000-00003396.00000000.90310.03A90000.00000004.mdmp, 00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API "CreateFileMapping" (Indicator: "CreateFile"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API "CreateFile" (Indicator: "CreateFile"; Source: "00000000-00003720.00000000.66801.038E0000.00000004.mdmp, 00000000-00003720.00000001.67816.006C0000.00000004.mdmp, 00000000-00003720.00000001.67816.038E0000.00000004.mdmp")39:T7cdc,Found reference to API (Indicator: "GetObject"; File: "Purchase order.exe") Found reference to API (Indicator: "CreateService"; File: "Purchase order.exe") Found reference to API (Indicator: "DeleteService"; File: "Purchase order.exe") Found reference to API (Indicator: "StartService"; File: "Purchase order.exe") Found reference to API (Indicator: "ReleaseMutex"; File: "Purchase order.exe") Found reference to API (Indicator: "CreateDirectory"; File: "Purchase order.exe") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "CreateThread"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "QueryDosDevice"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "IsTextUnicode"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "SendMessage"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "GetEnvironmentVariable"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "SetEnvironmentVariable"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "GetModuleHandle"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "CloseHandle"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "DuplicateHandle"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "CreateFile"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "DeleteFile"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "WriteFile"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "MoveFile"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "MapViewOfFile"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "UnmapViewOfFile"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "GetModuleFileName"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "GetFileType"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "GetKeyboardState"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "GetKeyState"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "CreateFileMapping"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "GetPrivateProfileString"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "GetTempPath"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "GetWindowTextLength"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "VaultGetItem"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "GetVolumeInformation"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "NtQuerySystemInformation"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "GetLastInputInfo"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "GetLastError"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "EnumProcessModules"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "GetLogicalDrives"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "VaultEnumerateItems"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "CreateProcess"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "OpenProcess"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "GetCurrentProcess"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "NtQueryObject"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "VaultOpenVault"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "GetParent"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "BCryptDecrypt"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "BCryptEncrypt"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "GetKeyboardLayout"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "GetWindowText"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "GetForegroundWindow"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "ToUnicodeEx"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "GetModuleFileNameEx"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "RegQueryValueEx"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "GetFileSizeEx"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "UnhookWindowsHookEx"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "SetWindowsHookEx"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "CallNextHookEx"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "RegOpenKeyEx"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "RegCloseKey"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "BCryptImportKey"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "BCryptDestroyKey"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "BCryptGetProperty"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "BCryptSetProperty"; File: "00003064.00000BF8.19231311.00402000.wprm") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "IsValidSid"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "InitializeSid"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "GetSidLengthRequired"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorOwner"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "MakeAbsoluteSD"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorGroup"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "AddAce"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "GetAclInformation"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "IsValidSecurityDescriptor"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "ProgIDFromCLSID"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "CommandLineToArgvW"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "GetSystemWindowsDirectoryW"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "UnregisterClassA"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "RtlFreeHeap"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "RtlAllocateHeap"; Source: "00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp") Found reference to API (Indicator: "MoveFileEx"; Source: "00000000-00003396.00000000.90310.03A90000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00003396.00000000.90310.03A90000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003396.00000000.90310.03A90000.00000004.mdmp") Found reference to API (Indicator: "CheckRemoteDebuggerPresent"; Source: "00000000-00003396.00000000.90310.03A90000.00000004.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00003396.00000000.90310.03A90000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003396.00000000.90310.03A90000.00000004.mdmp, 00000000-00003396.00000001.91228.02A90000.00000004.mdmp, 00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "CreateFile"; Source: "00000000-00003396.00000000.90310.03A90000.00000004.mdmp, 00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00003396.00000000.90310.03A90000.00000004.mdmp, 00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003396.00000000.90310.03A90000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003396.00000000.90310.03A90000.00000004.mdmp, 00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00003396.00000000.90310.03A90000.00000004.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00003396.00000000.90310.03A90000.00000004.mdmp, 00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00003396.00000000.90310.03A90000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentDirectory"; Source: "00000000-00003396.00000000.90310.03A90000.00000004.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00003396.00000000.90310.03A90000.00000004.mdmp") Found reference to API (Indicator: "Local State"; Source: "00000000-00003396.00000001.91228.02A90000.00000004.mdmp, 00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00003396.00000001.91228.02A90000.00000004.mdmp") Found reference to API (Indicator: "Wow64SetThreadContext"; Source: "00000000-00003396.00000001.91228.02A90000.00000004.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00003396.00000001.91228.02A90000.00000004.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00003396.00000001.91228.02A90000.00000004.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00003396.00000001.91228.02A90000.00000004.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00003396.00000001.91228.02A90000.00000004.mdmp") Found reference to API (Indicator: "ZwUnmapViewOfSection"; Source: "00000000-00003396.00000001.91228.02A90000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00003396.00000001.91228.02A90000.00000004.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00003396.00000001.91228.02A90000.00000004.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00003396.00000001.91228.02A90000.00000004.mdmp, 00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "SetWindowsHookEx"; Source: "00000000-00003396.00000001.91228.02A90000.00000004.mdmp, 00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00003396.00000001.91228.02A90000.00000004.mdmp, 00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyEx"; Source: "00000000-00003396.00000001.91228.02A90000.00000004.mdmp, 00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00003396.00000001.91228.02A90000.00000004.mdmp, 00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "BCryptImportKey"; Source: "00000000-00003396.00000001.91228.02A90000.00000004.mdmp, 00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "BCryptDestroyKey"; Source: "00000000-00003396.00000001.91228.02A90000.00000004.mdmp, 00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "BCryptGetProperty"; Source: "00000000-00003396.00000001.91228.02A90000.00000004.mdmp, 00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "BCryptSetProperty"; Source: "00000000-00003396.00000001.91228.02A90000.00000004.mdmp, 00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "QueryDosDevice"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "IsTextUnicode"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "SendMessage"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "SetEnvironmentVariable"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandle"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "DeleteFile"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "MoveFile"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileName"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "GetKeyboardState"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "CreateFileMapping"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "GetPrivateProfileString"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "GetWindowTextLength"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "VaultGetItem"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "GetVolumeInformation"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "GetLastInputInfo"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "EnumProcessModules"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "VaultEnumerateItems"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "CreateProcess"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "NtQueryObject"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "VaultOpenVault"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "BCryptDecrypt"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "BCryptEncrypt"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "GetKeyboardLayout"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "GetWindowText"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "ToUnicodeEx"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameEx"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueEx"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00003396.00000001.91228.03A90000.00000004.mdmp") Found reference to API (Indicator: "MoveFileEx"; Source: "00000000-00003720.00000000.66801.038E0000.00000004.mdmp, 00000000-00003720.00000001.67816.006C0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00003720.00000000.66801.038E0000.00000004.mdmp, 00000000-00003720.00000001.67816.006C0000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003720.00000000.66801.038E0000.00000004.mdmp, 00000000-00003720.00000001.67816.006C0000.00000004.mdmp") Found reference to API (Indicator: "CheckRemoteDebuggerPresent"; Source: "00000000-00003720.00000000.66801.038E0000.00000004.mdmp, 00000000-00003720.00000001.67816.006C0000.00000004.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00003720.00000000.66801.038E0000.00000004.mdmp, 00000000-00003720.00000001.67816.006C0000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003720.00000000.66801.038E0000.00000004.mdmp, 00000000-00003720.00000001.67816.006C0000.00000004.mdmp, 00000000-00003720.00000001.67816.028E0000.00000004.mdmp, 00000000-00003720.00000001.67816.038E0000.00000004.mdmp") Found reference to API (Indicator: "CreateFile"; Source: "00000000-00003720.00000000.66801.038E0000.00000004.mdmp, 00000000-00003720.00000001.67816.006C0000.00000004.mdmp, 00000000-00003720.00000001.67816.038E0000.00000004.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00003720.00000000.66801.038E0000.00000004.mdmp, 00000000-00003720.00000001.67816.006C0000.00000004.mdmp, 00000000-00003720.00000001.67816.038E0000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003720.00000000.66801.038E0000.00000004.mdmp, 00000000-00003720.00000001.67816.006C0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003720.00000000.66801.038E0000.00000004.mdmp, 00000000-00003720.00000001.67816.006C0000.00000004.mdmp, 00000000-00003720.00000001.67816.038E0000.00000004.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00003720.00000000.66801.038E0000.00000004.mdmp, 00000000-00003720.00000001.67816.006C0000.00000004.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00003720.00000000.66801.038E0000.00000004.mdmp, 00000000-00003720.00000001.67816.006C0000.00000004.mdmp, 00000000-00003720.00000001.67816.038E0000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00003720.00000000.66801.038E0000.00000004.mdmp, 00000000-00003720.00000001.67816.006C0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentDirectory"; Source: "00000000-00003720.00000000.66801.038E0000.00000004.mdmp, 00000000-00003720.00000001.67816.006C0000.00000004.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00003720.00000000.66801.038E0000.00000004.mdmp, 00000000-00003720.00000001.67816.006C0000.00000004.mdmp")3a:T15f3,"%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "%appdata%\microsoft\windows\start menu\programs\startup") in Source: 00000000-00000476-00000C41-6028482070 "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\cmd.*" (Indicator: "%appdata%\microsoft\windows\start menu\programs\startup\cmd.*") in Source: 00000000-00003396-00000C28-8023514776 "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\powershell.*" (Indicator: "%appdata%\microsoft\windows\start menu\programs\startup\powershell.*") in Source: 00000000-00003396-00000C28-29434975754 ""%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs"" (Indicator: ""%appdata%\microsoft\windows\start menu\programs\startup\pdf.vbs"") in Source: WScript.exe "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\") in Source: 00000000-00003396.00000000.90310.007E0000.00000004.mdmp 00000000-00003396.00000001.91228.007E0000.00000004.mdmp 00000000-00003396.00000001.91228.05B40000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003396.00000000.90310.007E0000.00000004.mdmp 00000000-00003396.00000000.90310.00EE0000.00000002.mdmp 00000000-00003396.00000001.91228.007E0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00003396.00000000.90310.007E0000.00000004.mdmp "\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00003396.00000000.90310.007E0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00003396.00000000.90310.007E0000.00000004.mdmp 00000000-00003396.00000001.91228.007E0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003396.00000000.90310.007E0000.00000004.mdmp 00000000-00003396.00000000.90310.00EE0000.00000002.mdmp 00000000-00003396.00000001.91228.007E0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003396.00000000.90310.007E0000.00000004.mdmp 00000000-00003396.00000001.91228.007E0000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003396.00000000.90310.007E0000.00000004.mdmp 00000000-00003396.00000001.91228.007E0000.00000004.mdmp "ming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "ming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00003396.00000000.90310.007E0000.00000004.mdmp "\Users\5pZvNhG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "\users\5pzvnhg\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00003396.00000001.91228.007E0000.00000004.mdmp "C:\Users\5pZvNhG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "c:\users\5pzvnhg\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00003396.00000001.91228.02A90000.00000004.mdmp "C:\Users\5pZvNhG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf" (Indicator: "c:\users\5pzvnhg\appdata\roaming\microsoft\windows\start menu\programs\startup\pdf") in Source: 00000000-00003396.00000001.91228.02A90000.00000004.mdmp "C:\Users\5pZvNhG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs" (Indicator: "c:\users\5pzvnhg\appdata\roaming\microsoft\windows\start menu\programs\startup\pdf.vbs") in Source: 00000000-00003396.00000001.91228.02A90000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003720.00000000.66801.00E00000.00000004.mdmp 00000000-00003720.00000001.67816.00E00000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003720.00000000.66801.00E00000.00000004.mdmp 00000000-00003720.00000001.67816.00E00000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003720.00000000.66801.00E00000.00000004.mdmp 00000000-00003720.00000001.67816.00E00000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003720.00000000.66801.00E00000.00000004.mdmp 00000000-00003720.00000001.67816.00E00000.00000004.mdmp3b:T1618,"Software\IncrediMail\Identities\" in Source: 00003064.00000BF8.19231311.00402000.wprm "Software\Qualcomm\Eudora\CommandLine\" in Source: 00003064.00000BF8.19231311.00402000.wprm "SOFTWARE\FTPWare\COREFTP\Sites" in Source: 00003064.00000BF8.19231311.00402000.wprm "CURRENT_USER\Software\RimArts\B2\Settings" in Source: 00003064.00000BF8.19231311.00402000.wprm "HKEY_CURRENT_USER\Software\Aerofox\FoxmailPreview" in Source: 00003064.00000BF8.19231311.00402000.wprm "Opera Software\Opera Stable" in Source: 00003064.00000BF8.19231311.00402000.wprm "\REGISTRY\MACHINE\SOFTWARE\Classes\W" in Source: 00000000-00003124.00000000.73877.00190000.00000004.mdmp 00000000-00003124.00000001.75104.001E0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BE33A527-42FE-43A4-AC5E-C1D059FC705F}" in Source: 00000000-00003124.00000000.73877.00190000.00000004.mdmp 00000000-00003124.00000001.75104.0020A000.00000004.mdmp "GISTRY\MACHINE\SOFTWARE\Classes\W" in Source: 00000000-00003124.00000000.73877.00190000.00000004.mdmp 00000000-00003124.00000001.75104.0020A000.00000004.mdmp "HINE\SOFTWARE\Classes\Wow6432Node\C9" in Source: 00000000-00003124.00000000.73877.00190000.00000004.mdmp "SOFTWARE\Classes\CLSID\{BE33A527-42FE-43A4-AC5E-C1D059FC705F}" in Source: 00000000-00003124.00000000.73877.00190000.00000004.mdmp 00000000-00003124.00000001.75104.0020A000.00000004.mdmp "MACHINE\SOFTWARE\Classes\CLSID" in Source: 00000000-00003124.00000001.75104.0020A000.00000004.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00003124.00000001.75104.FF4B1000.00000020.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003396.00000000.90310.007E0000.00000004.mdmp 00000000-00003396.00000001.91228.007E0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003396.00000000.90310.007E0000.00000004.mdmp 00000000-00003396.00000001.91228.007E0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00003396.00000000.90310.007E0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003396.00000000.90310.007E0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003396.00000000.90310.007E0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00003396.00000000.90310.02A90000.00000004.mdmp 00000000-00003396.00000001.91228.02A90000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00003396.00000000.90310.02A90000.00000004.mdmp 00000000-00003396.00000001.91228.02A90000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00003396.00000000.90310.02A90000.00000004.mdmp 00000000-00003396.00000001.91228.02A90000.00000004.mdmp "cmd.Software\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00003396.00000000.90310.02A90000.00000004.mdmp 00000000-00003396.00000001.91228.02A90000.00000004.mdmp "KEY_CURRENT_USER\Software\RimArts\B2\Settings" in Source: 00000000-00003396.00000001.91228.02A90000.00000004.mdmp 00000000-00003396.00000001.91228.03A90000.00000004.mdmp "KEY_CURRENT_USER\Software\Aerofox\FoxmailPreview" in Source: 00000000-00003396.00000001.91228.02A90000.00000004.mdmp 00000000-00003396.00000001.91228.03A90000.00000004.mdmp "KEY_CURRENT_USER\Software\Aerofox\Foxmail\V3.1" in Source: 00000000-00003396.00000001.91228.02A90000.00000004.mdmp 00000000-00003396.00000001.91228.03A90000.00000004.mdmp "pera Software\Opera Stable" in Source: 00000000-00003396.00000001.91228.02A90000.00000004.mdmp 00000000-00003396.00000001.91228.03A90000.00000004.mdmp "raveSoftware\Brave-Browser\User Data" in Source: 00000000-00003396.00000001.91228.02A90000.00000004.mdmp 00000000-00003396.00000001.91228.03A90000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003720.00000000.66801.00E00000.00000004.mdmp 00000000-00003720.00000001.67816.00E00000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003720.00000000.66801.00E00000.00000004.mdmp 00000000-00003720.00000001.67816.00E00000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003720.00000000.66801.00E00000.00000004.mdmp 00000000-00003720.00000001.67816.00E00000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003720.00000000.66801.00E00000.00000004.mdmp 00000000-00003720.00000001.67816.00E00000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00003720.00000000.66801.028E0000.00000004.mdmp 00000000-00003720.00000001.67816.028E0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00003720.00000000.66801.028E0000.00000004.mdmp 00000000-00003720.00000001.67816.028E0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00003720.00000000.66801.028E0000.00000004.mdmp 00000000-00003720.00000001.67816.028E0000.00000004.mdmp "cmd.Software\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00003720.00000000.66801.028E0000.00000004.mdmp 00000000-00003720.00000001.67816.028E0000.00000004.mdmp3c:T1d36,"Purchaseorder.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "Purchaseorder.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "Purchaseorder.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "Purchaseorder.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "Purchaseorder.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "Purchaseorder.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "Purchaseorder.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "Purchaseorder.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "Purchaseorder.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "Purchaseorder.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "Purchaseorder.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "Purchaseorder.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "Purchaseorder.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "Purchaseorder.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "cmd.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "cmd.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\vaultcli.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "pdf.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "pdf.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "pdf.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "pdf.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "pdf.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "pdf.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "pdf.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "pdf.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "pdf.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "pdf.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "pdf.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "pdf.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "pdf.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "pdf.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "ipconfig.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "ipconfig.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135]3d:Ted0,"GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 27 Nov 2023 14:11:19 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1767 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 27 Nov 2023 13:50:19 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3028 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 27 Nov 2023 14:09:13 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1895 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 27 Nov 2023 13:56:25 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2663 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 27 Nov 2023 13:58:51 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2519 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEEYEdcdvM%2B0BEMsDuQBqQWU%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 27 Nov 2023 14:07:23 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2008 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32.......3e:T78f9,"Purchaseorder.exe" loaded module "GDI32.DLL" at base 759e0000 "Purchaseorder.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 76c60000 "Purchaseorder.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 751e0000 "Purchaseorder.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "Purchaseorder.exe" loaded module "KERNEL32" at base 76cc0000 "Purchaseorder.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "Purchaseorder.exe" loaded module "ADVAPI32.DLL" at base 75930000 "Purchaseorder.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 73b20000 "Purchaseorder.exe" loaded module "SHLWAPI.DLL" at base 76f60000 "Purchaseorder.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "Purchaseorder.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "Purchaseorder.exe" loaded module "VERSION.DLL" at base 74f90000 "Purchaseorder.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 73370000 "Purchaseorder.exe" loaded module "USER32.DLL" at base 76ad0000 "Purchaseorder.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "Purchaseorder.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "Purchaseorder.exe" loaded module "MSCOREE.DLL" at base 73db0000 "Purchaseorder.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "Purchaseorder.exe" loaded module "PSAPI.DLL" at base 77640000 "Purchaseorder.exe" loaded module "KERNEL32.DLL" at base 76cc0000 "Purchaseorder.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 71eb0000 "Purchaseorder.exe" loaded module "RPCRT4.DLL" at base 76730000 "Purchaseorder.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "Purchaseorder.exe" loaded module "OLE32.DLL" at base 774e0000 "Purchaseorder.exe" loaded module "CRYPTBASE.DLL" at base 75470000 "Purchaseorder.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 71ea0000 "Purchaseorder.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 71e10000 "Purchaseorder.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 713b0000 "Purchaseorder.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 70b90000 "Purchaseorder.exe" loaded module "AMSI.DLL" at base 0 "Purchaseorder.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 70b70000 "Purchaseorder.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "Purchaseorder.exe" loaded module "BCRYPT.DLL" at base 70b50000 "Purchaseorder.exe" loaded module "CRYPTSP.DLL" at base 74a90000 "Purchaseorder.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74770000 "Purchaseorder.exe" loaded module "SHELL32.DLL" at base 75ae0000 "Purchaseorder.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75910000 "Purchaseorder.exe" loaded module "PROFAPI.DLL" at base 75a70000 "Purchaseorder.exe" loaded module "ADVAPI32" at base 75930000 "Purchaseorder.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 703d0000 "Purchaseorder.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74ce0000 "Purchaseorder.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "Purchaseorder.exe" loaded module "PROPSYS.DLL" at base 74b60000 "Purchaseorder.exe" loaded module "COMCTL32.DLL" at base 74db0000 "Purchaseorder.exe" loaded module "OLEAUT32.DLL" at base 76ec0000 "Purchaseorder.exe" loaded module "APPHELP.DLL" at base 74ae0000 "Purchaseorder.exe" loaded module "CLBCATQ.DLL" at base 76bd0000 "Purchaseorder.exe" loaded module "%WINDIR%\SYSWOW64\IEFRAME.DLL" at base 6f6b0000 "Purchaseorder.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76cc0000 "Purchaseorder.exe" loaded module "SETUPAPI.DLL" at base 754e0000 "Purchaseorder.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74b60000 "Purchaseorder.exe" loaded module "NTMARTA.DLL" at base 74b30000 "Purchaseorder.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 76970000 "Purchaseorder.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 76980000 "Purchaseorder.exe" loaded module "SECUR32.DLL" at base 746e0000 "Purchaseorder.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 76e80000 "Purchaseorder.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74ae0000 "Purchaseorder.exe" loaded module "%WINDIR%\SYSWOW64\IEFRAME.DLL" at base 6e990000 "Purchaseorder.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 70200000 "Purchaseorder.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 6f390000 "Purchaseorder.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "Purchaseorder.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "Purchaseorder.exe" loaded module "NTDLL.DLL" at base 77be0000 "Purchaseorder.exe" loaded module "%WINDIR%\SYSWOW64\IEFRAME.DLL" at base 6e670000 "Purchaseorder.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "Purchaseorder.exe" loaded module "NTDLL" at base 77be0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 76cc0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74ae0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74ce0000 "powershell.exe" loaded module "CLBCATQ.DLL" at base 76bd0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75ae0000 "powershell.exe" loaded module "OLE32.DLL" at base 774e0000 "powershell.exe" loaded module "USERENV.DLL" at base 777c0000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75910000 "powershell.exe" loaded module "COMCTL32.DLL" at base 74db0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 75930000 "powershell.exe" loaded module "KERNEL32.DLL" at base 76cc0000 "powershell.exe" loaded module "SHELL32.DLL" at base 75ae0000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 76ec0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74b60000 "powershell.exe" loaded module "NTMARTA.DLL" at base 74b30000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76cc0000 "powershell.exe" loaded module "SETUPAPI.DLL" at base 754e0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 76730000 "powershell.exe" loaded module "APPHELP.DLL" at base 74ae0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 746f0000 "powershell.exe" loaded module "PROPSYS.DLL" at base 74b60000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75ae0000 "powershell.exe" loaded module "LINKINFO.DLL" at base 6f370000 "powershell.exe" loaded module "PROFAPI.DLL" at base 75a70000 "powershell.exe" loaded module "USER32.DLL" at base 76ad0000 "powershell.exe" loaded module "NTSHRUI.DLL" at base 74840000 "powershell.exe" loaded module "SRVCLI.DLL" at base 74900000 "powershell.exe" loaded module "CSCAPI.DLL" at base 748f0000 "powershell.exe" loaded module "SLC.DLL" at base 748e0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 76f60000 "powershell.exe" loaded module "CRYPTSP.DLL" at base 74a90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74770000 "powershell.exe" loaded module "CRYPTBASE.DLL" at base 75470000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 751e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "powershell.exe" loaded module "KERNEL32" at base 76cc0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 73b20000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "VERSION.DLL" at base 74f90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL" at base 6edc0000 "powershell.exe" loaded module "MSCOREE.DLL" at base 73db0000 "powershell.exe" loaded module "NTDLL" at base 77be0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 73db0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\199DD46435D7FDBBE590CCCD8C8AE9CB\MSCORLIB.NI.DLL" at base 6e220000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\OLE32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\F3E2031575563C54B4BAB372BBE1453F\SYSTEM.NI.DLL" at base 6da70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\07B924D7E3B2E6344530AAA8514942AA\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 6d9e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT.A#\BB568276B4A8B4D6F64D115294DD5C3D\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 6ce70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "PSAPI.DLL" at base 77640000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 77be0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CORE\8B5F9B59ED667A576D891EEE157BF212\SYSTEM.CORE.NI.DLL" at base 6cc30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\E17FD2E5FAC93D8B9613BD5762BBD647\MICROSOFT.POWERSHELL.COMMANDS.DIAGNOSTICS.NI.DLL" at base 6cbe0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATIO#\4342ED1AAD046AA5EA9BB72BFBE99B8C\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 6cbb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.WSMAN.MAN#\E0652E0803F7A46306920B8043D23F52\MICROSOFT.WSMAN.MANAGEMENT.NI.DLL" at base 6cb20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.TRANSACTIONS\CEDBDD073E0BCAD91DBC5DDD921FFCA0\SYSTEM.TRANSACTIONS.NI.DLL" at base 6ca70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\2.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6ca20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\E4FC372B5FF973EEAC3DD6DAC72E36B2\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 6c880000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\83076F46A06276B5A16EF0BC246D1BEE\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 6c750000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\5509072E130E13708F7DCB8B5B527665\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 6c850000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL" at base 6c740000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\BD2E0A351B1495ED6E0F5EB45BA9F3FE\SYSTEM.XML.NI.DLL" at base 6c210000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT\48155C7263CE0528F367ED4B3015CDC4\SYSTEM.MANAGEMENT.NI.DLL" at base 6c100000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DIRECTORYSER#\421EA4F1BCF6E3989B521D744A5B4A8F\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 6bfe0000 "powershell.exe" loaded module "SHFOLDER.DLL" at base 6bfd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 746e0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 75480000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DATA\5091F8E36728E57DCDFD74B464281728\SYSTEM.DATA.NI.DLL" at base 734c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.DATA\2.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 731e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL" at base 72900000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\IEFRAME.DLL" at base 71be0000 "powershell.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 77700000 "powershell.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 76970000 "powershell.exe" loaded module "URLMON.DLL" at base 76980000 "powershell.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 748c0000 "powershell.exe" loaded module "%PROGRAMFILES%\(X86)\INTERNET EXPLORER\IEPROXY.DLL" at base 741a0000 "powershell.exe" loaded module "IERTUTIL.DLL" at base 75680000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74ae0000 "powershell.exe" loaded module "NETUTILS.DLL" at base 748d0000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 751e0000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "cmd.exe" loaded module "KERNEL32" at base 76cc0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "ipconfig.exe" loaded module "DHCPCSVC.DLL" at base 750c0000 "ipconfig.exe" loaded module "IPHLPAPI.DLL" at base 74d70000 "RegAsm.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 751e0000 "RegAsm.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "RegAsm.exe" loaded module "KERNEL32" at base 76cc0000 "RegAsm.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72a30000 "RegAsm.exe" loaded module "USER32.DLL" at base 76ad0000 "RegAsm.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "RegAsm.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "RegAsm.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "RegAsm.exe" loaded module "MSCOREE.DLL" at base 73db0000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "RegAsm.exe" loaded module "PSAPI.DLL" at base 77640000 "RegAsm.exe" loaded module "RPCRT4.DLL" at base 76730000 "RegAsm.exe" loaded module "KERNEL32.DLL" at base 76cc0000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 707d0000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "RegAsm.exe" loaded module "OLE32.DLL" at base 774e0000 "RegAsm.exe" loaded module "CRYPTBASE.DLL" at base 75470000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74ce0000 "RegAsm.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 73ee0000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 72870000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 71e10000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 71c60000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 6f540000 "RegAsm.exe" loaded module "ADVAPI32.DLL" at base 75930000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 71c40000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 73300000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 731f0000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6edc0000 "RegAsm.exe" loaded module "NTDLL.DLL" at base 77be0000 "RegAsm.exe" loaded module "SHELL32.DLL" at base 75ae0000 "RegAsm.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75910000 "RegAsm.exe" loaded module "PROFAPI.DLL" at base 75a70000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "RegAsm.exe" loaded module "BCRYPT.DLL" at base 72940000 "RegAsm.exe" loaded module "CRYPTSP.DLL" at base 74a90000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74770000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 6cb10000 "RegAsm.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75910000 "RegAsm.exe" loaded module "CLBCATQ.DLL" at base 76bd0000 "RegAsm.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76cc0000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 72910000 "RegAsm.exe" loaded module "RPCRTREMOTE.DLL" at base 74a80000 "RegAsm.exe" loaded module "OLEAUT32.DLL" at base 76ec0000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 72900000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 6c600000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 71be0000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6c340000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "RegAsm.exe" loaded module "SSPICLI.DLL" at base 75480000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VAULTCLI.DLL" at base 0 "RegAsm.exe" loaded module "VAULTCLI.DLL" at base 75060000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "RegAsm.exe" loaded module "VERSION.DLL" at base 74f90000 "RegAsm.exe" loaded module "IMM32.DLL" at base 76c60000 "RegAsm.exe" loaded module "COMCTL32.DLL" at base 6c690000 "RegAsm.exe" loaded module "GDI32.DLL" at base 759e0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base fbc90000 "WScript.exe" loaded module "RPCRT4.DLL" at base ffa20000 "WScript.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base ffb50000 "WScript.exe" loaded module "ADVAPI32.DLL" at base fe120000 "WScript.exe" loaded module "KERNEL32.DLL" at base 778e0000 "WScript.exe" loaded module "SXS.DLL" at base fd560000 "WScript.exe" loaded module "DWMAPI.DLL" at base fb810000 "WScript.exe" loaded module "CLBCATQ.DLL" at base fdb90000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VBSCRIPT.DLL" at base f0d30000 "WScript.exe" loaded module "OLE32.DLL" at base ff820000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base fe120000 "WScript.exe" loaded module "WINTRUST.DLL" at base fda60000 "WScript.exe" loaded module "CRYPTSP.DLL" at base fcee0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base fcbe0000 "WScript.exe" loaded module "CRYPTBASE.DLL" at base fd550000 "WScript.exe" loaded module "MSISIP.DLL" at base f5b90000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base fd7d0000 "WScript.exe" loaded module "IMM32.DLL" at base fdc30000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base f5440000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base f0f20000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base f5280000 "WScript.exe" loaded module "SHELL32.DLL" at base fe490000 "WScript.exe" loaded module "PROPSYS.DLL" at base fbe20000 "WScript.exe" loaded module "COMCTL32.DLL" at base fc140000 "WScript.exe" loaded module "OLEAUT32.DLL" at base fdab0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base fbe20000 "WScript.exe" loaded module "NTMARTA.DLL" at base fc110000 "WScript.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base ffb50000 "WScript.exe" loaded module "PROFAPI.DLL" at base fd700000 "WScript.exe" loaded module "APPHELP.DLL" at base fd4f0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base f6ae0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base fe490000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 778e0000 "WScript.exe" loaded module "SETUPAPI.DLL" at base 40c0000 "WScript.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base fda50000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base ffb80000 "WScript.exe" loaded module "SECUR32.DLL" at base fd220000 "WScript.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base fd760000 "WScript.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base f93d0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base fd4f0000 "pdf.exe" loaded module "GDI32.DLL" at base 759e0000 "pdf.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 76c60000 "pdf.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 751e0000 "pdf.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "pdf.exe" loaded module "KERNEL32" at base 76cc0000 "pdf.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "pdf.exe" loaded module "ADVAPI32.DLL" at base 75930000 "pdf.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 735d0000 "pdf.exe" loaded module "SHLWAPI.DLL" at base 76f60000 "pdf.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "pdf.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "pdf.exe" loaded module "VERSION.DLL" at base 74f90000 "pdf.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 71920000 "pdf.exe" loaded module "USER32.DLL" at base 76ad0000 "pdf.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "pdf.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "pdf.exe" loaded module "MSCOREE.DLL" at base 73700000 "pdf.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "pdf.exe" loaded module "KERNEL32.DLL" at base 76cc0000 "pdf.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 6f300000 "pdf.exe" loaded module "RPCRT4.DLL" at base 76730000 "pdf.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "pdf.exe" loaded module "OLE32.DLL" at base 774e0000 "pdf.exe" loaded module "CRYPTBASE.DLL" at base 75470000 "pdf.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 734f0000 "pdf.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 72bf0000 "pdf.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 70ec0000 "pdf.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6eae0000 "pdf.exe" loaded module "AMSI.DLL" at base 0 "pdf.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 734d0000 "pdf.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "pdf.exe" loaded module "BCRYPT.DLL" at base 72940000 "pdf.exe" loaded module "CRYPTSP.DLL" at base 74a90000 "pdf.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74770000 "pdf.exe" loaded module "SHELL32.DLL" at base 75ae0000 "pdf.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75910000 "pdf.exe" loaded module "PROFAPI.DLL" at base 75a70000 "pdf.exe" loaded module "ADVAPI32" at base 75930000 "pdf.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6e360000 "pdf.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74ce0000 "pdf.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "pdf.exe" loaded module "PROPSYS.DLL" at base 74b60000 "pdf.exe" loaded module "COMCTL32.DLL" at base 74db0000 "pdf.exe" loaded module "OLEAUT32.DLL" at base 76ec0000 "pdf.exe" loaded module "APPHELP.DLL" at base 74ae0000 "pdf.exe" loaded module "CLBCATQ.DLL" at base 76bd0000 "pdf.exe" loaded module "%WINDIR%\SYSWOW64\IEFRAME.DLL" at base 6d640000 "pdf.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76cc0000 "pdf.exe" loaded module "SETUPAPI.DLL" at base 754e0000 "pdf.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74b60000 "pdf.exe" loaded module "NTMARTA.DLL" at base 74b30000 "pdf.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 76970000 "pdf.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 76980000 "pdf.exe" loaded module "SECUR32.DLL" at base 746e0000 "pdf.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 76e80000 "pdf.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74ae0000 "pdf.exe" loaded module "%WINDIR%\SYSWOW64\IEFRAME.DLL" at base 6c920000 "pdf.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 72a40000 "pdf.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 6d4f0000 "pdf.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "pdf.exe" loaded module "PSAPI.DLL" at base 77640000 "pdf.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "pdf.exe" loaded module "NTDLL.DLL" at base 77be0000 "pdf.exe" loaded module "%WINDIR%\SYSWOW64\IEFRAME.DLL" at base 6c7d0000 "pdf.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "pdf.exe" loaded module "NTDLL" at base 77be0000 "ipconfig.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 751e0000 "ipconfig.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "ipconfig.exe" loaded module "KERNEL32" at base 76cc0000 "ipconfig.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "ipconfig.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73660000 "ipconfig.exe" loaded module "KERNEL32.DLL" at base 76cc0000 "ipconfig.exe" loaded module "DHCPCSVC6.DLL" at base 750b0000 "ipconfig.exe" loaded module "RPCRT4.DLL" at base 76730000 "powershell.exe" loaded module "LINKINFO.DLL" at base 72a20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 735d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL" at base 70910000 "powershell.exe" loaded module "MSCOREE.DLL" at base 73700000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 73700000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\199DD46435D7FDBBE590CCCD8C8AE9CB\MSCORLIB.NI.DLL" at base 6c9f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\F3E2031575563C54B4BAB372BBE1453F\SYSTEM.NI.DLL" at base 6b8c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\07B924D7E3B2E6344530AAA8514942AA\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 70820000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT.A#\BB568276B4A8B4D6F64D115294DD5C3D\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 6b040000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CORE\8B5F9B59ED667A576D891EEE157BF212\SYSTEM.CORE.NI.DLL" at base 72a40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\E17FD2E5FAC93D8B9613BD5762BBD647\MICROSOFT.POWERSHELL.COMMANDS.DIAGNOSTICS.NI.DLL" at base 73580000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATIO#\4342ED1AAD046AA5EA9BB72BFBE99B8C\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 71f40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.WSMAN.MAN#\E0652E0803F7A46306920B8043D23F52\MICROSOFT.WSMAN.MANAGEMENT.NI.DLL" at base 71eb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.TRANSACTIONS\CEDBDD073E0BCAD91DBC5DDD921FFCA0\SYSTEM.TRANSACTIONS.NI.DLL" at base 71e10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\2.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 71dc0000 "RegAsm.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73660000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 735d0000 "RegAsm.exe" loaded module "SHLWAPI.DLL" at base 76f600003f:T4b7,"150016003ccac3732cf07b000efdc173@ADVAPI32.dll" "0e000f00eccac3732cf07b000efdc173@ADVAPI32.dll" "0e000f0048cbc3732cf07b000efdc173@ADVAPI32.dll" "1100120024d3c3732cf07b000efdc173@ADVAPI32.dll" "11001200c0d3c3732cf07b000efdc173@ADVAPI32.dll" "1200130004d4c3732cf07b000efdc173@ADVAPI32.dll" "120013005cd4c3732cf07b000efdc173@ADVAPI32.dll" "14001500ecf3c3732cf07b000efdc173@ADVAPI32.dll" "1400150004f4c3732cf07b000efdc173@ADVAPI32.dll" "140015001cf4c3732cf07b000efdc173@ADVAPI32.dll" "1700180034f4c3732cf07b000efdc173@ADVAPI32.dll" "0d000e004cf4c3732cf07b000efdc173@ADVAPI32.dll" "0f00100078f5c3732cf07b000efdc173@ADVAPI32.dll" "14001500b8f5c3732cf07b000efdc173@ADVAPI32.dll" "14001500d0f5c3732cf07b000efdc173@ADVAPI32.dll" "0c000d0018f6c3732cf07b000efdc173@ADVAPI32.dll" "0c000d0028f6c3732cf07b000efdc173@ADVAPI32.dll" "0e000f0038f6c3732cf07b000efdc173@ADVAPI32.dll" "18001900a0f7c3732cf07b000efdc173@RPCRT4.dll" "13001400ccf7c3732cf07b000efdc173@RPCRT4.dll" "14001500e0f7c3732cf07b000efdc173@RPCRT4.dll" "16001700f8f7c3732cf07b000efdc173@RPCRT4.dll" "0b000c005cf0c3732cf07b000efdc173@WS2_32.dll" "12001300c4ccae76c0e47b0031c5c073@IMM32.DLL" "18001900a8ccae76c0e47b0031c5c073@IMM32.DLL"40:T1871,"Purchaseorder.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "Purchaseorder.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "Purchaseorder.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "Purchaseorder.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "Purchaseorder.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "Purchaseorder.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "Purchaseorder.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "Purchaseorder.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "Purchaseorder.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "Purchaseorder.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "Purchaseorder.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "Purchaseorder.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "Purchaseorder.exe" touched "Other Users Folder" (Path: "HKCU\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "Purchaseorder.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "Purchaseorder.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "Purchaseorder.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "Purchaseorder.exe" touched "Games Explorer" (Path: "HKCU\WOW6432NODE\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "Purchaseorder.exe" touched "Computers and Devices" (Path: "HKCU\WOW6432NODE\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "Purchaseorder.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "Purchaseorder.exe" touched "Security Manager" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}") "powershell.exe" touched "Custom Destination List" (Path: "HKCU\WOW6432NODE\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}") "powershell.exe" touched "Start Menu Cache" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}") "powershell.exe" touched "Start Menu Pin" (Path: "HKCU\WOW6432NODE\CLSID\{A2A9545D-A0C2-42B4-9708-A0B2BADD77C8}\TREATAS") "powershell.exe" touched "Taskband Pin" (Path: "HKCU\WOW6432NODE\CLSID\{90AA3A4E-1CBA-4233-B8BB-535773D48449}\TREATAS") "powershell.exe" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "Internet Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "User Pinned" (Path: "HKCU\WOW6432NODE\CLSID\{1F3427C8-5C10-4210-AA03-2EE45287D668}\SHELLFOLDER") "powershell.exe" touched "Shell File System Folder" (Path: "HKCU\WOW6432NODE\CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837}\INPROCSERVER32") "powershell.exe" touched "User Assist" (Path: "HKCU\WOW6432NODE\CLSID\{DD313E04-FEFF-11D1-8ECD-0000F87A470C}\TREATAS") "powershell.exe" touched "Shared Task Scheduler" (Path: "HKCU\WOW6432NODE\CLSID\{603D3801-BD81-11D0-A3A5-00C04FD706EC}\TREATAS") "powershell.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\WOW6432NODE\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "powershell.exe" touched "Application Registration" (Path: "HKCU\WOW6432NODE\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\TREATAS") "RegAsm.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "RegAsm.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}") "RegAsm.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}") "RegAsm.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "RegAsm.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "RegAsm.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "RegAsm.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "RegAsm.exe" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "WScript.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "WScript.exe" touched "VB Script Language" (Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\TREATAS") "WScript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\TREATAS") "WScript.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS")41:Tb1b,"Purchase order.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "pdf.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "DISMHOST.EXE.6564B0AF.bin" file has an entrypoint instructions - "sub rsp, 0x28,call 0x10000fcc0,add rsp, 0x28,jmp 0x10000f0b8,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],cmp rcx, qword ptr [rip + 0x6da9],jne 0x10000f40b,rol rcx, 0x10,test cx, 0xffff,jne 0x10000f407,ret 0,ror rcx, 0x10,jmp 0x10000fd7c,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x10], rbx,mov dword ptr [rsp + 0x18], r8d,mov qword ptr [rsp + 8], rcx,push rsi,push rdi,push r12,sub rsp, 0x40,"42:T8a6,Observed system executable string:"/C:\ PROGRA~3 MICROS~1 WindowsSTARTM~1:((*ProgramsACCESS~1WINDOW~1:''*WINDOW~2.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPSyry8ovkyog/C:\ PROGRA~3 MICROS~1 WindowsSTARTM~1:((*ProgramsACCESS~1WINDOW~1:''*WINDOW~2.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPSyry8ovkyog/C:\WindowsSystem32WINDOW~1v1.0>;B*powershell_ise.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exe1SPS1SPSyry8ovkyog/C:\Windowshh.exeC:\Windows\hh.exe%systemroot%\hh.exe1SPS1SPSyry8ovkyog" [Source: AD05CI7MFTFLU5ILR9M4.temp] Observed system executable string:"%WINDIR%\System32\cmd.exe" [Source: 00000000-00003720-00000C41-13236526693] Observed system executable string:""%WINDIR%\System32\cmd.exe" /c ipconfig /release" [Source: 00000000-00003720-00000C41-13236526693] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00003720-00000C41-30637668282] Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACcAaAB0AHQAcABzADoALwAvAGcAb" [Source: 00000000-00003720-00000C41-30637668282] Observed system executable string:""%WINDIR%\System32\cmd.exe" /c ipconfig /renew" [Source: 00000000-00003720-00000C41-34694502971] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" [Source: 00000000-00003720-00000C40-49047880765] Observed system executable string:"%WINDIR%\system32\ipconfig.exe" [Source: 00000000-00002676-00000C41-1219823168] Observed system executable string:"%WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe" [Source: 00000000-00002556-00000C28-10547581913] Observed system executable string:"%WINDIR%\System32\WScript.exe" [Source: 00000000-00000476-00000C25-409625755]43:T956,Process "cmd.exe" (UID: 00000000-00002676) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "cmd.exe" (UID: 00000000-00002676) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "ipconfig.exe" (UID: 00000000-00002600) was launched with new environment variables: "PROMPT="$P$G"" Process "powershell.exe" (UID: 00000000-00002556) was launched with modified environment variables: "Path" Process "powershell.exe" (UID: 00000000-00002556) was launched with missing environment variables: "PROMPT" Process "cmd.exe" (UID: 00000000-00002632) was launched with modified environment variables: "Path" Process "ipconfig.exe" (UID: 00000000-00002584) was launched with new environment variables: "PROMPT="$P$G"" Process "RegAsm.exe" (UID: 00000000-00004724) was launched with missing environment variables: "PROMPT" Process "iexplore.exe" (UID: 00000000-00004764) was launched with modified environment variables: "PSModulePath, Path" Process "IEXPLORE.EXE" (UID: 00000000-00000676) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "IEXPLORE.EXE" (UID: 00000000-00000676) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "WScript.exe" (UID: 00000000-00000476) was launched with new environment variables: "PROMPT="$P$G", PROCESSOR_ARCHITEW6432="AMD64"" Process "WScript.exe" (UID: 00000000-00000476) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, PSModulePath, CommonProgramFiles, Path, ProgramFiles" Process "pdf.exe" (UID: 00000000-00003396) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "pdf.exe" (UID: 00000000-00003396) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "cmd.exe" (UID: 00000000-00001524) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "cmd.exe" (UID: 00000000-00001524) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "powershell.exe" (UID: 00000000-00001712) was launched with modified environment variables: "Path" Process "cmd.exe" (UID: 00000000-00004896) was launched with modified environment variables: "Path"44:T664,"Purchaseorder.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Purchaseorder.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Purchaseorder.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "Purchaseorder.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "Purchaseorder.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "Purchaseorder.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "ipconfig.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "ipconfig.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "ipconfig.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "ipconfig.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH")45:T63f,file/memory contains long string with (Indicator: "text/javascript"; File: "cb_gapi_1_.js") file/memory contains long string with (Indicator: "text/javascript"; File: "urlref_httpsgoogle.com") file/memory contains long string with (Indicator: "text/javascript"; File: "LVCOIIX2.htm") Found string "" (Indicator: "text/javascript"; File: "8XO85FLH.htm") Found string "" (Indicator: "text/javascript"; File: "8XO85FLH.htm") Found string "" (Indicator: "text/javascript"; File: "8XO85FLH.htm") Found string "" (Indicator: "text/javascript"; File: "8XO85FLH.htm")46:Tee5,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00004724.00001274.20613430.00070000.wprm] Observed system executable string:"%WINDIR%\system32\IMM32.DLL" [Source: 00000000-00003720-00000C25-45855234] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00003720-00000C25-46099972] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00003720-00000C25-46221767] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00003720-00000C25-46484575] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00003720-00000C25-46529895] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00003720-00000C25-46651380] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00003720-00000C25-46719953] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00003720-00000C25-46865382] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00003720-00000C25-47222954] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00003720-00000C25-47280929] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00003720-00000C25-47396718] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00003720-00000C25-47410386] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00003720-00000C25-47542083] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00003720-00000C25-47609135] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00003720-00000C25-47655986] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00003720-00000C25-48624859] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00003720-00000C25-48786111] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00003720-00000C25-48850534] Observed system executable string:"%WINDIR%\SysWOW64\ieframe.dll" [Source: 00000000-00003720-00000C25-49364075] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00003720-00000C25-58578682] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00003720-00000C25-58701335] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00003720-00000C25-58996810] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00003720-00000C25-59321648] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00003720-00000C25-65474891]47:T60c,Spawned process "cmd.exe" with commandline "/c ipconfig /release" (UID: 00000000-00002676) Spawned process "ipconfig.exe" with commandline "ipconfig /release" (UID: 00000000-00002600) Spawned process "powershell.exe" with commandline "-enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACcAaAB0AHQAcABzADoALwA ..." (UID: 00000000-00002556) Spawned process "cmd.exe" with commandline "/c ipconfig /renew" (UID: 00000000-00002632) Spawned process "ipconfig.exe" with commandline "ipconfig /renew" (UID: 00000000-00002584) Spawned process "RegAsm.exe" (UID: 00000000-00004724) Spawned process "iexplore.exe" with commandline "https://google.com/" (UID: 00000000-00004764) Spawned process "IEXPLORE.EXE" with commandline "SCODEF:4764 CREDAT:275457 /prefetch:2" (UID: 00000000-00000676) Spawned process "WScript.exe" with commandline ""%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\p ..." (UID: 00000000-00000476), Spawned process "pdf.exe" (UID: 00000000-00003396), Spawned process "cmd.exe" with commandline "/c ipconfig /release" (UID: 00000000-00001524), Spawned process "ipconfig.exe" with commandline "ipconfig /release" (UID: 00000000-00004312), Spawned process "powershell.exe" with commandline "-enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACcAaAB0AHQAcABzADoALwA ..." (UID: 00000000-00001712), Spawned process "cmd.exe" with commandline "/c ipconfig /renew" (UID: 00000000-00004896), Spawned process "ipconfig.exe" with commandline "ipconfig /renew" (UID: 00000000-00002892), Spawned process "RegAsm.exe" (UID: 00000000-00003064)48:T60c,Spawned process "cmd.exe" with commandline "/c ipconfig /release" (UID: 00000000-00002676) Spawned process "ipconfig.exe" with commandline "ipconfig /release" (UID: 00000000-00002600) Spawned process "powershell.exe" with commandline "-enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACcAaAB0AHQAcABzADoALwA ..." (UID: 00000000-00002556) Spawned process "cmd.exe" with commandline "/c ipconfig /renew" (UID: 00000000-00002632) Spawned process "ipconfig.exe" with commandline "ipconfig /renew" (UID: 00000000-00002584) Spawned process "RegAsm.exe" (UID: 00000000-00004724) Spawned process "iexplore.exe" with commandline "https://google.com/" (UID: 00000000-00004764) Spawned process "IEXPLORE.EXE" with commandline "SCODEF:4764 CREDAT:275457 /prefetch:2" (UID: 00000000-00000676) Spawned process "WScript.exe" with commandline ""%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\p ..." (UID: 00000000-00000476), Spawned process "pdf.exe" (UID: 00000000-00003396), Spawned process "cmd.exe" with commandline "/c ipconfig /release" (UID: 00000000-00001524), Spawned process "ipconfig.exe" with commandline "ipconfig /release" (UID: 00000000-00004312), Spawned process "powershell.exe" with commandline "-enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACcAaAB0AHQAcABzADoALwA ..." (UID: 00000000-00001712), Spawned process "cmd.exe" with commandline "/c ipconfig /renew" (UID: 00000000-00004896), Spawned process "ipconfig.exe" with commandline "ipconfig /renew" (UID: 00000000-00002892), Spawned process "RegAsm.exe" (UID: 00000000-00003064)49:T3af3,"pdf.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%USERPROFILE%\Documents\pdf.exe]- [targetUID: 00000000-00000476] "urlref_httpsgoogle.com" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "pdf.vbs.bin" has type "ASCII text with no line terminators"- [targetUID: N/A] "pdf.vbs" has type "ASCII text with no line terminators"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs]- [targetUID: 00000000-00000476] "urlblockindex_1_.bin" has type "data"- [targetUID: N/A] "QWAU72M2.js" has type "ASCII text with very long lines"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\2M2KC0IU\QWAU72M2.js]- [targetUID: 00000000-00000676] "LVCOIIX2.htm" has type "HTML document ASCII text with very long lines"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\OX8EQCT0\LVCOIIX2.htm]- [targetUID: 00000000-00000676] "dism.log" has type "data"- [targetUID: N/A] "8XO85FLH.htm" has type "HTML document UTF-8 Unicode text with very long lines with CRLF NEL line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\4KBMQIHU\8XO85FLH.htm]- [targetUID: 00000000-00004764] "m__b__tp_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "Tar6567.tmp" has type "data"- Location: [%TEMP%\Tar6567.tmp]- [targetUID: 00000000-00004764] "cb_gapi_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "DISMHOST.EXE.6564B0AF.bin" has type "PE32+ executable (GUI) x86-64 for MS Windows"- [targetUID: N/A] "77EC63BDA74BD0D0E0426DC8F8008506" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00004764] "Cab6566.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\Cab6566.tmp]- [targetUID: 00000000-00004764] "callout_1_.htm" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "4UabrENHsxJlGDuGo1OIlLU94YtzCwA_1_.woff" has type "Web Open Font Format TrueType length 26412 version 1.1"- [targetUID: N/A] "~DFE6F1230D7CE3B2CA.TMP" has type "data"- Location: [%TEMP%\~DFE6F1230D7CE3B2CA.TMP]- [targetUID: 00000000-00004764] "m_RqjULd_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "en-US.5" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.5]- [targetUID: 00000000-00004764] "~DFF98ECED49A636C87.TMP" has type "data"- Location: [%TEMP%\~DFF98ECED49A636C87.TMP]- [targetUID: 00000000-00004764] "~DFFC08A79F96A60B0B.TMP" has type "data"- Location: [%TEMP%\~DFFC08A79F96A60B0B.TMP]- [targetUID: 00000000-00004764] "~DF637C63B378227544.TMP" has type "data"- Location: [%TEMP%\~DF637C63B378227544.TMP]- [targetUID: 00000000-00004764] "~DF34606991752B760F.TMP" has type "data"- Location: [%TEMP%\~DF34606991752B760F.TMP]- [targetUID: 00000000-00004764] "RecoveryStore._C7A4F1AE-D920-11E7-B48D-080027D44A30_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "nav_logo229_1_.png" has type "PNG image data 167 x 305 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "_BE0768C1-8D2A-11EE-B07E-005056919882_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_3A0CBBF2-8D84-11EE-B07E-005056919882_.dat" has type "Composite Document File V2 Document Cannot read short stream"- [targetUID: N/A] "Chrome_Owned_96x96_1_.png" has type "PNG image data 96 x 96 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "imagestore.dat" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\imagestore\js9ur7b\imagestore.dat]- [targetUID: 00000000-00000676] "RecoveryStore._BE0768BF-8D2A-11EE-B07E-005056919882_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "googlelogo_white_background_color_272x92dp_1_.png" has type "PNG image data 272 x 92 8-bit/color RGB non-interlaced"- [targetUID: N/A] "favicon_3_.ico" has type "MS Windows icon resource - 2 icons 16x16 32 bits/pixel 32x32 32 bits/pixel"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00000676] "_039A233E-8D5A-11EE-B07E-005056919882_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "favicon_4_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "m_Wt6vjf_hhhU8_FCpbqb_WhJNk_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00000676] "m_bm51tf_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00000676] "6B2043001D270792DFFD725518EAFE2C" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\6B2043001D270792DFFD725518EAFE2C]- [targetUID: 00000000-00004764] "DHQCS6E2.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\DHQCS6E2.txt]- [targetUID: 00000000-00000676] "4NUN791W.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\4NUN791W.txt]- [targetUID: 00000000-00000676] "M3NTI24R.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\M3NTI24R.txt]- [targetUID: 00000000-00000676] "85OEXCQD.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\85OEXCQD.txt]- [targetUID: 00000000-00000676] "F2DDCD2B5F37625B82E81F4976CEE400_2DC6057E0FB5565A5F9E9820511707B5" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_2DC6057E0FB5565A5F9E9820511707B5]- [targetUID: 00000000-00000676] "F2DDCD2B5F37625B82E81F4976CEE400_8FF5BE4204C5F704E3914BEF4952C317" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_8FF5BE4204C5F704E3914BEF4952C317]- [targetUID: 00000000-00000676] "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00004764] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00004764] "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00004764] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00000676] "E87CE99F124623F95572A696C80EFCAF_D855A42D6DB34DB801FA37B51C1634EF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_D855A42D6DB34DB801FA37B51C1634EF]- [targetUID: 00000000-00000676] "7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6]- [targetUID: 00000000-00000676] "E87CE99F124623F95572A696C80EFCAF_868021D8FB0D336149DFA3B521855F32" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_868021D8FB0D336149DFA3B521855F32]- [targetUID: 00000000-00000676] "4EXWCC4C.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\4EXWCC4C.txt]- [targetUID: 00000000-00004764] "ICWH2QAS.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\ICWH2QAS.txt]- [targetUID: 00000000-00000676] "FKTOSIMT.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\FKTOSIMT.txt]- [targetUID: 00000000-00000676] "QRU7SF0N.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\QRU7SF0N.txt]- [targetUID: 00000000-00000676] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00004764] "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00004764] "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00004764] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00000676] "E87CE99F124623F95572A696C80EFCAF_868021D8FB0D336149DFA3B521855F32" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_868021D8FB0D336149DFA3B521855F32]- [targetUID: 00000000-00000676] "E87CE99F124623F95572A696C80EFCAF_D855A42D6DB34DB801FA37B51C1634EF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_D855A42D6DB34DB801FA37B51C1634EF]- [targetUID: 00000000-00000676] "F2DDCD2B5F37625B82E81F4976CEE400_2DC6057E0FB5565A5F9E9820511707B5" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_2DC6057E0FB5565A5F9E9820511707B5]- [targetUID: 00000000-00000676] "7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6]- [targetUID: 00000000-00000676] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00000676] "EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A]- [targetUID: 00000000-00004764] "F2DDCD2B5F37625B82E81F4976CEE400_8FF5BE4204C5F704E3914BEF4952C317" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_8FF5BE4204C5F704E3914BEF4952C317]- [targetUID: 00000000-00000676] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00000676] "AP1A8JSA.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\AP1A8JSA.txt]- [targetUID: 00000000-00004764] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00000676] "77EC63BDA74BD0D0E0426DC8F8008506" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00004764] "EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A]- [targetUID: 00000000-00004764] "KXH0EYMZ.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\KXH0EYMZ.txt]- [targetUID: 00000000-00000676] "6B2043001D270792DFFD725518EAFE2C" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\6B2043001D270792DFFD725518EAFE2C]- [targetUID: 00000000-00004764] "IT5S328K.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\IT5S328K.txt]- [targetUID: 00000000-00004764] "X331YJNT.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\X331YJNT.txt]- [targetUID: 00000000-00000676] "93YCJRSF.htm" has type "HTML document ASCII text with CRLF LF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\W4ZUP6XA\93YCJRSF.htm]- [targetUID: 00000000-00000676] "3VFTQP82.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\3VFTQP82.txt]- [targetUID: 00000000-00000676] "66AM5ARW.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\66AM5ARW.txt]- [targetUID: 00000000-00004764] "02WK8BWF.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\02WK8BWF.txt]- [targetUID: 00000000-00004764] "O7ZI5XUL.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\O7ZI5XUL.txt]- [targetUID: 00000000-00004764] "228HLYQZ.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\228HLYQZ.txt]- [targetUID: 00000000-00004764] "5PI5SJTR.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\5PI5SJTR.txt]- [targetUID: 00000000-00004764] "7TDKMY4M.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\7TDKMY4M.txt]- [targetUID: 00000000-00000676] "YD0SPUY2.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\YD0SPUY2.txt]- [targetUID: 00000000-00004764] "UEDYQUS8.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\UEDYQUS8.txt]- [targetUID: 00000000-00000676] "favicon_3_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "search__0633EE93-D776-472f-A0FF-E1416B8B2E3A_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A]4a:T652,"Purchaseorder.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "Purchaseorder.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "Purchaseorder.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64"; Key: ""; Value: "") "Purchaseorder.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "Purchaseorder.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "Purchaseorder.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "Purchaseorder.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Purchaseorder.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Purchaseorder.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "Purchaseorder.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "") "Purchaseorder.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\.NETFRAMEWORK\POLICY\"; Key: ""; Value: "") "Purchaseorder.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\.NETFRAMEWORK\POLICY\V4.0"; Key: ""; Value: "") "Purchaseorder.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\.NETFRAMEWORK"; Key: ""; Value: "")4b:Tb35,"Purchaseorder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: "DISABLEUSERMODECALLBACKFILTER"; Value: "") "Purchaseorder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "Purchaseorder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "Purchaseorder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "Purchaseorder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "Purchaseorder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "Purchaseorder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "Purchaseorder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\.NETFRAMEWORK"; Key: "INSTALLROOT"; Value: "") "Purchaseorder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\.NETFRAMEWORK"; Key: "CLRLOADLOGDIR"; Value: "") "Purchaseorder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\.NETFRAMEWORK"; Key: "USELEGACYV2RUNTIMEACTIVATIONPOLICYDEFAULTVALUE"; Value: "") "Purchaseorder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\.NETFRAMEWORK"; Key: "ONLYUSELATESTCLR"; Value: "") "Purchaseorder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\FUSION"; Key: "NOCLIENTCHECKS"; Value: "") "Purchaseorder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\NET FRAMEWORK SETUP\NDP\V4\FULL"; Key: "RELEASE"; Value: "") "Purchaseorder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "PURCHASEORDER"; Value: "") "Purchaseorder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\.NETFRAMEWORK"; Key: "DISABLECONFIGCACHE"; Value: "") "Purchaseorder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4"; Value: "") "Purchaseorder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "763FD754-7086-4DFE-95EB-C01A46FAF4CA"; Value: "") "Purchaseorder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "A669021C-C450-4609-A035-5AF59AF4DF18"; Value: "") "Purchaseorder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "CC2BCBBA-16B6-4CF3-8990-D74C2E8AF500"; Value: "")4c:T554,"Purchaseorder.exe" trying to touch file "C:\Windows\SYSTEM32\wow64.dll" "Purchaseorder.exe" trying to touch file "C:\Windows\SYSTEM32\wow64win.dll" "Purchaseorder.exe" trying to touch file "C:\Windows\SYSTEM32\wow64cpu.dll" "Purchaseorder.exe" trying to touch file "C:\Windows\system32\wow64log.dll" "Purchaseorder.exe" trying to touch file "C:\Windows\SysWOW64\MSCOREE.DLL" "Purchaseorder.exe" trying to touch file "C:\Windows\SysWOW64\sechost.dll" "Purchaseorder.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "Purchaseorder.exe" trying to touch file "C:\FLTLIB.DLL" "Purchaseorder.exe" trying to touch file "C:\Windows\SysWOW64\FLTLIB.DLL" "Purchaseorder.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.DLL" "Purchaseorder.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-1.DLL" "Purchaseorder.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-1.DLL" "Purchaseorder.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "Purchaseorder.exe" trying to touch file "C:\Windows\SysWOW64\IMM32.DLL" "Purchaseorder.exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" "Purchaseorder.exe" trying to touch file "C:\Windows\SysWOW64\MSCOREE.DLL.local" "Purchaseorder.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll"4d:T63e,"Purchaseorder.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "Purchaseorder.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "Purchaseorder.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "Purchaseorder.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "Purchaseorder.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "Purchaseorder.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "Purchaseorder.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "Purchaseorder.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs" "Purchaseorder.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs" "Purchaseorder.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "cmd.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "powershell.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "powershell.exe" touched file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe.config"4e:T615,"Purchaseorder.exe" trying to access non-existent file "C:\Windows\system32\wow64log.dll" "Purchaseorder.exe" trying to access non-existent file "C:\FLTLIB.DLL" "Purchaseorder.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-1.DLL" "Purchaseorder.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-1.DLL" "Purchaseorder.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "Purchaseorder.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "Purchaseorder.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "Purchaseorder.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "Purchaseorder.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "Purchaseorder.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-appmodel-runtime-l1-1-2.dll" "Purchaseorder.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-appmodel-runtime-l1-1-0.dll" "Purchaseorder.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "Purchaseorder.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "Purchaseorder.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-quirks-l1-1-0.dll"4f:T6a3,"Purchaseorder.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.local" "Purchaseorder.exe" trying to access non-existent file "C:\Purchaseorder.exe.config" "Purchaseorder.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "Purchaseorder.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\Tfvbnhphqzi\" "Purchaseorder.exe" trying to access non-existent file "C:\Purchaseorder.INI" "Purchaseorder.exe" trying to access non-existent file "C:\Purchaseorder.exe.Local\" "Purchaseorder.exe" trying to access non-existent file "IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&2848384c&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" "Purchaseorder.exe" trying to access non-existent file "IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&2848384c&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\" "Purchaseorder.exe" trying to access non-existent file "C:\Windows\SysWOW64\cmd.exe:Zone.Identifier" "Purchaseorder.exe" trying to access non-existent file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe:Zone.Identifier" "Purchaseorder.exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Net.Http\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.Http.INI" "Purchaseorder.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "Purchaseorder.exe" trying to access non-existent file "\Device\HarddiskVolume2\PURCHASEORDER.EXE.CONFIG" "Purchaseorder.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC"50:Ta3d,Observed string: "})();