24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 62:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4ac,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample c8f3302ef072… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c8f3302ef072…. Malware family: Trojan.Generic. Threat score 100/100. 13/27 AV engines flagged this file. 17 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f"],"about":{"@type":"SoftwareApplication","name":"47afecdd07e1ffca80a41fe42bf1508c.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":13,"total":27},"behavioralIndicators":{"malicious":17,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T6a3,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "$str = $_ | Microsoft.PowerShell.Utility\Format-List -Property * | Microsoft.PowerShell.Utility\Out-String" (Indicator: "Format-List"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "# Format-Hex cmdlet helps in displaying the Hexadecimal equivalent of the input data." (Indicator: "Format-Hex"; Source: "00000000-00006600.00000000.77115.07200000.00000004.mdmp")26:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}27:T41a,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains reference to cryptographic keys Matched sigs: Found XOR operators (encryption/decryption) Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt data Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to decrypt/decode data Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Sample file has high entropy (likely encrypted/compressed content)28:T203e,"c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000180000007648e405432aa773e8244f00687d487588f34f005059a77392aa0276feffffffa4f24f00c244a67348f24f0000005e7540f34f00db44a673e0df1f7608000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff3400000000000000d0f24f0000000000080000000000000000000000000000000000000000000000000000006e48e4050000000010f34f0069921177ffffffff34000000d0f24f00080000000000000000005e7540f34f0027941177d8f24f000b0000000000000028f34f00 (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000a0dc4f0044dc4f00226e0c7600005a04000000002d6e0c768c1dc3522d000000ecb71074c8dc4f0000005f0200f16d02b0c76d02090000008000000008dc4f0000005f028cdc4f0070c80d7630b09e24feffffff2d000000d0cc1f74270000005cdc4f00856a0e761c2313769cdc4f00f85f0e7608000000bb690d76b2690d76541dc3522d000000ecb7107427000000d0cc1f7470dc4f002d000000d0cc1f7427000000a0dc4f00856a0e761c231376e8dc4f007e8a1e74ee8c1e74738a1e743d18a3b22d000000ecb7107427000000d0cc1f746c285a0400285a043d18a3b2b0dc4f00fc525c749cdd4f00e0841e74ed35b6c6feffffff738a1e74 (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000736f187d736f00000000d0a988760000817690118276e0366d02f0b6680208ce700278e94f00feffffff20ec4f00506a7177043aacddfeffffff38ea4f00eaa96d77e0366d020000000008ce7002a11400000a000b00b297736f5c76736f6876736f08ce7002c0f07002140000000000000000000000e0366d0260ea4f00cc2d727708ce70020000000014ce700200000000f8006c6f00000000cc0d24385ce8707768406f7790030000190000001100000010000000e0bd670298ea4f008d9a037430bc67021493700200000000b8ea4f002c05670214937002d0ea4f0000006c6ffeffffff0400000020af0374000000000000000000006c6fc0ea4f00 (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000001c00000000005a0448e04f000000000000000000a3016e77842e9aaa28487007d007c8062800000000000000140000000000c806000000002075000200000000a70000a750e05a0410815a040300000000000000200000000000c806cc01c8060408c806000000000008c8060000000040e04f0059166e771c0000000000000004073c6f00005a0400000000280000000000000000000000050000000200000000005a041c00000000000000505f5a0460e04f00ee136e771c000000ee136e7700000000000000001c000000ffffffff80e04f0050720c7600005a04000000001c00000004073c6f (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000006d77400972074009720700000000a854720720c77107b80272071d00000030c7710711001c0050f56d77583d7107583d710700000000ac21c35268ba7007183071072600000078ba70070a002c0050f56d77e04f7207e04f72070000000040097207c0c77107504b720723000000d0c7710731002300a009c806640000006421c352583d7107583d710700000000feffffff84700c76d8e04f0065700c7600005a040000000084700c761021c352e04f7207e04f720700000000e32e386f583d7107b5ce346fc42b1985a0e04f00176f356f34e14f0070c80d76e8b39e24feffffff84700c760a8e376fe04f7207f08d376f00e14f00a7ce346f01000000 (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000006d773804720738047207000000000000000020c77107b80272070600000050f56d77083e7107083e71070000000084700c7668ba7007183071072800000078ba70070a002400e00cc8066400000050f56d7700517207005172070000000038047207c0c77107504b72072c000000d0c7710731002c00a009c80664000000083e7107083e710700000000feffffff84700c76d4e04f0065700c7600005a040000000084700c761c21c352005172070051720700000000e32e386f083e7107b5ce346fb82b19859ce04f00176f356f34e14f0070c80d76e8b39e24feffffff84700c760a8e376f00517207f08d376ffce04f00a7ce346f01000000504b356f (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000006d0250051f73000000002a00e773fc86e0732a00e773fb8c6e770000000000000000fc86e07390e14f000000000000000000000000002a00e77309000000d03f6d0209000000fc86e0730000000050051f7318000000b65ae405432aa773a8134f000000000010e44f005059a77392aa0276feffffff50e14f000a63a67300e14f0000000000000000002363a6737ce14f000000000000000000000000000000000000000000000000000100000000000000010000000000000078e14f000000000088e14f00000000007ce14f000000000000000000000000004b002177ae5ae40590e14f0084da0f77d82e9aaa94e14f00dab90f770000167388e14f00 (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000f8c2f80838cf6e777427670264c3f80801000000282767027427670228276702040000000400000000e01b770010000064c3f8080100000028276702cd976e779c976e77000a2da2b50f12772827670200006e7700000000941f236e0000000080ee18770100000000000000f8e21b77000000000400000080a9037448401a77f8e21b7768c3f80880e89c7500306d0280e89c7564c3f8080000000080e89c7500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000006ef7730284f77302 (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000008e8b7202a68b7202 (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000de887002f2887002 (UID: 00000000-00007360)29:T914,"c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000006700720061006d00460069006c00650073003d0043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029000000500072006f006700720061006d00460069006c0065007300280078003800360029003d0043003a005c00500072006f006700720061006d0020004600 (UID: 00000000-00007360) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000005c000000000063000000000000000100000074001400000090be1303000000000100000001000000000000002c0000007041140300000000140000000a000000000000000000000000006f00e071130314000000000000000000000000000000000000000000000000006e00000000006700000020a51203 (UID: 00000000-00007252) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000032038000000000000000a11400003ccf7209ee136e7780000000ee136e77000000000000000080000000f062f66e000000005ccf720950720c76000032030000000080000000f062f66e02000000002ff66e78cf7209fb62f66e010000008004f76e885f0e7600000000af5f82ada8cf7209b864f66ef42ef66e (UID: 00000000-00007252) "wXuBqODjBHEIez.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000010000000c00000000000000000000000000000001000000010000000000000000000000720061006d00650000000000000000000000000000000000010000002f000000000000000000000063006f006e006600690067005c006d006100630000000000000065000000000000000000000000000000000000000000 (UID: 00000000-00001244) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000005c000000000063000000000000000100000074001400000088c6ca00000000000100000001000000000000002c000000c042cb0000000000140000000a000000000000000000000000006f00f076ca0014000000000000000000000000000000000000000000000000006e000000000067000000d8a5c900 (UID: 00000000-00006600) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000ee008000000000000000a11400006cd06409ee136e7780000000ee136e77000000000000000080000000f062ee71000000008cd0640950720c760000ee000000000080000000f062ee7102000000002fee71a8d06409fb62ee71010000008004ef71885f0e7600000000578d63a0d8d06409b864ee71f42eee71 (UID: 00000000-00006600)2a:T643,"c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "schtasks.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "RegSvcs.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "RegSvcs.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "wXuBqODjBHEIez.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "wXuBqODjBHEIez.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")2b:T687,Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API "[System.Diagnostics.FileVersionInfo]::GetVersionInfo($this.FullName)" (Indicator: "GetVersion"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp")2c:T1486,"c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" queries volume information of "C:\c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" at 00000000-00007360-00000C15-43039975 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00007360-00000C15-43440050 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00007360-00000C15-43578597 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00000000-00007360-00000C15-44831883 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00000000-00007360-00000C15-44849782 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll" at 00000000-00007252-00000C15-49497004 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00007252-00000C15-49740692 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00007252-00000C15-52045350 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll" at 00000000-00007252-00000C15-52148514 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00007252-00000C15-52185588 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007252-00000C15-52316385 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007252-00000C15-52332731 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007252-00000C15-52340050 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007252-00000C15-52340183 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll" at 00000000-00007252-00000C15-53216840 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007252-00000C15-53247718 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007252-00000C15-53258246 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007252-00000C15-53258354 "powershell.exe" queries volume information of "C:\" at 00000000-00007252-00000C15-53716811 "powershell.exe" queries volume information of "C:\share" at 00000000-00007252-00000C15-53717949 "powershell.exe" queries volume information of "C:\share" at 00000000-00007252-00000C15-53818490 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007252-00000C15-54742606 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007252-00000C15-55209725 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007252-00000C15-55331062 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007252-00000C15-554864862d:T442,"c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "APPENDPATH") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "PATH") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SCHTASKS.EXE") "wXuBqODjBHEIez.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE") "wXuBqODjBHEIez.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "APPENDPATH") "wXuBqODjBHEIez.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "PATH") "wXuBqODjBHEIez.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SCHTASKS.EXE")2e:T8c4,"powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")2f:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")30:T5f0,"c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "%APPDATA%\wXuB" - (UID: 00000000-00007360), "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\schtasks.exe" /Create /TN "Updates\wXuBqODjBHEIez" /XML "%TEMP%\tmp179.tmp"" - (UID: 00000000-00007360), "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "CreateProcessA" with parameter "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" - (UID: 00000000-00007360), "RegSvcs.exe" called "CreateProcessW" with parameter ""schtasks.exe" /create /f /tn "SCSI Service Task" /xml "%TEMP%\tmpAFF.tmp"" - (UID: 00000000-00004276), "wXuBqODjBHEIez.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "%APPDATA%\wXuB" - (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\schtasks.exe" /Create /TN "Updates\wXuBqODjBHEIez" /XML "%TEMP%\tmp4F41.tmp"" - (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "CreateProcessA" with parameter "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" - (UID: 00000000-00001244) "RegSvcs.exe" called "CreateProcessW" with parameter ""schtasks.exe" /create /f /tn "SCSI Service Task" /xml "%TEMP%\tmp58E7.tmp"" - (UID: 00000000-00006420)31:Tc4ba,"c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007360) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e7f9e4af50c666b5fec85987c303915a\Microsoft.Management.Infrastr (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00007252) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00007252) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003228) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003228) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003228) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003228) "RegSvcs.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004276) "RegSvcs.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004276) "RegSvcs.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004276) "RegSvcs.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004276) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ntdll.dll (UID: 00000000-00004276) "RegSvcs.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004276) "RegSvcs.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004276) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004276) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004276) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00004276) "RegSvcs.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00004276) "RegSvcs.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004276) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004276) "RegSvcs.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00004276) "RegSvcs.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00004276) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004276) "RegSvcs.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004276) "RegSvcs.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004276) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004276) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004276) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004276) "RegSvcs.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004276) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00004276) "RegSvcs.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004276) "RegSvcs.exe" called "LoadLibrary" with a parameter User32.dll (UID: 00000000-00004276) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007292) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007292) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007292) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007292) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004088) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004088) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004088) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004088) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001244) "wXuBqODjBHEIez.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001244) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e7f9e4af50c666b5fec85987c303915a\Microsoft.Management.Infrastr (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00006600) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00006600) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007576) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007576) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007576) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007576) "RegSvcs.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006420) "RegSvcs.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006420) "RegSvcs.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006420) "RegSvcs.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006420) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ntdll.dll (UID: 00000000-00006420) "RegSvcs.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006420) "RegSvcs.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006420) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006420) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006420) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00006420) "RegSvcs.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00006420) "RegSvcs.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006420) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006420) "RegSvcs.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00006420) "RegSvcs.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00006420) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006420) "RegSvcs.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00006420) "RegSvcs.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006420) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006420) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00006420) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00006420) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006420) "RegSvcs.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00006420) "RegSvcs.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006420) "RegSvcs.exe" called "LoadLibrary" with a parameter User32.dll (UID: 00000000-00006420) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007560) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007560) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007560) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007560) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006636) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006636) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006636) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006636)32:T6245,Found reference to API (Indicator: "GetObject"; File: "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe") Found reference to API (Indicator: "InitializeConditionVariable"; File: "00000000-00006600.00000000.77115.00F81000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; File: "00000000-00006600.00000000.77115.00F81000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "00000000-00006600.00000000.77115.00F81000.00000020.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00006600.00000000.77115.00F81000.00000020.mdmp, 00000000-00006600.00000000.77115.723A1000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00006600.00000000.77115.00F81000.00000020.mdmp, 00000000-00006600.00000000.77115.723A1000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00006600.00000000.77115.00F81000.00000020.mdmp, 00000000-00006600.00000000.77115.723A1000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00006600.00000000.77115.723A1000.00000020.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00006600.00000000.77115.723A1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00006600.00000000.77115.723A1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00006600.00000000.77115.723A1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00006600.00000000.77115.723A1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00006600.00000000.77115.723A1000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00006600.00000000.77115.723A1000.00000020.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00006600.00000000.77115.723A1000.00000020.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp")33:T425,Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00006600.00000000.77115.00F91000.00000002.mdmp, 00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00006600.00000000.77115.723B5000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00007252.00000000.67453.00F91000.00000002.mdmp, 00000000-00007252.00000000.67453.6F555000.00000002.mdmp")34:T1bab,"SOFTWARE\Microsoft\PowerShell\3" in Source: 23785-184-00F8BFA2 "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 23785-182-00F88190 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 23785-182-00F88190 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 23785-182-00F88190 "SOFTWARE\Microsoft\PowerShell" in Source: 23785-195-00F88AF0 "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 23785-149-00F8D560 "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006600.00000000.77115.00C90000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006600.00000000.77115.00C90000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00006600.00000000.77115.00F81000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00006600.00000000.77115.00F81000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00006600.00000000.77115.00F81000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00006600.00000000.77115.00F81000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00006600.00000000.77115.00F81000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00006600.00000000.77115.00F81000.00000020.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\EventLog" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell" in Source: 00000000-00006600.00000000.77115.04B10000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007252.00000000.67453.03120000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007252.00000000.67453.03120000.00000004.mdmp35:T2112,"c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135] "RegSvcs.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ntdll.dll" - [base:0; Status:c0000135] "RegSvcs.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "RegSvcs.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "wXuBqODjBHEIez.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "wXuBqODjBHEIez.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "wXuBqODjBHEIez.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "wXuBqODjBHEIez.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "wXuBqODjBHEIez.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "wXuBqODjBHEIez.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "wXuBqODjBHEIez.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "wXuBqODjBHEIez.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "wXuBqODjBHEIez.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135]36:T8a84,"c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "KERNEL32" at base 75e80000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 77010000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 77010000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 77010000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 761a0000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77010000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77010000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77010000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 739a0000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "ADVAPI32.DLL" at base 772a0000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 73890000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "SHLWAPI.DLL" at base 75420000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 76f40000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "VERSION.DLL" at base 73de0000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72730000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "USER32.DLL" at base 76810000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 77010000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "MSCOREE.DLL" at base 739f0000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 75610000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "PSAPI.DLL" at base 75470000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "KERNEL32.DLL" at base 75e80000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "RPCRT4.DLL" at base 75fc0000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 71320000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "OLE32.DLL" at base 76990000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73b40000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 75610000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 77010000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 71290000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 70830000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "UXTHEME.DLL" at base 73b40000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "NTDLL.DLL" at base 776a0000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "SHELL32.DLL" at base 740e0000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 70010000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6ff00000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6f780000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "BCRYPT.DLL" at base 72f10000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 6f750000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "IMM32.DLL" at base 761a0000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "COMCTL32.DLL" at base 6f6c0000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "GDI32.DLL" at base 755e0000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "GDIPLUS.DLL" at base 73e00000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 73e00000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77010000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "WLDP.DLL" at base 6f420000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "AMSI.DLL" at base 73790000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73de0000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 6f3d0000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6f330000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 75e80000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "USERENV.DLL" at base 6f3f0000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 772a0000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\URLMON.DLL" at base 0 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 75e80000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "URLMON.DLL" at base 6f130000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 77010000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "SSPICLI.DLL" at base 740c0000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "MSISO.DLL" at base 6eeb0000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "WINDOWSCODECS.DLL" at base 73160000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "NTDLL" at base 776a0000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 6ebd0000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 758b0000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73610000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 6eaa0000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 740e0000 "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 6f130000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77010000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77010000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77010000 "powershell.exe" loaded module "KERNEL32" at base 75e80000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 739a0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 772a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 73890000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 75420000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 76f40000 "powershell.exe" loaded module "VERSION.DLL" at base 73de0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72730000 "powershell.exe" loaded module "USER32.DLL" at base 76810000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 77010000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 739f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 75610000 "powershell.exe" loaded module "PSAPI.DLL" at base 75470000 "powershell.exe" loaded module "KERNEL32.DLL" at base 75e80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 71320000 "powershell.exe" loaded module "RPCRT4.DLL" at base 75fc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 76990000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 75610000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 77600000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 6f750000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76140000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 77010000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 70830000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 708c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 70010000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 75610000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 75610000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 776a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 740e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 75860000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 75860000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 76db0000 "powershell.exe" loaded module "AMSI.DLL" at base 73790000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73de0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 6f540000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E7F9E4AF50C666B5FEC85987C303915A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 6f4c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6f780000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6f050000 "powershell.exe" loaded module "CRYPT32.DLL" at base 76db0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 75610000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6efa0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 6ef90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6ff00000 "powershell.exe" loaded module "SSPICLI.DLL" at base 740c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WLDP.DLL" at base 0 "powershell.exe" loaded module "WLDP.DLL" at base 6f590000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73b40000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6f420000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 75e80000 "powershell.exe" loaded module "USERENV.DLL" at base 6f560000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 772a0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 6ef80000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 6ef60000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 75e80000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 6ef30000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 6ec40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 6ec10000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 6ec10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\URLMON.DLL" at base 0 "powershell.exe" loaded module "URLMON.DLL" at base 6ec50000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 77010000 "powershell.exe" loaded module "MSISO.DLL" at base 6eba0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 6eaf0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 72f10000 "powershell.exe" loaded module "OLEAUT32" at base 77600000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 77010000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MSVCRT.DLL" at base 0 "powershell.exe" loaded module "MSVCRT.DLL" at base 76080000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 0 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 6eae0000 "powershell.exe" loaded module "MI.DLL" at base 6eac0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MI.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 77010000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WMIDCOM.DLL" at base 6e500000 "powershell.exe" loaded module "GDI32.DLL" at base 755e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77010000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6eaa0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6e480000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6e3c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 77010000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 77010000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 75e80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 77010000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 761a0000 "schtasks.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77010000 "schtasks.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77010000 "schtasks.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77010000 "schtasks.exe" loaded module "KERNEL32" at base 75e80000 "schtasks.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 739a0000 "schtasks.exe" loaded module "KERNEL32.DLL" at base 75e80000 "schtasks.exe" loaded module "RPCRT4.DLL" at base 75fc0000 "schtasks.exe" loaded module "%WINDIR%\SYSWOW64\TASKSCHD.DLL" at base 73520000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 740c0000 "RegSvcs.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77010000 "RegSvcs.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77010000 "RegSvcs.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77010000 "RegSvcs.exe" loaded module "KERNEL32" at base 75e80000 "RegSvcs.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 739a0000 "RegSvcs.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NTDLL.DLL" at base 0 "RegSvcs.exe" loaded module "NTDLL.DLL" at base 776a0000 "RegSvcs.exe" loaded module "KERNEL32.DLL" at base 75e80000 "RegSvcs.exe" loaded module "WLDP.DLL" at base 6f590000 "RegSvcs.exe" loaded module "AMSI.DLL" at base 73790000 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73de0000 "RegSvcs.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 6f540000 "RegSvcs.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6f420000 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 75e80000 "RegSvcs.exe" loaded module "USERENV.DLL" at base 6f560000 "RegSvcs.exe" loaded module "VERSION.DLL" at base 73de0000 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 772a0000 "RegSvcs.exe" loaded module "SSPICLI.DLL" at base 740c0000 "RegSvcs.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "RegSvcs.exe" loaded module "PSAPI.DLL" at base 75470000 "RegSvcs.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "RegSvcs.exe" loaded module "WS2_32.DLL" at base 76f50000 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73aa0000 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 6f040000 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 6eff0000 "RegSvcs.exe" loaded module "USER32.DLL" at base 76810000 "wXuBqODjBHEIez.exe" loaded module "KERNEL32" at base 75e80000 "wXuBqODjBHEIez.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 77010000 "wXuBqODjBHEIez.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 77010000 "wXuBqODjBHEIez.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 77010000 "wXuBqODjBHEIez.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 761a0000 "wXuBqODjBHEIez.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77010000 "wXuBqODjBHEIez.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77010000 "wXuBqODjBHEIez.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77010000 "wXuBqODjBHEIez.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72730000 "wXuBqODjBHEIez.exe" loaded module "ADVAPI32.DLL" at base 772a0000 "wXuBqODjBHEIez.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 726a0000 "wXuBqODjBHEIez.exe" loaded module "SHLWAPI.DLL" at base 75420000 "wXuBqODjBHEIez.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 76f40000 "wXuBqODjBHEIez.exe" loaded module "VERSION.DLL" at base 73de0000 "wXuBqODjBHEIez.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 713e0000 "wXuBqODjBHEIez.exe" loaded module "USER32.DLL" at base 76810000 "wXuBqODjBHEIez.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 77010000 "wXuBqODjBHEIez.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "wXuBqODjBHEIez.exe" loaded module "MSCOREE.DLL" at base 727d0000 "wXuBqODjBHEIez.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 75610000 "wXuBqODjBHEIez.exe" loaded module "PSAPI.DLL" at base 75470000 "wXuBqODjBHEIez.exe" loaded module "KERNEL32.DLL" at base 75e80000 "wXuBqODjBHEIez.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 6ffd0000 "wXuBqODjBHEIez.exe" loaded module "RPCRT4.DLL" at base 75fc0000 "wXuBqODjBHEIez.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "wXuBqODjBHEIez.exe" loaded module "OLE32.DLL" at base 76990000 "wXuBqODjBHEIez.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73b40000 "wXuBqODjBHEIez.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "wXuBqODjBHEIez.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 75610000 "wXuBqODjBHEIez.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 77010000 "wXuBqODjBHEIez.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 72560000 "wXuBqODjBHEIez.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "wXuBqODjBHEIez.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6e950000 "wXuBqODjBHEIez.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "wXuBqODjBHEIez.exe" loaded module "UXTHEME.DLL" at base 73b40000 "wXuBqODjBHEIez.exe" loaded module "NTDLL.DLL" at base 776a0000 "wXuBqODjBHEIez.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "wXuBqODjBHEIez.exe" loaded module "SHELL32.DLL" at base 740e0000 "wXuBqODjBHEIez.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6f7b0000 "wXuBqODjBHEIez.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 72450000 "wXuBqODjBHEIez.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6e1d0000 "wXuBqODjBHEIez.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "wXuBqODjBHEIez.exe" loaded module "BCRYPT.DLL" at base 72f10000 "wXuBqODjBHEIez.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 6f750000 "wXuBqODjBHEIez.exe" loaded module "IMM32.DLL" at base 761a0000 "wXuBqODjBHEIez.exe" loaded module "COMCTL32.DLL" at base 723c0000 "wXuBqODjBHEIez.exe" loaded module "GDI32.DLL" at base 755e0000 "wXuBqODjBHEIez.exe" loaded module "GDIPLUS.DLL" at base 73e00000 "wXuBqODjBHEIez.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 73e00000 "wXuBqODjBHEIez.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77010000 "wXuBqODjBHEIez.exe" loaded module "WLDP.DLL" at base 723a0000 "wXuBqODjBHEIez.exe" loaded module "AMSI.DLL" at base 73a10000 "wXuBqODjBHEIez.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73de0000 "wXuBqODjBHEIez.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 72380000 "wXuBqODjBHEIez.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 722e0000 "wXuBqODjBHEIez.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 75e80000 "wXuBqODjBHEIez.exe" loaded module "USERENV.DLL" at base 737e0000 "wXuBqODjBHEIez.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 772a0000 "wXuBqODjBHEIez.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\URLMON.DLL" at base 0 "wXuBqODjBHEIez.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 75e80000 "wXuBqODjBHEIez.exe" loaded module "URLMON.DLL" at base 72d50000 "wXuBqODjBHEIez.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 77010000 "wXuBqODjBHEIez.exe" loaded module "SSPICLI.DLL" at base 740c0000 "wXuBqODjBHEIez.exe" loaded module "MSISO.DLL" at base 71b90000 "wXuBqODjBHEIez.exe" loaded module "WINDOWSCODECS.DLL" at base 73160000 "wXuBqODjBHEIez.exe" loaded module "NTDLL" at base 776a0000 "wXuBqODjBHEIez.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "wXuBqODjBHEIez.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 72830000 "wXuBqODjBHEIez.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 758b0000 "wXuBqODjBHEIez.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73610000 "wXuBqODjBHEIez.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73890000 "wXuBqODjBHEIez.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 740e0000 "wXuBqODjBHEIez.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 72d50000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72730000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 726a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 713e0000 "powershell.exe" loaded module "MSCOREE.DLL" at base 727d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 6ffd0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 72560000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6e950000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6f7b0000 "powershell.exe" loaded module "AMSI.DLL" at base 73a10000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 723a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E7F9E4AF50C666B5FEC85987C303915A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 72320000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6e1d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6f3f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 721d0000 "powershell.exe" loaded module "SECUR32.DLL" at base 73790000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 72450000 "powershell.exe" loaded module "WLDP.DLL" at base 72300000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 72220000 "powershell.exe" loaded module "USERENV.DLL" at base 737e0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 722e0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 71ee0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 71eb0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 721c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 71d30000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 71d30000 "powershell.exe" loaded module "URLMON.DLL" at base 72d50000 "powershell.exe" loaded module "MSISO.DLL" at base 71b90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 71c70000 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 71c60000 "powershell.exe" loaded module "MI.DLL" at base 71c40000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WMIDCOM.DLL" at base 6f780000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6f3e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6f3d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6dd70000 "schtasks.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72730000 "RegSvcs.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72730000 "RegSvcs.exe" loaded module "WLDP.DLL" at base 72300000 "RegSvcs.exe" loaded module "AMSI.DLL" at base 73a10000 "RegSvcs.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 723a0000 "RegSvcs.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 72220000 "RegSvcs.exe" loaded module "USERENV.DLL" at base 737e0000 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 722f0000 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 71f0000037:Tf8b,Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Variable to hold all default pairse used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "split-path $_.Path" (Indicator: "Split-Path"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "split-path $_.Path -leaf" (Indicator: "Split-Path"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string ""$(split-path $_.Path -leaf): $($_.Status)"" (Indicator: "Split-Path"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "New-Object System.Version -ArgumentList @(" (Indicator: "New-Object"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "new-object datetime @([int]$matches[1], [int]$matches[2], [int]$matches[3])" (Indicator: "New-Object"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "$argumentsBuilder = new-object System.Text.StringBuilder" (Indicator: "New-Object"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "$private:sd = new-object System.Security.AccessControl.CommonSecurityDescriptor $false,$false,$this.SecurityDescriptorSddl" (Indicator: "New-Object"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Write-Error -ErrorRecord $errorRecord" (Indicator: "Write-Error"; Source: "00000000-00006600.00000000.77115.07200000.00000004.mdmp")38:T1e5d,"c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" touched "This Device" (Path: "HKCU\WOW6432NODE\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\WOW6432NODE\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" touched "Other Users Folder" (Path: "HKCU\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" touched "Games Explorer" (Path: "HKCU\WOW6432NODE\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" touched "StreamBackedFolder" (Path: "HKCU\WOW6432NODE\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" touched "Computers and Devices" (Path: "HKCU\WOW6432NODE\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" touched "Removable Drives" (Path: "HKCU\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}") "powershell.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\WOW6432NODE\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\WOW6432NODE\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}") "RegSvcs.exe" touched "NDP SymBinder" (Path: "HKCU\WOW6432NODE\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32")39:Tde0,"c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "wXuBqODjBHEIez.exe.bin" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "scsisvc.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"3a:T4b7,Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00007360-00000C41-13373244018] Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "%APPDATA%\wXuB" [Source: 00000000-00007360-00000C41-13373244018], Observed system executable string:"%WINDIR%\System32\schtasks.exe" [Source: 00000000-00007360-00000C41-13867220952], Observed system executable string:""%WINDIR%\System32\schtasks.exe" /Create /TN "Updates\wXuBqODjBHEIez" /XML "%TEMP%\tmp179.tmp"" [Source: 00000000-00007360-00000C41-13867220952], Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" [Source: 00000000-00007360-00000C40-16900632710], Observed system executable string:"%WINDIR%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00007252-00000BC0-52353390], Observed system executable string:"%WINDIR%\SysWOW64\schtasks.exe" [Source: 00000000-00001244-00000BC0-198699730], Observed system executable string:""%WINDIR%\System32\schtasks.exe" /Create /TN "Updates\wXuBqODjBHEIez" /XML "%TEMP%\tmp4F41.tmp"" [Source: 00000000-00001244-00000C41-8836843956]3b:T9c8,"c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "KO-KR") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "KO-KR") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-CN") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HK") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HK") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "JA-JP") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "JA-JP") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY")3c:T10df,Observed system executable string:"3,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: powershell.exe.log] Observed system executable string:"3,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll",0" [Source: powershell.exe.log] Observed system executable string:"3,"System.Xml Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll",0" [Source: powershell.exe.log] Observed system executable string:"3,"System.Configuration Version=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll",0" [Source: powershell.exe.log] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00007360-00000C25-42467998] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00007360-00000C25-42791943] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00007360-00000C25-42860319] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007360-00000C25-42909196] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00007360-00000C25-43005589] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00007360-00000C25-43040815] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007360-00000C25-43075401] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00007360-00000C25-43417601] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00007360-00000C25-43475684] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00007360-00000C25-43533475] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00007360-00000C25-43668131] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00007360-00000C25-43803500] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00007360-00000C25-43942999] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00007360-00000C25-44210547] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00007360-00000C25-44432467] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00007360-00000C25-44488534] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00007360-00000C25-44565649] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00007360-00000C25-45066432] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00007360-00000C25-45078893] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00007360-00000C25-45093243] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00007360-00000C25-45306990]3d:T4bf,Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath "%APPDATA%\\wXuBqODjBHEIez.exe"" (UID: 00000000-00007252) Spawned process "schtasks.exe" with commandline "/Create /TN "Updates\\wXuBqODjBHEIez" /XML "%TEMP%\\tmp179.tmp"" (UID: 00000000-00003228) Spawned process "RegSvcs.exe" (UID: 00000000-00004276) Spawned process "schtasks.exe" with commandline "/create /f /tn "SCSI Service" /xml "%TEMP%\\tmp9E5.tmp"" (UID: 00000000-00007292) Spawned process "schtasks.exe" with commandline "/create /f /tn "SCSI Service Task" /xml "%TEMP%\\tmpAFF.tmp"" (UID: 00000000-00004088) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath "%APPDATA%\\wXuBqODjBHEIez.exe"" (UID: 00000000-00006600) Spawned process "schtasks.exe" with commandline "/Create /TN "Updates\\wXuBqODjBHEIez" /XML "%TEMP%\\tmp4F41.tmp"" (UID: 00000000-00007576) Spawned process "RegSvcs.exe" (UID: 00000000-00006420) Spawned process "schtasks.exe" with commandline "/create /f /tn "SCSI Service" /xml "%TEMP%\\tmp5656.tmp"" (UID: 00000000-00007560) Spawned process "schtasks.exe" with commandline "/create /f /tn "SCSI Service Task" /xml "%TEMP%\\tmp58E7.tmp"" (UID: 00000000-00006636)3e:T4bf,Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath "%APPDATA%\\wXuBqODjBHEIez.exe"" (UID: 00000000-00007252) Spawned process "schtasks.exe" with commandline "/Create /TN "Updates\\wXuBqODjBHEIez" /XML "%TEMP%\\tmp179.tmp"" (UID: 00000000-00003228) Spawned process "RegSvcs.exe" (UID: 00000000-00004276) Spawned process "schtasks.exe" with commandline "/create /f /tn "SCSI Service" /xml "%TEMP%\\tmp9E5.tmp"" (UID: 00000000-00007292) Spawned process "schtasks.exe" with commandline "/create /f /tn "SCSI Service Task" /xml "%TEMP%\\tmpAFF.tmp"" (UID: 00000000-00004088) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath "%APPDATA%\\wXuBqODjBHEIez.exe"" (UID: 00000000-00006600) Spawned process "schtasks.exe" with commandline "/Create /TN "Updates\\wXuBqODjBHEIez" /XML "%TEMP%\\tmp4F41.tmp"" (UID: 00000000-00007576) Spawned process "RegSvcs.exe" (UID: 00000000-00006420) Spawned process "schtasks.exe" with commandline "/create /f /tn "SCSI Service" /xml "%TEMP%\\tmp5656.tmp"" (UID: 00000000-00007560) Spawned process "schtasks.exe" with commandline "/create /f /tn "SCSI Service Task" /xml "%TEMP%\\tmp58E7.tmp"" (UID: 00000000-00006636)3f:T781,Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "function New-Guid" (Indicator: "New-Guid"; Source: "00000000-00006600.00000000.77115.07200000.00000004.mdmp")40:Taad,"wXuBqODjBHEIez.exe.bin" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- [targetUID: N/A] "scsisvc.exe" has type "PE32 executable (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\(x86)\SCSI Service\scsisvc.exe]- [targetUID: 00000000-00006420] "powershell.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log]- [targetUID: 00000000-00007252] "wXuBqODjBHEIez.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\wXuBqODjBHEIez.exe.log]- [targetUID: 00000000-00001244] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00007252] "tmp179.tmp" has type "XML 1.0 document ASCII text"- Location: [%TEMP%\tmp179.tmp]- [targetUID: 00000000-00003228] "tmp5656.tmp" has type "XML 1.0 document ASCII text with CRLF line terminators"- Location: [%TEMP%\tmp5656.tmp]- [targetUID: 00000000-00006420] "tmpAFF.tmp" has type "XML 1.0 document ASCII text with CRLF line terminators"- Location: [%TEMP%\tmpAFF.tmp]- [targetUID: 00000000-00004088] "KB_907467859.dat" has type "data"- Location: [%APPDATA%\A3D27CFA-1E7A-4FF8-8004-2BE13417B6B1\Logs\%OSUSER%\KB_907467859.dat]- [targetUID: 00000000-00004276] "KB_907618937.dat" has type "data"- Location: [%APPDATA%\A3D27CFA-1E7A-4FF8-8004-2BE13417B6B1\Logs\%OSUSER%\KB_907618937.dat]- [targetUID: 00000000-00006420] "wXuBqODjBHEIez.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "run.dat" has type "Non-ISO extended-ASCII text with no line terminators"- Location: [%APPDATA%\A3D27CFA-1E7A-4FF8-8004-2BE13417B6B1\run.dat]- [targetUID: 00000000-00006420] "wXuBqODjBHEIez.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%APPDATA%\wXuBqODjBHEIez.exe]- [targetUID: 00000000-00007360] "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe.log]- [targetUID: 00000000-00007360] "tmp4F41.tmp" has type "XML 1.0 document ASCII text"- Location: [%TEMP%\tmp4F41.tmp]- [targetUID: 00000000-00001244] "tmp9E5.tmp" has type "XML 1.0 document ASCII text with CRLF line terminators"- Location: [%TEMP%\tmp9E5.tmp]- [targetUID: 00000000-00004276] "tmp58E7.tmp" has type "XML 1.0 document ASCII text with CRLF line terminators"- Location: [%TEMP%\tmp58E7.tmp]- [targetUID: 00000000-00006636]41:T113c,"c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME"; Key: ""; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID"; Key: ""; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: ""; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\CUSTOMATTRIBUTES"; Key: ""; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\DIAGNOSIS"; Key: ""; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER"; Key: ""; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: ""; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\DEBUGINFORMATION"; Key: ""; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY\CUSTOMATTRIBUTES"; Key: ""; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TREATASCLASSINDEX"; Key: ""; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\INTERFACE\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}"; Key: ""; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}"; Key: ""; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\INTERFACE\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}\PROXYSTUBCLSID32"; Key: ""; Value: "")42:T4cb,"c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" queries basic process information of the "C:\c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (UID: 7360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" queries basic process information of the "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (UID: 7360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" queries basic process information of the "C:\Windows\SysWOW64\schtasks.exe" (UID: 7360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" (UID: 7360) "powershell.exe" queries basic process information of the "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (UID: 7252) "RegSvcs.exe" queries basic process information of the "C:\Windows\SysWOW64\schtasks.exe" (UID: 4276) "RegSvcs.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" (UID: 4276) "wXuBqODjBHEIez.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Roaming\wXuBqODjBHEIez.exe" (UID: 1244)43:T1339,"c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATIONTYPE"; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "SERVER"; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "DLLPATH"; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "THREADING"; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "TRUSTLEVEL"; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "REMOTESERVER"; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEASUSER"; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINSHAREDBROKER"; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "PERMISSIONS"; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXEPATH"; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "COMMANDLINE"; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITYTYPE"; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "PERMISSIONS"; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "ACTIVATABLECLASSES"; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVERTYPE"; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "APPID"; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITY"; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVICENAME"; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXPLICITPSMACTIVATIONTYPE"; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}\PROXYSTUBCLSID32"; Key: ""; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"; Key: ""; Value: "") "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "")44:T47f,"c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.configuration\96f7edb07b12303f0ec2595c7f3778c7\system.configuration.ni.dll.aux" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.xml\15af16d373cf0528cb74fc73d365fdbf\system.xml.ni.dll.aux"45:T4b1,"c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to touch file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to touch file "C:\Windows\SysWOW64\mscoree.dll" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to touch file "C:\c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll"46:T1063,"c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\OLE32.DLL" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\RPCSS.DLL" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.DLL" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\UXTHEME.DLL" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll"47:Td4a,"c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "\Device\HarddiskVolume2\C8F3302EF072664C135D2A3049637DB8AE72058F63FBFEDC67DFCEDEBF4D236F.EXE.CONFIG" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\C8F3302EF072664C135D2A3049637DB8AE72058F63FBFEDC67DFCEDEBF4D236F.EXE.LOG" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "C:\c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe.config" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\XQI" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "\Device\HarddiskVolume2\C8F3302EF072664C135D2A3049637DB8AE72058F63FBFEDC67DFCEDEBF4D236F.INI" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "C:\c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.INI" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.WINDOWS.FORMS" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.WINDOWS.FORMS.INI" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.INI" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.DRAWING" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\SYSTEM.DRAWING.INI" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI"48:T530,"c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" writes file "c:\users\%osuser%\appdata\roaming\wxubqodjbheiez.exe" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" writes file "c:\users\%osuser%\appdata\roaming\wxubqodjbheiez.exe:zone.identifier" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" writes file "c:\users\%osuser%\appdata\local\temp\tmp179.tmp" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\clr_v4.0_32\usagelogs\c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe.log" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" writes file "%appdata%\wxubqodjbheiez.exe:zone.identifier" "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" writes file "%localappdata%\microsoft\clr_v4.0_32\usagelogs\c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe.log" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_nvxkh4yh.cey.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_knipvv55.2kw.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive"49:T46e,"16.0.0.0" "10.0.0.0" "1.0.0.0" "192.168.241.70" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "4.0.0.0" found in string "ystem.Xml,4.0.0.0,,b77a5c561934e089" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.14" "2.5.29.15" "2.5.29.19" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.17" "2.5.4.3" "2.5.29.1" "2.5.29.32" "2.5.29.31" "2.5.29.10" "1.1.0.1" "3.0.0.0" Potential IP "4.0.0.0" found in string "Maximum number of drives allowed in a sessionnonon=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" Potential IP "4.0.0.0" found in string "The software settings for the current useromputern=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" Potential IP "4.0.0.0" found in string "ystem.Transactions,4.0.0.0,,b77a5c561934e089" "2.5.29.16" "2.5.4.6" "2.5.4.5" "2.5.4.10" "2.5.4.11" "2.5.4.8" "2.5.4.7" Potential IP "3.0.0.0" found in string "onsoleHost,3.0.0.0,,"4a:T193a,Heuristic match: "f,R.tD" Heuristic match: "Jk.lU" Heuristic match: "o!.Eg" Pattern match: "crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0ZN0L0J" Pattern match: "http://schemas.microsoft.com/windows/2004/02/mit/task" Pattern match: "www.youtube.com/watch?v=9bZkp7q19f0#www.youtube.com/watch?v=9bZkp7q19f0www.reddit.com/r/gifs" Heuristic match: "december2n.duckdns.org" Heuristic match: "december2nd.ddns.net" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Heuristic match: "9.15.cat" Pattern match: "www.digicert.com1" Pattern match: "www.verisign.com/CPS" Pattern match: "https://www.verisign.com/CPS04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0K" Pattern match: "http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=" Pattern match: "https://www.digicert.com/CPS0" Pattern match: "http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q" Pattern match: "http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v" Pattern match: "crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0F" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0L" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/ThawtePCA-G3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=" Pattern match: "crl.usertrust.com/AddTrustExternalCARoot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0" Pattern match: "www.digicert.com1$0" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0" Pattern match: "www.microsoft.com/PKI/docs/CPS/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0" Pattern match: "http://schemas.microsoft.com/SMI/2016/WindowsSettings" Pattern match: "Microsoft.Net/assembly/GAC_MSIL/System.Management.Automation/v4.0_3.0.0.0__31bf3856ad364e35/System.Management.Automation.dll" Pattern match: "http://schemas.microsoft.com/powershell/Microsoft.PowerShell" Heuristic match: "Set-Location $MyInvocation.MyCommand.Name" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=225750" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=225747" Heuristic match: "Get-Content $file | more.com" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=113316" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=160712" Pattern match: "Microsoft.Net/assembly/GAC_MSIL/Microsoft.PowerShell.ConsoleHost/v4.0_3.0.0.0__31bf3856ad364e35/Microsoft.PowerShell.ConsoleHost.dll" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/XMLSchema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Pattern match: "Microsoft.Net/assembly/GAC_MSIL/Microsoft.PowerShell.Security/v4.0_3.0.0.0__31bf3856ad364e35/Microsoft.PowerShell.Security.dll" Heuristic match: "$_.SubjectName.Name" Heuristic match: "$_.IssuerName.Name" Pattern match: "go.microsoft.com/fwlink/?LinkID=113216" Heuristic match: "$this.ResolvedCommand.Name" Heuristic match: "$this.Name + -> + $this.ResolvedCommand.Name" Heuristic match: "$this.Name" Heuristic match: "$commandName = $this.Name" Heuristic match: "ement.Au" Heuristic match: "ntrust.net" Heuristic match: "Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "Microsoft-Windows-Client-Features-WOW64-Package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "www.microsoft.com/pkiops/Docs/Repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "7www.entrust.net/CPS_2048" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "http://www.certplus.com/CRL/class2.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com0" Pattern match: "http://crl.securetrust.com/STCA.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/CPS" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.comodoca.com/AAACertificateServices.crl06" Pattern match: "crl.comodo.net/AAACertificateServices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "https://go.microsoft.com/fwlink/?LinkId=526920" Pattern match: "www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0" Pattern match: "http://www.validationtest.contoso.com/test%d.html"4b:T4c6d,Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006600.00000000.77115.00D69000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0fq9\.x=\*x1\&x5\" - Source: "00000000-00006600.00000000.77115.00D69000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006600.00000000.77115.00D69000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006600.00000000.77115.00D69000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006600.00000000.77115.00D69000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006600.00000000.77115.00D69000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006600.00000000.77115.00D69000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006600.00000000.77115.00D69000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006600.00000000.77115.00D69000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006600.00000000.77115.00D69000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00006600.00000000.77115.00D69000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006600.00000000.77115.00D69000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006600.00000000.77115.00D69000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006600.00000000.77115.00D69000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;digicert" - Source: "00000000-00006600.00000000.77115.00D69000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006600.00000000.77115.00D69000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006600.00000000.77115.00D69000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006600.00000000.77115.00D69000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006600.00000000.77115.00D69000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006600.00000000.77115.00D69000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006600.00000000.77115.00D69000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006600.00000000.77115.00D69000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006600.00000000.77115.00EE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006600.00000000.77115.00EE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006600.00000000.77115.07200000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?geotrust" - Source: "00000000-00006600.00000000.77115.07200000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006600.00000000.77115.07200000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00006600.00000000.77115.07200000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00006600.00000000.77115.07200000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00006600.00000000.77115.07200000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00006600.00000000.77115.07200000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00006600.00000000.77115.07200000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006600.00000000.77115.07200000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006600.00000000.77115.07200000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f" - Source: "00000000-00006600.00000000.77115.723A1000.00000020.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007252.00000000.67453.031F4000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007252.00000000.67453.031F4000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007252.00000000.67453.031F4000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007252.00000000.67453.031F4000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eil" - Source: "00000000-00007252.00000000.67453.031F4000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007252.00000000.67453.031F4000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007252.00000000.67453.031F4000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007252.00000000.67453.031F4000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00007252.00000000.67453.031F4000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcnew" - Source: "00000000-00007252.00000000.67453.031F4000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007252.00000000.67453.03320000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007252.00000000.67453.03320000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00007252.00000000.67453.075A0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00007252.00000000.67453.075A0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00007252.00000000.67453.075A0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007252.00000000.67453.075A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0gd7e" - Source: "00000000-00007252.00000000.67453.075A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.micro2qhchqhchqchq4iq@chq@chqchq(chq(chq4chq4chqpchqpchq\chq\chqhchqhchqtchqtchqdhq(dhq(dhq4dhq4dhq@dhq@dhqldhqldhqxdhqxdhqddhqddhqpdhqpdhq" - Source: "00000000-00007252.00000000.67453.075A0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00007252.00000000.67453.075A0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623636" - Source: "00000000-00007252.00000000.67453.075A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007252.00000000.67453.075A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>>v" - Source: "00000000-00007252.00000000.67453.075A0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00007252.00000000.67453.6F541000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007360.00000000.67092.02670000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json11/27" - Source: "00000000-00007360.00000000.67092.06C70000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,011/27" - Source: "00000000-00007360.00000000.67092.06C70000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00007360.00000000.67092.6F331000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00007360.00000000.67092.6F331000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00007360.00000000.67092.6F331000.00000020.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00007360.00000000.67092.6F3D1000.00000020.mdmp")4c:Ta9c,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp")4d:Teac,"c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00007360) "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00007360)4e:T157d,Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00006600.00000000.77115.00C90000.00000004.mdmp, 00000000-00006600.00000000.77115.00D69000.00000004.mdmp, 00000000-00006600.00000000.77115.07200000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00006600.00000000.77115.00D69000.00000004.mdmp, 00000000-00006600.00000000.77115.07200000.00000004.mdmp") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00006600.00000000.77115.00F81000.00000020.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006600.00000000.77115.00F81000.00000020.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006600.00000000.77115.00F81000.00000020.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006600.00000000.77115.00F81000.00000020.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006600.00000000.77115.00F81000.00000020.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006600.00000000.77115.00F81000.00000020.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006600.00000000.77115.00F81000.00000020.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006600.00000000.77115.00F81000.00000020.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006600.00000000.77115.00F81000.00000020.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00006600.00000000.77115.04B10000.00000004.mdmp") Found string "[-WindowStyle