24:I[10321,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/3h6zdc-it88if.js","/_next/static/chunks/2vw2j18d9u3gs.js","/_next/static/chunks/3l_wb6il5gi_h.js"],"ReportDetailWrapper"] 46c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4ea,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious — Falcon Sandbox Report 6935f4002536… — Score 100/100 — Sample f4b1c2b023da…","description":"Malicious verdict for sandbox report 6935f4002536…. Threat score 100/100. 4 malicious and 22 suspicious behavioral indicators across 278 signatures. Detonated in Windows 11 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT\u0026CK mappings.","url":"/sample/f4b1c2b023daf6d549159564728d2e30906c0a3783c36d064ab86d05c2c040c4/6935f400253699c85602f9dc","keywords":["Malicious","sandbox report","malware analysis","MITRE ATT\u0026CK","f4b1c2b023daf6d549159564728d2e30906c0a3783c36d064ab86d05c2c040c4"],"about":{"@type":"SoftwareApplication","name":"Atena.exe","applicationCategory":"PE32 executable for MS Windows 4.00 (GUI), Intel i386, Nullsoft Installer self-extracting archive, 5 sections","identifier":"f4b1c2b023daf6d549159564728d2e30906c0a3783c36d064ab86d05c2c040c4","additionalType":"Malicious sample"},"threatScore":100,"sandboxEnvironment":"Windows 11 64 bit","behavioralIndicators":{"malicious":4,"suspicious":22,"totalSignatures":278},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAAPAAAAAAAAAAAAAAAAAAAAAAAAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAcAcAAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==26:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAAPAAAAAAAAAAAAAAAAAAAAAAAAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAcAcAAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==27:T95e,file/memory contains long string with (Indicator: "add-mppreference"; File: "error.log") Found reference string "%WINDIR%\system32\cmd.exe /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\SystemD" (Indicator: "add-mppreference"; Source: "00000000-00002308-00000C47-37763526810") Found reference string "%WINDIR%\system32\cmd.exe /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath '%TEMP%\at" (Indicator: "add-mppreference"; Source: "00000000-00002308-00000C47-101157816568") Found reference string "powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\SystemData\obt9di'"" (Indicator: "add-mppreference"; Source: "00000000-00002724-00000C47-2871158108") Found reference string "Add-MpPreference -ExclusionPath 'C:\Users\rSqfdep\AppData\Local\SystemData\obt9di'" (Indicator: "add-mppreference"; File: "AMSI") Found reference string "powershell -Command "Add-MpPreference -ExclusionPath '%TEMP%\ata\23t8us'"" (Indicator: "add-mppreference"; Source: "00000000-00007140-00000C47-3999192594") Found reference string "Add-MpPreference -ExclusionPath 'C:\Users\rSqfdep\AppData\Local\TempData\23t8us'" (Indicator: "add-mppreference"; File: "AMSI") Found reference string "powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\SystemData\j560ce'"" (Indicator: "add-mppreference"; Source: "00000000-00005460-00000C47-2410037628") Found reference string "Add-MpPreference -ExclusionPath 'C:\Users\rSqfdep\AppData\Local\SystemData\j560ce'" (Indicator: "add-mppreference"; File: "AMSI") Found reference string "/d /s /c "powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\SystemData\obt9di'""" (Indicator: "add-mppreference"; File: "cmd.exe") Found reference string "/d /s /c "powershell -Command "Add-MpPreference -ExclusionPath '%TEMP%\ata\23t8us'""" (Indicator: "add-mppreference"; File: "cmd.exe") Found reference string "/d /s /c "powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\SystemData\j560ce'""" (Indicator: "add-mppreference"; File: "cmd.exe") Found reference string "const command = `powershell -Command "Add-MpPreference -ExclusionPath '${folderPath}'"`;" (Indicator: "add-mppreference"; Source: "00000000-00002308.00000000.295185.0007C000.00000004.mdmp, 00000000-00002308.00000001.297105.0007C000.00000004.mdmp, 00000000-00002308.00000002.299027.0007C000.00000004.mdmp")28:T9a0,"Atena.exe" queried SystemProcessInformation at 00000000-00004748-00000C15-3575906187 [PID: 4748] "Atena.exe" queried SystemProcessInformation at 00000000-00004748-00000C15-3575912577 [PID: 4748] "Atena.exe" queried SystemProcessInformation at 00000000-00004748-00000C15-3576097387 [PID: 4748] "Atena.exe" queried SystemProcessInformation at 00000000-00004748-00000C15-3576103623 [PID: 4748] "Atena.exe" queried SystemProcessInformation at 00000000-00004748-00000C15-3577278252 [PID: 4748] "Atena.exe" queried SystemProcessInformation at 00000000-00004748-00000C15-3577284841 [PID: 4748] "Atena.exe" queried SystemProcessInformation at 00000000-00004748-00000C15-3577763984 [PID: 4748] "Atena.exe" queried SystemProcessInformation at 00000000-00004748-00000C15-3577771319 [PID: 4748] "Atena.exe" queried SystemProcessInformation at 00000000-00002308-00000C15-3605292455 [PID: 2308] "Atena.exe" queried SystemProcessInformation at 00000000-00002308-00000C15-3605300797 [PID: 2308] "Atena.exe" queried SystemProcessInformation at 00000000-00002308-00000C15-3605695232 [PID: 2308] "Atena.exe" queried SystemProcessInformation at 00000000-00002308-00000C15-3605702017 [PID: 2308] "Atena.exe" queried SystemProcessInformation at 00000000-00002308-00000C15-3606498539 [PID: 2308] "Atena.exe" queried SystemProcessInformation at 00000000-00002308-00000C15-3606505222 [PID: 2308] "Atena.exe" queried SystemProcessInformation at 00000000-00002308-00000C15-3606846780 [PID: 2308] "Atena.exe" queried SystemProcessInformation at 00000000-00002308-00000C15-3606853142 [PID: 2308] "Atena.exe" queried SystemProcessInformation at 00000000-00002308-00000C15-3637980424 [PID: 2308] "Atena.exe" queried SystemProcessInformation at 00000000-00002308-00000C15-3637987148 [PID: 2308] "Atena.exe" queried SystemProcessInformation at 00000000-00002308-00000C15-3643710343 [PID: 2308] "Atena.exe" queried SystemProcessInformation at 00000000-00002308-00000C15-3643716867 [PID: 2308] "cmd.exe" queried SystemProcessInformation at 00000000-00008140-00000C15-3608184136 [PID: 8140] "cmd.exe" queried SystemProcessInformation at 00000000-00008140-00000C15-3608190819 [PID: 8140] "cmd.exe" queried SystemProcessInformation at 00000000-00008140-00000C15-3608690208 [PID: 8140] "cmd.exe" queried SystemProcessInformation at 00000000-00008140-00000C15-3608696602 [PID: 8140] "net1.exe" queried SystemProcessInformation at 00000000-00006180-00000C15-3609646833 [PID: 6180]29:T4285,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIlmQYJKoZIhvcNAQcCoIIlijCCJYYCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCAKi/54AHWcDKN7MMgzW+Je4GnjudtlwpnXzX+Iejz1QKCCC1MwggTgMIIDyKADAgECAhMzAAAKdX" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259906092a864886f70d010702a082258a30822586020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004200a8bfe7800759c0ca37b30c8335be25ee069e3b9db65c299d7cd7f887a3cf540a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9d250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIlmQYJKoZIhvcNAQcCoIIlijCCJYYCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259906092a864886f70d010702a082258a30822586020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004200a8bfe7800759c0ca37b30c8335be25ee069e3b9db65c299d7cd7f887a3cf540a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9d250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIlqAYJKoZIhvcNAQcCoIIlmTCCJZUCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCCGKubREngV5EFDodK5brTAqlkaVHav/M+SkqGWqFKKqCCC2IwggTvMIID16ADAgECAhMzAAAKc/" "cchString": "13262" "dwFlags": "1" "pbBinary": "308225a806092a864886f70d010702a082259930822595020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004208218ab9b4449e05791050e874ae5bad302a9646951dabff33e4a4a865aa14a2aa0820b62308204ef308203d7a00302010202133300000a73f154098656107847000000000a73300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034345a170d3234303133313139303034345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100b4ce74c0cad1188cdf8838138bcd067e336adbab396df6edbff6c9c16fd5f86077fa4301be71c2c88fcc329f4fa51cb6a0907c36910f619f29978492eff9f569325132362806c80987d2b33572bb10a144e819aab6526dbc3a1526f42471a861a5eabbe6675438e44c6f02aebf804d09524989c8fa511d9b8921d99c787d031340027828fd8ed86d76bb4db0308641c8efa99874b125e2bb0c57fe982f73c98710921faa12bde5d4eed02573eea92138233578f53c80e59b0b5ecd029b6a19ea6cd2fe5e7c4132ad8bf3c5e7b9d9f50eed1da2b7c26d5c3b89d6bf57ed30cb04f9528f865e8d6312f597a5bc64abbfdf14c89cda8a789a43cd71006c51fbe05d0203010001a382017730820173301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414ad470300e97fa66722d1a34941c284c5a321ce6430540603551d11044d304ba4493047312d302b060355040b13244d6963726f736f6674204972656c616e64204f7065726174696f6e73204c696d69746564311630140603550405130d3233303032382b353030313931301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c" "pcbBinary": "ac250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIlqAYJKoZIhvcNAQcCoIIlmTCCJZUCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "13262" "dwFlags": "1" "pbBinary": "308225a806092a864886f70d010702a082259930822595020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004208218ab9b4449e05791050e874ae5bad302a9646951dabff33e4a4a865aa14a2aa0820b62308204ef308203d7a00302010202133300000a73f154098656107847000000000a73300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034345a170d3234303133313139303034345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100b4ce74c0cad1188cdf8838138bcd067e336adbab396df6edbff6c9c16fd5f86077fa4301be71c2c88fcc329f4fa51cb6a0907c36910f619f29978492eff9f569325132362806c80987d2b33572bb10a144e819aab6526dbc3a1526f42471a861a5eabbe6675438e44c6f02aebf804d09524989c8fa511d9b8921d99c787d031340027828fd8ed86d76bb4db0308641c8efa99874b125e2bb0c57fe982f73c98710921faa12bde5d4eed02573eea92138233578f53c80e59b0b5ecd029b6a19ea6cd2fe5e7c4132ad8bf3c5e7b9d9f50eed1da2b7c26d5c3b89d6bf57ed30cb04f9528f865e8d6312f597a5bc64abbfdf14c89cda8a789a43cd71006c51fbe05d0203010001a382017730820173301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414ad470300e97fa66722d1a34941c284c5a321ce6430540603551d11044d304ba4493047312d302b060355040b13244d6963726f736f6674204972656c616e64204f7065726174696f6e73204c696d69746564311630140603550405130d3233303032382b353030313931301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c" "pcbBinary": "ac250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIlmgYJKoZIhvcNAQcCoIIlizCCJYcCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCuweDGBKLLkpvRIfNHqlHxBvX6u7A8kK+C53oBAy+VdKCCC1MwggTgMIIDyKADAgECAhMzAAAKdX" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259a06092a864886f70d010702a082258b30822587020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420aec1e0c604a2cb929bd121f347aa51f106f5fabbb03c90af82e77a01032f9574a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9e250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIlmgYJKoZIhvcNAQcCoIIlizCCJYcCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259a06092a864886f70d010702a082258b30822587020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420aec1e0c604a2cb929bd121f347aa51f106f5fabbb03c90af82e77a01032f9574a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9e250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIlmQYJKoZIhvcNAQcCoIIlijCCJYYCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCD1Ic9VXSKRHe3vJHTviA7n2oanD+d84ekkYUUIWGAvN6CCC1MwggTgMIIDyKADAgECAhMzAAAKdX" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259906092a864886f70d010702a082258a30822586020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420f521cf555d22911dedef2474ef880ee7da86a70fe77ce1e92461450858602f37a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9d250000" "pdwFlags": "01000000"}2a:T80e,"pbBinary": "3082259906092a864886f70d010702a082258a30822586020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004200a8bfe7800759c0ca37b30c8335be25ee069e3b9db65c299d7cd7f887a3cf540a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769"2b:T80e,"pbBinary": "3082259906092a864886f70d010702a082258a30822586020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004200a8bfe7800759c0ca37b30c8335be25ee069e3b9db65c299d7cd7f887a3cf540a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769"2c:T80e,"pbBinary": "308225a806092a864886f70d010702a082259930822595020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004208218ab9b4449e05791050e874ae5bad302a9646951dabff33e4a4a865aa14a2aa0820b62308204ef308203d7a00302010202133300000a73f154098656107847000000000a73300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034345a170d3234303133313139303034345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100b4ce74c0cad1188cdf8838138bcd067e336adbab396df6edbff6c9c16fd5f86077fa4301be71c2c88fcc329f4fa51cb6a0907c36910f619f29978492eff9f569325132362806c80987d2b33572bb10a144e819aab6526dbc3a1526f42471a861a5eabbe6675438e44c6f02aebf804d09524989c8fa511d9b8921d99c787d031340027828fd8ed86d76bb4db0308641c8efa99874b125e2bb0c57fe982f73c98710921faa12bde5d4eed02573eea92138233578f53c80e59b0b5ecd029b6a19ea6cd2fe5e7c4132ad8bf3c5e7b9d9f50eed1da2b7c26d5c3b89d6bf57ed30cb04f9528f865e8d6312f597a5bc64abbfdf14c89cda8a789a43cd71006c51fbe05d0203010001a382017730820173301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414ad470300e97fa66722d1a34941c284c5a321ce6430540603551d11044d304ba4493047312d302b060355040b13244d6963726f736f6674204972656c616e64204f7065726174696f6e73204c696d69746564311630140603550405130d3233303032382b353030313931301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c"2d:T80e,"pbBinary": "308225a806092a864886f70d010702a082259930822595020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004208218ab9b4449e05791050e874ae5bad302a9646951dabff33e4a4a865aa14a2aa0820b62308204ef308203d7a00302010202133300000a73f154098656107847000000000a73300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034345a170d3234303133313139303034345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100b4ce74c0cad1188cdf8838138bcd067e336adbab396df6edbff6c9c16fd5f86077fa4301be71c2c88fcc329f4fa51cb6a0907c36910f619f29978492eff9f569325132362806c80987d2b33572bb10a144e819aab6526dbc3a1526f42471a861a5eabbe6675438e44c6f02aebf804d09524989c8fa511d9b8921d99c787d031340027828fd8ed86d76bb4db0308641c8efa99874b125e2bb0c57fe982f73c98710921faa12bde5d4eed02573eea92138233578f53c80e59b0b5ecd029b6a19ea6cd2fe5e7c4132ad8bf3c5e7b9d9f50eed1da2b7c26d5c3b89d6bf57ed30cb04f9528f865e8d6312f597a5bc64abbfdf14c89cda8a789a43cd71006c51fbe05d0203010001a382017730820173301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414ad470300e97fa66722d1a34941c284c5a321ce6430540603551d11044d304ba4493047312d302b060355040b13244d6963726f736f6674204972656c616e64204f7065726174696f6e73204c696d69746564311630140603550405130d3233303032382b353030313931301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c"2e:T80e,"pbBinary": "3082259a06092a864886f70d010702a082258b30822587020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420aec1e0c604a2cb929bd121f347aa51f106f5fabbb03c90af82e77a01032f9574a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769"2f:T80e,"pbBinary": "3082259a06092a864886f70d010702a082258b30822587020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420aec1e0c604a2cb929bd121f347aa51f106f5fabbb03c90af82e77a01032f9574a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769"30:T80e,"pbBinary": "3082259906092a864886f70d010702a082258a30822586020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420f521cf555d22911dedef2474ef880ee7da86a70fe77ce1e92461450858602f37a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769"31:T80e,"pbBinary": "3082259906092a864886f70d010702a082258a30822586020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004200a8bfe7800759c0ca37b30c8335be25ee069e3b9db65c299d7cd7f887a3cf540a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769"32:T80e,"pbBinary": "3082259906092a864886f70d010702a082258a30822586020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004200a8bfe7800759c0ca37b30c8335be25ee069e3b9db65c299d7cd7f887a3cf540a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769"33:T80e,"pbBinary": "308225a806092a864886f70d010702a082259930822595020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004208218ab9b4449e05791050e874ae5bad302a9646951dabff33e4a4a865aa14a2aa0820b62308204ef308203d7a00302010202133300000a73f154098656107847000000000a73300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034345a170d3234303133313139303034345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100b4ce74c0cad1188cdf8838138bcd067e336adbab396df6edbff6c9c16fd5f86077fa4301be71c2c88fcc329f4fa51cb6a0907c36910f619f29978492eff9f569325132362806c80987d2b33572bb10a144e819aab6526dbc3a1526f42471a861a5eabbe6675438e44c6f02aebf804d09524989c8fa511d9b8921d99c787d031340027828fd8ed86d76bb4db0308641c8efa99874b125e2bb0c57fe982f73c98710921faa12bde5d4eed02573eea92138233578f53c80e59b0b5ecd029b6a19ea6cd2fe5e7c4132ad8bf3c5e7b9d9f50eed1da2b7c26d5c3b89d6bf57ed30cb04f9528f865e8d6312f597a5bc64abbfdf14c89cda8a789a43cd71006c51fbe05d0203010001a382017730820173301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414ad470300e97fa66722d1a34941c284c5a321ce6430540603551d11044d304ba4493047312d302b060355040b13244d6963726f736f6674204972656c616e64204f7065726174696f6e73204c696d69746564311630140603550405130d3233303032382b353030313931301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c"34:T80e,"pbBinary": "308225a806092a864886f70d010702a082259930822595020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004208218ab9b4449e05791050e874ae5bad302a9646951dabff33e4a4a865aa14a2aa0820b62308204ef308203d7a00302010202133300000a73f154098656107847000000000a73300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034345a170d3234303133313139303034345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100b4ce74c0cad1188cdf8838138bcd067e336adbab396df6edbff6c9c16fd5f86077fa4301be71c2c88fcc329f4fa51cb6a0907c36910f619f29978492eff9f569325132362806c80987d2b33572bb10a144e819aab6526dbc3a1526f42471a861a5eabbe6675438e44c6f02aebf804d09524989c8fa511d9b8921d99c787d031340027828fd8ed86d76bb4db0308641c8efa99874b125e2bb0c57fe982f73c98710921faa12bde5d4eed02573eea92138233578f53c80e59b0b5ecd029b6a19ea6cd2fe5e7c4132ad8bf3c5e7b9d9f50eed1da2b7c26d5c3b89d6bf57ed30cb04f9528f865e8d6312f597a5bc64abbfdf14c89cda8a789a43cd71006c51fbe05d0203010001a382017730820173301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414ad470300e97fa66722d1a34941c284c5a321ce6430540603551d11044d304ba4493047312d302b060355040b13244d6963726f736f6674204972656c616e64204f7065726174696f6e73204c696d69746564311630140603550405130d3233303032382b353030313931301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c"35:T80e,"pbBinary": "3082259a06092a864886f70d010702a082258b30822587020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420aec1e0c604a2cb929bd121f347aa51f106f5fabbb03c90af82e77a01032f9574a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769"36:T80e,"pbBinary": "3082259a06092a864886f70d010702a082258b30822587020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420aec1e0c604a2cb929bd121f347aa51f106f5fabbb03c90af82e77a01032f9574a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769"37:T80e,"pbBinary": "3082259906092a864886f70d010702a082258a30822586020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420f521cf555d22911dedef2474ef880ee7da86a70fe77ce1e92461450858602f37a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769"38:T40a,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Calls an API typically used to performs encryption on the data Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Able to decrypt/decode data Matched sigs: Able to access crypto-related API (String) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match - AES encryption Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops file with high entropy indicating encryption/obfuscation Matched sigs: YARA signature match – cryptographic algorithms39:Te1ed,Found XOR loop in file "vk_swiftshader.dll" at offset 2185533; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 2186530; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 2187244; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 3453340; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 4292616; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 4432704; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 4432720; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 4432737; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 4432754; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 4432771; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 651989; code bytes = 33c1 Found XOR loop in file "vk_swiftshader.dll" at offset 1223257; code bytes = 33c1 Found XOR loop in file "vk_swiftshader.dll" at offset 1612553; code bytes = 33c1 Found XOR loop in file "vk_swiftshader.dll" at offset 2350745; code bytes = 33c1 Found XOR loop in file "vk_swiftshader.dll" at offset 4111619; code bytes = 33c1 Found XOR loop in file "vk_swiftshader.dll" at offset 4134518; code bytes = 33c1 Found XOR loop in file "vk_swiftshader.dll" at offset 4134537; code bytes = 33c1 Found XOR loop in file "vk_swiftshader.dll" at offset 4229016; code bytes = 33c1 Found XOR loop in file "vk_swiftshader.dll" at offset 4327722; code bytes = 33c1 Found XOR loop in file "vk_swiftshader.dll" at offset 4327786; code bytes = 33c1 Found XOR loop in file "vk_swiftshader.dll" at offset 5179500; code bytes = 33c1 Found XOR loop in file "vk_swiftshader.dll" at offset 584003; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 733252; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 733305; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1451812; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1458040; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1461304; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1467910; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1539262; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1594588; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1728325; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1729272; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1754192; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1756902; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1777291; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1777325; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1788095; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 2305207; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 2479746; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 2480731; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 2481912; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 2554689; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 3320848; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 3321035; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 3321374; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 3321547; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 4661283; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 1715660; code bytes = 30d0 Found XOR loop in file "Atena.exe" at offset 2144268; code bytes = 30d0 Found XOR loop in file "Atena.exe" at offset 2576553; code bytes = 30d0 Found XOR loop in file "Atena.exe" at offset 2576630; code bytes = 30d0 Found XOR loop in file "Atena.exe" at offset 2640316; code bytes = 30d0 Found XOR loop in file "Atena.exe" at offset 3325292; code bytes = 30d0 Found XOR loop in file "Atena.exe" at offset 3725003; code bytes = 30d0 Found XOR loop in file "Atena.exe" at offset 3725057; code bytes = 30d0 Found XOR loop in file "Atena.exe" at offset 3729764; code bytes = 30d0 Found XOR loop in file "Atena.exe" at offset 4196364; code bytes = 30d0 Found XOR loop in file "Atena.exe" at offset 5066479; code bytes = 30d0 Found XOR loop in file "Atena.exe" at offset 5074276; code bytes = 30d0 Found XOR loop in file "Atena.exe" at offset 2538457; code bytes = 33c1 Found XOR loop in file "Atena.exe" at offset 2801305; code bytes = 33c1 Found XOR loop in file "Atena.exe" at offset 4344165; code bytes = 33c1 Found XOR loop in file "Atena.exe" at offset 4344437; code bytes = 33c1 Found XOR loop in file "Atena.exe" at offset 4344661; code bytes = 33c1 Found XOR loop in file "Atena.exe" at offset 1335380; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 1463137; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 1514092; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 2094764; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 2177423; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 2178581; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 2305906; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 2308471; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 2313554; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 2316476; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 2322540; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 2683530; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 2741371; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 2743948; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 2949163; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 2951065; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 2953951; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 2955297; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 2972034; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 2976685; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 2986197; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 3037910; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 3212606; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 3215759; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 3219544; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 3221868; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 3222559; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 3223234; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 3224121; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 3276518; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 3308720; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 3326507; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 3426392; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 3447534; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 3466928; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 3476819; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 3478945; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 3493854; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 3514309; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 3515836; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 3659795; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 3792802; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 3802807; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 3845999; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 3848474; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 4124462; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 4135451; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 4308087; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 4308509; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 4385893; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 4656876; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 4757013; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 5145648; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 5148080; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 5150512; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 5152944; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 5155376; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 5159082; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 5162994; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 5165298; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 5168908; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 5171340; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 5173732; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 5176036; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 5178340; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 5180461; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 5188038; code bytes = 8030 Found XOR loop in file "Atena.exe" at offset 5195598; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 2434472; code bytes = 30d0 Found XOR loop in file "dxcompiler.dll" at offset 2434526; code bytes = 30d0 Found XOR loop in file "dxcompiler.dll" at offset 2434580; code bytes = 30d0 Found XOR loop in file "dxcompiler.dll" at offset 3481950; code bytes = 30d0 Found XOR loop in file "dxcompiler.dll" at offset 1043881; code bytes = 33c1 Found XOR loop in file "dxcompiler.dll" at offset 1224352; code bytes = 33c1 Found XOR loop in file "dxcompiler.dll" at offset 3735137; code bytes = 33c1 Found XOR loop in file "dxcompiler.dll" at offset 5164169; code bytes = 33c1 Found XOR loop in file "dxcompiler.dll" at offset 3806426; code bytes = 30040e Found XOR loop in file "dxcompiler.dll" at offset 194644; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 584557; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 585061; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 585580; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 589932; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 924218; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 924298; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 924378; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 1007363; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 1546449; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 1740856; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 1771546; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 1772154; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 2074234; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 2752012; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 2819081; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 2943207; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 3006292; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 3166348; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 3416104; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 3416146; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 3417451; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 3572595; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 3578249; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 4299546; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 4307884; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 4455413; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 4455907; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 4760377; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 4895356; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 4928511; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 5035070; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 5069653; code bytes = 8030 Found XOR loop in file "dxcompiler.dll" at offset 5221506; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 451452; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 519820; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 1600602; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 1601320; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 1601978; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 1602567; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 1649939; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 1651815; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 1719441; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 1720531; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 1976900; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2002213; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2130263; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2131751; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2133015; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2134279; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2135543; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2138247; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2144601; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2148391; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2149879; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2314826; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2316464; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 3260981; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 3261033; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 3261210; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 3406652; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 365285; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 3729929; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 13095; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 518200; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 567731; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1154381; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1642982; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1643053; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1679250; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1681762; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1806236; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1855516; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1939836; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2117150; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2220914; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2220940; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2262972; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2746713; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2747096; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2779714; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2781322; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2781611; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2781867; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3126476; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3566094; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3700981; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3701865; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3701892; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3701922; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3701952; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3701982; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3702012; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3702042; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3702072; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3702102; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3702132; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3702162; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3702192; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3702222; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3702252; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3702282; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3702312; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3765412; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3765443; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3765477; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3765511; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3765545; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3765579; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3765613; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3765647; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3765681; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3765715; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3765749; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3765783; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3765817; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3765851; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3765885; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3765919; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3766923; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3766954; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3766988; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3767022; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3767056; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3767090; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3767124; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3767158; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3767192; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3767226; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3767260; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3767294; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3767328; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3767362; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3767396; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3767430; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3772722; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3793803; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3793830; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3793860; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3793890; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3793920; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3793950; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3793980; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3794010; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3794040; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3794070; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3794100; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3794130; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3794160; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3794190; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3794220; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3794250; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3805299; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3805545; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3805572; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3805602; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3805632; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3805662; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3805692; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3805722; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3805752; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3805782; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3805812; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3805842; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3805872; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3805902; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3805932; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3805962; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3805992; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3851278; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3851610; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4225561; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4227851; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4304221; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4304550; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4305753; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4311316; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4322114; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4455476; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4610396; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4792035; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 154860; code bytes = 30d0 Found XOR loop in file "d3dcompiler_47.dll" at offset 3426470; code bytes = 30d0 Found XOR loop in file "d3dcompiler_47.dll" at offset 3426572; code bytes = 30d0 Found XOR loop in file "d3dcompiler_47.dll" at offset 3658312; code bytes = 30d0 Found XOR loop in file "d3dcompiler_47.dll" at offset 3658368; code bytes = 30d0 Found XOR loop in file "d3dcompiler_47.dll" at offset 3802091; code bytes = 30d0 Found XOR loop in file "d3dcompiler_47.dll" at offset 4574828; code bytes = 30d0 Found XOR loop in file "d3dcompiler_47.dll" at offset 4672956; code bytes = 30d0 Found XOR loop in file "d3dcompiler_47.dll" at offset 88702; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 105289; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 105611; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 158153; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 196882; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 209731; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 216432; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 276786; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 276804; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 276884; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 279343; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 287505; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 287704; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 405065; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 405317; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 405363; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 405474; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 405502; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 405625; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 405654; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 405762; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 405890; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 466731; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 480996; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 533012; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 533040; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 533249; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 817415; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 878022; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 960646; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1076295; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1098532; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1098553; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1102588; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1114876; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1150972; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1200849; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1200864; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1204613; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1392282; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1392301; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1496633; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1600316; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1648850; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1648888; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1648926; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1648969; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649012; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649055; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649098; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649141; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649184; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649227; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649270; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649313; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649356; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649399; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649442; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649529; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649567; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649605; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649648; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649691; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649734; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649777; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649820; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649863; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649906; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649949; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1649992; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650035; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650078; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650121; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650208; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650246; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650284; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650327; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650370; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650413; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650456; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650499; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650542; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650585; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650628; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650671; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650714; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650757; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650800; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650882; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1650887; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1974414; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2007987; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2016700; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2146815; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2150981; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2150996; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2151015; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2151022; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2166180; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2166229; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2166308; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2166357; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2348207; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2348214; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2380587; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2419710; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2419892; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2420248; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2477533; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2570945; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2572613; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2589793; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2613683; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2613704; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2614135; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2614187; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2629008; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2701460; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2701699; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2701746; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2701855; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2701875; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2702002; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2702032; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2702133; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2702280; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3149882; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3160600; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3174106; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3174170; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3291395; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3291416; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3295287; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3476637; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3508250; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3519379; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 42554; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 341293; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 341336; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 435925; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 435991; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 436113; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 436130; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 436203; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 436220; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 595188; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 632432; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 639547; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 641131; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 641579; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 701096; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 707215; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 707538; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 778907; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1013365; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1228448; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1594373; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1594501; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1657881; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1658649; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1659201; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1659969; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1660689; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1661457; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1661961; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1932677; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1933390; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1934011; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1935381; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1936734; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2519761; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2594765; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2806916; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2807053; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2807281; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2807631; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2807768; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2807920; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2811867; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2812530; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2812568; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2812705; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2812943; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2813068; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2813151; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2813636; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2813771; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2817459; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2817579; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2817698; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2817809; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2929986; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2933410; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2942601; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 3041810; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 3231164; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 3244657; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 3409136; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 3416896; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 3604104; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 3635744; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 3692320; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 3773392; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 3781334; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 3792016; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 3797211; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 4329667; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 4343973; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 4343985; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 4435056; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 4435112; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 4618008; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 4653704; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 4733627; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 4733705; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 4737142; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 1176903; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 2410560; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 2410576; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 2410593; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 2410610; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 2410627; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 2872812; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 2872864; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 760035; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 779686; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 779705; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 942857; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 966168; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 979946; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 980010; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1000969; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1164507; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1265297; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1265398; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1265476; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1682397; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1703357; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1707021; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1710685; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1731281; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 2146096; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 2154320; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 2166571; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 3004604; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 19447; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 19696; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 39447; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 39696; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 59591; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 59816; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 78311; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 78536; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 97303; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 97528; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 116023; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 116248; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 615420; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 1108929; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 1388776; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 1448673; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 1449025; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 1534160; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 1698488; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 1700620; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 1700675; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 2251660; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 2498835; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 2941915; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 3012216; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 3030040; code bytes = 8030 Found XOR loop in file "dxil.dll" at offset 1360428; code bytes = 30d0 Found XOR loop in file "dxil.dll" at offset 1377315; code bytes = 30d0 Found XOR loop in file "dxil.dll" at offset 1377451; code bytes = 30d0 Found XOR loop in file "dxil.dll" at offset 1377883; code bytes = 30d0 Found XOR loop in file "dxil.dll" at offset 198468; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 198564; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 198650; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 198864; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 199164; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 199690; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 199735; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 201153; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 206748; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 245811; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 246050; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 246097; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 246199; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 246219; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 246353; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 246383; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 246477; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 246627; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 248456; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 248695; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 248742; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 248844; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 248864; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 248998; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 249028; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 249122; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 249272; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 253466; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 254013; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 608356; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 618725; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 625321; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 890651; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 890668; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 890685; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 890702; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 890753; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 890768; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 890773; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 893051; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 1002013; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 1086624; code bytes = 33c1 Found XOR loop in file "dxil.dll" at offset 260224; code bytes = 8030 Found XOR loop in file "dxil.dll" at offset 1202387; code bytes = 8030 Found XOR loop in file "dxil.dll" at offset 1220764; code bytes = 8030 Found XOR loop in file "dxil.dll" at offset 1360447; code bytes = 8030 Found XOR loop in file "dxil.dll" at offset 1431968; code bytes = 8030 Found XOR loop in file "dxil.dll" at offset 1431984; code bytes = 8030 Found XOR loop in file "dxil.dll" at offset 1495739; code bytes = 8030 Found XOR loop in file "dxil.dll" at offset 1499255; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 630032; code bytes = 30d0 Found XOR loop in file "vulkan-1.dll" at offset 630048; code bytes = 30d0 Found XOR loop in file "vulkan-1.dll" at offset 630065; code bytes = 30d0 Found XOR loop in file "vulkan-1.dll" at offset 630082; code bytes = 30d0 Found XOR loop in file "vulkan-1.dll" at offset 630099; code bytes = 30d0 Found XOR loop in file "vulkan-1.dll" at offset 390307; code bytes = 33c1 Found XOR loop in file "vulkan-1.dll" at offset 409958; code bytes = 33c1 Found XOR loop in file "vulkan-1.dll" at offset 409977; code bytes = 33c1 Found XOR loop in file "vulkan-1.dll" at offset 13233; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 80794; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 86242; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 89666; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 93090; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 99954; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 104050; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 107650; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 110978; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 114402; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 117474; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 120546; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 124146; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 127746; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 235426; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 238498; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 241474; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 246354; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 248946; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 251964; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 252690; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 258382; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 258738; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 659048; code bytes = 8030 Found XOR loop in file "libEGL.dll" at offset 369024; code bytes = 30d0 Found XOR loop in file "libEGL.dll" at offset 369040; code bytes = 30d0 Found XOR loop in file "libEGL.dll" at offset 369057; code bytes = 30d0 Found XOR loop in file "libEGL.dll" at offset 369074; code bytes = 30d0 Found XOR loop in file "libEGL.dll" at offset 369091; code bytes = 30d0 Found XOR loop in file "libEGL.dll" at offset 130147; code bytes = 33c1 Found XOR loop in file "libEGL.dll" at offset 152774; code bytes = 33c1 Found XOR loop in file "libEGL.dll" at offset 152793; code bytes = 33c1 Found XOR loop in file "libEGL.dll" at offset 284633; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 377388; code bytes = 30d0 Found XOR loop in file "nsis7z.dll" at offset 423495; code bytes = 30d0 Found XOR loop in file "nsis7z.dll" at offset 429493; code bytes = 30d0 Found XOR loop in file "nsis7z.dll" at offset 430733; code bytes = 30d0 Found XOR loop in file "nsis7z.dll" at offset 432095; code bytes = 30d0 Found XOR loop in file "nsis7z.dll" at offset 433473; code bytes = 30d0 Found XOR loop in file "nsis7z.dll" at offset 14196; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 32458; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 32489; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 32520; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 39010; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 66588; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 118788; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 266651; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 274623; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 274752; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 417293; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 16577; code bytes = 8030 Found XOR loop in file "nsis7z.dll" at offset 423456; code bytes = 8030 Found XOR loop in file "nsis7z.dll" at offset 424610; code bytes = 8030 Found XOR loop in file "nsis7z.dll" at offset 427782; code bytes = 8030 Found XOR loop in file "nsis7z.dll" at offset 428606; code bytes = 8030 Found XOR loop in file "nsis7z.dll" at offset 429474; code bytes = 8030 Found XOR loop in file "nsis7z.dll" at offset 430714; code bytes = 8030 Found XOR loop in file "Uninstall Atena.exe" at offset 350038; code bytes = 30d0 Found XOR loop in file "Uninstall Atena.exe" at offset 341064; code bytes = 33c1 Found XOR loop in file "Uninstall Atena.exe" at offset 370884; code bytes = 33c1 Found XOR loop in file "Uninstall Atena.exe" at offset 392397; code bytes = 33c1 Found XOR loop in file "Uninstall Atena.exe" at offset 196582; code bytes = 8030 Found XOR loop in file "Uninstall Atena.exe" at offset 222934; code bytes = 8030 Found XOR loop in file "elevate.exe" at offset 104839; code bytes = 30d0 Found XOR loop in file "elevate.exe" at offset 9341; code bytes = 8030 Found XOR loop in file "elevate.exe" at offset 38220; code bytes = 8030 Found XOR loop in file "elevate.exe" at offset 38617; code bytes = 8030 Found XOR loop in file "StdUtils.dll" at offset 101399; code bytes = 30d0 Found XOR loop in file "StdUtils.dll" at offset 2707; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 2896; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 3088; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 30152; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 30569; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 34552; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 34557; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 34719; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 37953; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 37960; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 40217; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 43107; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 43120; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 101360; code bytes = 8030 Found XOR loop in file "SpiderBanner.dll" at offset 3377; code bytes = 8030 Found XOR loop in file "SpiderBanner.dll" at offset 3457; code bytes = 8030 Found XOR loop in file "SpiderBanner.dll" at offset 3642; code bytes = 80303a:T5d1,Found string "'C:\\Windows\\System32\\drivers\\VBoxMouse.sys'," (Source: "00000000-00002308.00000000.295185.0007C000.00000004.mdmp, 00000000-00002308.00000001.297105.0007C000.00000004.mdmp, 00000000-00002308.00000002.299027.0007C000.00000004.mdmp") Found string "'C:\\Windows\\System32\\drivers\\VBoxGuest.sys'," (Source: "00000000-00002308.00000000.295185.0007C000.00000004.mdmp, 00000000-00002308.00000001.297105.0007C000.00000004.mdmp, 00000000-00002308.00000002.299027.0007C000.00000004.mdmp") Found string "'C:\\Windows\\System32\\drivers\\vmci.sys'," (Source: "00000000-00002308.00000000.295185.0007C000.00000004.mdmp, 00000000-00002308.00000001.297105.0007C000.00000004.mdmp, 00000000-00002308.00000002.299027.0007C000.00000004.mdmp") Found string "'C:\\Windows\\System32\\drivers\\vmmouse.sys'," (Source: "00000000-00002308.00000000.295185.0007C000.00000004.mdmp, 00000000-00002308.00000001.297105.0007C000.00000004.mdmp, 00000000-00002308.00000002.299027.0007C000.00000004.mdmp") Found string "'C:\\Program Files\\VMware\\VMware Tools\\'," (Source: "00000000-00002308.00000000.295185.0007C000.00000004.mdmp, 00000000-00002308.00000001.297105.0007C000.00000004.mdmp, 00000000-00002308.00000002.299027.0007C000.00000004.mdmp") Found string "'C:\\Program Files (x86)\\VMware\\VMware Tools\\'," (Source: "00000000-00002308.00000000.295185.0007C000.00000004.mdmp, 00000000-00002308.00000001.297105.0007C000.00000004.mdmp, 00000000-00002308.00000002.299027.0007C000.00000004.mdmp")3b:T439,Found string "'C:\\Windows\\System32\\drivers\\VBoxMouse.sys'," (Indicator: "VBoxMouse"; Source: "00000000-00002308.00000000.295185.0007C000.00000004.mdmp, 00000000-00002308.00000001.297105.0007C000.00000004.mdmp, 00000000-00002308.00000002.299027.0007C000.00000004.mdmp") Found string "'C:\\Windows\\System32\\drivers\\VBoxGuest.sys'," (Indicator: "VBoxGuest"; Source: "00000000-00002308.00000000.295185.0007C000.00000004.mdmp, 00000000-00002308.00000001.297105.0007C000.00000004.mdmp, 00000000-00002308.00000002.299027.0007C000.00000004.mdmp") Found string "'C:\\Windows\\System32\\drivers\\vmci.sys'," (Indicator: "\vmci"; Source: "00000000-00002308.00000000.295185.0007C000.00000004.mdmp, 00000000-00002308.00000001.297105.0007C000.00000004.mdmp, 00000000-00002308.00000002.299027.0007C000.00000004.mdmp") Found string "'C:\\Windows\\System32\\drivers\\vmmouse.sys'," (Indicator: "vmmouse"; Source: "00000000-00002308.00000000.295185.0007C000.00000004.mdmp, 00000000-00002308.00000001.297105.0007C000.00000004.mdmp, 00000000-00002308.00000002.299027.0007C000.00000004.mdmp")3c:T2c38,"Atena.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004748) "Atena.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004748) "Atena.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000a4f419006820dc750200000000000000aa936629109aa37200000000e4f41900201be175fffffffff4f419005810dc753c10dc75fa936629109aa372d445a372d845a372d4f41900d0f419000d0000000d0000009003a572dc54a772000000006caca472d858a77268f51900608ddf754672975cfeffffff00f51900900fdc759003a57210f5190084d4a472dc54a7729003a5721cf51900a4d4a4729003a57238f519001a9aa3729003a572528bdb75010000000100000017d4a47278f5190086caa472000000004acaa4722b7b2aaa010000000100000000000000000000000000000048f519003dba19f4b8f51900f0cca472eba294d8feffffff (UID: 00000000-00004748) "Atena.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000b4f61803c5907472409c7672f0f618039f737472020000008f737472ff74f8f714000000582275721500000000000000c4f618030000000090f71803302b747207b69686feffffff8f737472667674720cf7180304f7180310f7180320f7180324f7180302000000020000002ee8707228f71803d975747200997672f21c757234f71803ca157472f21c757240f71803ee157472f21c757260f718030e117072f21c7572097874720100000001000000010000006b157472a0f718034b1774720000000001177472af75f8f7010000000100000000000000000000000000000070f7180304b64e7de0f71803302b747297b29686feffffffb0f71803 (UID: 00000000-00004748) "Atena.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d000000650014000000080014000000780004086500000000000008650020ea1803feba0f77080014000000000008000000050000006cea1803f0bdb07600007800080014001400000040e4ca18008000000a000000050000005852ecd964ea1803f4ec1803b0ac4f73ffffffffa4ea180372fa3a7398ea18037cce2c7372fa3a730100000000000000020000007cce2c73d8ea18030000000080c33b7380fa3a7390bd86006cf118036ef118032c0ed21b8c52ecd9 (UID: 00000000-00004748) "Atena.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000000000200000000a000c0020000000d00765000000650053bf0f770000000020000000e03385000000000000000000000000000200000020000000c80165000000000004000000000065001200000000000000000078006851ecd974e9180308ea1803b0ac4f73ffffffffb0e9180372fa3a73120000007cce2c7372fa3a730100000000000000020000007cce2c73dce918030c6585000000000080fa3a7310000000fcffffff00000000b0e91803 (UID: 00000000-00004748) "Atena.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d000000650014000000080014000000780004086500000000000008650020ea1803feba0f77080014000000000008000000050000006cea1803f0bdb07600007800080014001400000040e4ca18008000000a000000050000005852ecd964ea1803f4ec1803b0ac4f73ffffffffa4ea180372fa3a7398ea18037cce2c7372fa3a730100000000000000020000007cce2c73d8ea18030000000080c33b7380fa3a73b0bc86006cf118036ef118032c0ed21b8c52ecd9 (UID: 00000000-00004748) "Atena.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000000002000000009000c0020000000d00765000000650053bf0f770000000020000000e03385000000000000000000000000000200000020000000c80165000000000004000000000065001200000000000000000078006851ecd974e9180308ea1803b0ac4f73ffffffffb0e9180372fa3a73120000007cce2c7372fa3a730100000000000000020000007cce2c73dce91803ece485000000000080fa3a7310000000fcffffff00000000b0e91803 (UID: 00000000-00004748) "Atena.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000006500140000000800140000007800040865000000000000086500f0ea1803feba0f77080014000000000008000000050000003ceb1803f0bdb07600007800080014001400000010e5ca18008000000a000000050000002853ecd934eb1803c4ed1803b0ac4f73ffffffff74eb180372fa3a7368eb18037cce2c7372fa3a730100000000000000020000007cce2c73a8eb18030000000080c33b7380fa3a73406f7f043cf218033ef218032c0ed21b5c53ecd9 (UID: 00000000-00004748) "Atena.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000000001fc1d000000ad8000000000000000000024e81803b0e81277796fb647feffffff8ce718036dfc13770000000094fc1377f0ac7f0000007800f0ac7f00000000000000000000000000000000001800000042ce8e7a785fecd984e71803d0ea1803b0ac4f73ffffffffc4e7180372fa3a73e4e718037cce2c7372fa3a730100000000000000020000007cce2c73f0e718032cee1803e48a7d0480fa3a73c0e718030085bd720000780000000000ac5fecd9 (UID: 00000000-00004748) "Atena.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000000000200000000700210020000000d00765000000650053bf0f770000000020000000b0e07e040000000000000000000000000200000020000000c80165000000000004000000000065001200000000000000000078003852ecd944ea1803d8ea1803b0ac4f73ffffffff80ea180372fa3a73120000007cce2c7372fa3a730100000000000000020000007cce2c73acea18034c857d040000000080fa3a7310000000fcffffff0000000080ea1803 (UID: 00000000-00004748) "Atena.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000000000000000000000000000000000000000000000000000000006c611277cc56bb72dc01000000000000000000000000000068da18031b800800f0da18035806000090e1180318000000eaf38e7adc010000000000008861ecd994d91803e0dc1803b0ac4f73ffffffffd4d9180372fa3a73000000007cce2c7372fa3a730100000000000000020000007cce2c7300da18033ce018031c807d0480fa3a730f2700000100000008e1180300000000bc61ecd9 (UID: 00000000-00004748) "Atena.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031001803b199b233ccd818032cd91803f4ed18035c000000deb77a008cdb1803caff0d77deb77a0080d918035c000000c0b77a0030dc1803f2ff0d7700000000000000008861ecd994d91803e0dc1803b0ac4f73ffffffffd4d9180372fa3a73acd918037cce2c7372fa3a730100000000000000020000007cce2c7300da18033ce01803249c7d0480fa3a73a294b0762a000000b085860000000000bc61ecd9 (UID: 00000000-00004748) "Atena.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031001803b199b233ccd818032cd91803f4ed18035c00000076bb7a008cdb1803caff0d7776bb7a0080d918035c00000058bb7a0030dc1803f2ff0d7700000000000000008861ecd994d91803e0dc1803b0ac4f73ffffffffd4d9180372fa3a73acd918037cce2c7372fa3a730100000000000000020000007cce2c7300da18033ce018036c847d0480fa3a73a294b07626000000f829390300000000bc61ecd9 (UID: 00000000-00004748) "Atena.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031001803b199b233ccd818032cd91803f4ed18035c00000016c47a008cdb1803caff0d7716c47a0080d918035c000000f8c37a0030dc1803f2ff0d7700000000000000008861ecd994d91803e0dc1803b0ac4f73ffffffffd4d9180372fa3a73acd918037cce2c7372fa3a730100000000000000020000007cce2c7300da18033ce0180394867d0480fa3a73a294b07629000000f078860000000000bc61ecd9 (UID: 00000000-00004748) "Atena.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031001803b199b233ccd818032cd91803f4ed18035c000000c6bf7a008cdb1803caff0d77c6bf7a0080d918035c000000a8bf7a0030dc1803f2ff0d7700000000000000008861ecd994d91803e0dc1803b0ac4f73ffffffffd4d9180372fa3a73acd918037cce2c7372fa3a730100000000000000020000007cce2c7300da18033ce01803e48a7d0480fa3a73a294b07627000000c02d390300000000bc61ecd9 (UID: 00000000-00004748) "Atena.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031001803b199b233ccd818032cd91803f4ed18035c00000006ba7a008cdb1803caff0d7706ba7a0080d918035c000000e8b97a0030dc1803f2ff0d7700000000000000008861ecd994d91803e0dc1803b0ac4f73ffffffffd4d9180372fa3a73acd918037cce2c7372fa3a730100000000000000020000007cce2c7300da18033ce01803d4977d0480fa3a73a294b0762a000000f078860000000000bc61ecd9 (UID: 00000000-00004748) "Atena.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031001803b199b233ccd818032cd91803f4ed18035c000000c6bf7a008cdb1803caff0d77c6bf7a0080d918035c000000a8bf7a0030dc1803f2ff0d7700000000000000008861ecd994d91803e0dc1803b0ac4f73ffffffffd4d9180372fa3a73acd918037cce2c7372fa3a730100000000000000020000007cce2c7300da18033ce0180394867d0480fa3a73a294b07629000000b079860000000000bc61ecd9 (UID: 00000000-00004748)3d:T5e1,"Atena.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000000765000000650000000000000000000000000080ab7a00000000000000000040ec19000200000010000000c00165000000000002000000000065000100000008000000000078000c0a650000000000080a650010f31900feba0f77080000000000000008000000c229967954f51900da919d72000078000800000001000000 (UID: 00000000-00004748) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f0000000000000000000050090ed689010000c0fb099df87f00000001000000000000b8fb099df87f0000000000000000000080cb1bc4f87f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1a099df87f00000000000000000000b8fb099df87f000000000000 (UID: 00000000-00006836) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f00000000000000000000108aa34f14020000c0fb989bf87f00000001000000000000b8fb989bf87f0000000000000000000080cb1bc4f87f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1a989bf87f00000000000000000000b8fb989bf87f000000000000 (UID: 00000000-00004504) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f00000000000000000000f03c3b2a4f020000c0fb95b3f87f00000001000000000000b8fb95b3f87f0000000000000000000080cb1bc4f87f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1a95b3f87f00000000000000000000b8fb95b3f87f000000000000 (UID: 00000000-00007184)3e:T4cc,"Atena.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Atena.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "net1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME")3f:T77e,"Atena.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "Atena.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "Atena.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{37255216-02EF-44F9-8AED-5DC539DF48FB}"; Key: "SEARCHLIST"; Value: "") "Atena.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{37255216-02EF-44F9-8AED-5DC539DF48FB}"; Key: "DOMAIN"; Value: "") "Atena.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{37255216-02EF-44F9-8AED-5DC539DF48FB}"; Key: "DHCPDOMAIN"; Value: "") "Atena.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "Atena.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "Atena.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "Atena.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{47E2A11A-1F71-4949-AADD-6B479BDC0801}"; Key: "SEARCHLIST"; Value: "") "Atena.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{47E2A11A-1F71-4949-AADD-6B479BDC0801}"; Key: "DHCPDOMAIN"; Value: "") "Atena.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "SEARCHLIST"; Value: "")40:Tbd7,"Atena.exe" queries volume information of "C:\" at 00000000-00002308-00000C17-3607672027 "Atena.exe" queries volume information of "C:\Users" at 00000000-00002308-00000C17-3607672361 "Atena.exe" queries volume information of "C:\Users\%OSUSER%" at 00000000-00002308-00000C17-3607672727 "Atena.exe" queries volume information of "C:\Users\%OSUSER%\AppData" at 00000000-00002308-00000C17-3607672989 "Atena.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local" at 00000000-00002308-00000C17-3607673274 "Atena.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs" at 00000000-00002308-00000C17-3607673619 "Atena.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\atena" at 00000000-00002308-00000C17-3607673981 "Atena.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\atena\resources" at 00000000-00002308-00000C17-3607674397 "Atena.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\atena\resources\app.asar" at 00000000-00002308-00000C17-3607675096 "Atena.exe" queries volume information of "C:\Users\PC\AppData\Local\errorlx" at 00000000-00002308-00000C17-3614425126 "Atena.exe" queries volume information of "C:\Users\PC\AppData\Local\errorlx" at 00000000-00002308-00000C17-3620693742 "Atena.exe" queries volume information of "C:\Users\PC\AppData\Local\errorlx" at 00000000-00002308-00000C17-3620695128 "Atena.exe" queries volume information of "C:\Users\PC\AppData\Local\errorlx" at 00000000-00002308-00000C17-3620696419 "Atena.exe" queries volume information of "C:\Users\PC\AppData\Local\errorlx" at 00000000-00002308-00000C17-3620697662 "Atena.exe" queries volume information of "C:\Users\PC\AppData\Local\errorlx" at 00000000-00002308-00000C17-3620700846 "Atena.exe" queries volume information of "C:\Users\PC\AppData\Local\errorlx" at 00000000-00002308-00000C17-3637250518 "Atena.exe" queries volume information of "C:\Users\PC\AppData\Local\errorlx" at 00000000-00002308-00000C17-3637253281 "Atena.exe" queries volume information of "C:\Windows\System32\drivers\etc\hosts" at 00000000-00002308-00000C17-3637921650 "Atena.exe" queries volume information of "C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm" at 00000000-00002308-00000C17-3637973305 "Atena.exe" queries volume information of "C:\Users\PC\AppData\Local\errorlx" at 00000000-00002308-00000C17-3644397911 "Atena.exe" queries volume information of "C:\Users\PC\AppData\Local\errorlx" at 00000000-00002308-00000C17-3644399902 "Atena.exe" queries volume information of "C:\Users\PC\AppData\Local\errorlx" at 00000000-00002308-00000C17-3644401294 "Atena.exe" queries volume information of "C:\Users\PC\AppData\Local\errorlx" at 00000000-00002308-00000C17-3647103477 "Atena.exe" queries volume information of "C:\Users\PC\AppData\Local\errorlx" at 00000000-00002308-00000C17-3647106374 "Atena.exe" queries volume information of "C:\Users\PC\AppData\Local\errorlx" at 00000000-00002308-00000C17-367101062641:Ta03,"powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")42:T4d8,"Atena.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0119E81BE9A14CD8E22F40AC118C687ECBA3F4D8"; Key: "BLOB") "Atena.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43"; Key: "BLOB") "Atena.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\06F1AA330B927B753A40E68CDF22E34BCBEF3352"; Key: "BLOB") "Atena.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\18F7C1FCC3090203FD5BAA2F861A754976C8DD25"; Key: "BLOB") "Atena.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\245C97DF7514E7CF2DF8BE72AE957B9E04741E85"; Key: "BLOB") "Atena.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\2B45CA4F1FAC7F93EC09EABC096123B1E95C0108"; Key: "BLOB") "Atena.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\31F9FC8BA3805986B721EA7295C65B3A44534274"; Key: "BLOB") "Atena.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\3B1EFD3A66EA28B16697394703A72CA340A05BD5"; Key: "BLOB") "Atena.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25"; Key: "BLOB")43:T623,"Atena.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /d /s /c "net session"" - (UID: 00000000-00002308) "Atena.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\SystemD" - (UID: 00000000-00002308) "Atena.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath '%TEMP%\at" - (UID: 00000000-00002308) "Atena.exe" called "CreateProcessW" with parameter ""%LOCALAPPDATA%\Programs\atena\Atena.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en" - (UID: 00000000-00002308) "Atena.exe" called "CreateProcessW" with parameter ""%LOCALAPPDATA%\Programs\atena\Atena.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-" - (UID: 00000000-00002308) "cmd.exe" called "CreateProcessW" with parameter "net session" - (UID: 00000000-00008140) "cmd.exe" called "CreateProcessW" with parameter "net session" - (UID: 00000000-00008908) "cmd.exe" called "CreateProcessW" with parameter "powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\SystemData\obt9di'"" - (UID: 00000000-00002724) "cmd.exe" called "CreateProcessW" with parameter "powershell -Command "Add-MpPreference -ExclusionPath '%TEMP%\ata\23t8us'"" - (UID: 00000000-00007140) "cmd.exe" called "CreateProcessW" with parameter "powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\SystemData\j560ce'"" - (UID: 00000000-00005460)44:Td778,"Atena.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004748) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004748) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004748) "Atena.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004748) "Atena.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\UXTHEME.dll (UID: 00000000-00004748) "Atena.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\USERENV.dll (UID: 00000000-00004748) "Atena.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SETUPAPI.dll (UID: 00000000-00004748) "Atena.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.dll (UID: 00000000-00004748) "Atena.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PROPSYS.dll (UID: 00000000-00004748) "Atena.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DWMAPI.dll (UID: 00000000-00004748) "Atena.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPTBASE.dll (UID: 00000000-00004748) "Atena.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLEACC.dll (UID: 00000000-00004748) "Atena.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CLBCATQ.dll (UID: 00000000-00004748) "Atena.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NTMARTA.dll (UID: 00000000-00004748) "Atena.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00004748) "Atena.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFOLDER.dll (UID: 00000000-00004748) "Atena.exe" called "LoadLibrary" with a parameter %TEMP%\nskE0DB.tmp\System.dll (UID: 00000000-00004748) "Atena.exe" called "LoadLibrary" with a parameter %TEMP%\nskE0DB.tmp\StdUtils.dll (UID: 00000000-00004748) "Atena.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RichEd20.dll (UID: 00000000-00004748) "Atena.exe" called "LoadLibrary" with a parameter %TEMP%\nskE0DB.tmp\SpiderBanner.dll (UID: 00000000-00004748) "Atena.exe" called "LoadLibrary" with a parameter psapi (UID: 00000000-00004748) "Atena.exe" called "LoadLibrary" with a parameter %TEMP%\nskE0DB.tmp\nsis7z.dll (UID: 00000000-00004748) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00004748) "Atena.exe" called "LoadLibrary" with a parameter %TEMP%\nskE0DB.tmp\WinShell.dll (UID: 00000000-00004748) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002308) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002308) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002308) "Atena.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002308) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00002308) "Atena.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00002308) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00002308) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00002308) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00002308) "Atena.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00002308) "Atena.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002308) "Atena.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002308) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00002308) "Atena.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002308) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002308) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-shcore-scaling-l1-1-1.dll (UID: 00000000-00002308) "Atena.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002308) "Atena.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002308) "Atena.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00002308) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00002308) "Atena.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002308) "Atena.exe" called "LoadLibrary" with a parameter bcryptprimitives (UID: 00000000-00002308) "Atena.exe" called "LoadLibrary" with a parameter COMCTL32.dll (UID: 00000000-00002308) "Atena.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00002308) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002308) "Atena.exe" called "LoadLibrary" with a parameter WTSAPI32.dll (UID: 00000000-00002308) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00002308) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-power-base-l1-1-0.dll (UID: 00000000-00002308) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008140) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008140) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008140) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008140) "net1.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006180) "net1.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006180) "net1.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006180) "net1.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006180) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008908) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008908) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008908) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008908) "net1.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005688) "net1.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005688) "net1.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005688) "net1.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005688) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002724) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002724) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002724) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\86af2f4f2745738837c95f24472c32ca\Microsoft.PowerShell.ConsoleH (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation. (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\f4889fa032f8023fe280a54700d6d3a5\Microsoft.Management.Infrastr (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\2d1ff2ab3131de6a507f22ccc53b273a\System.DirectoryServices.ni.d (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\49750ea038273f75321e479ef1525d1e\Microsoft.PowerShell.Security (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\dd0ed795d7234a2ae4314de052867161\System.Transactions.ni.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\9494eda0c9af503cb61fe450b5ba9c1a\Microsoft.PowerShell.Commands (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\199f66bc1a6fe937deb9e320cbcaacd7\Microsoft.Management.Infrastr (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00006836) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00006836) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007140) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007140) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007140) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007140) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\86af2f4f2745738837c95f24472c32ca\Microsoft.PowerShell.ConsoleH (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation. (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\f4889fa032f8023fe280a54700d6d3a5\Microsoft.Management.Infrastr (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\2d1ff2ab3131de6a507f22ccc53b273a\System.DirectoryServices.ni.d (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\49750ea038273f75321e479ef1525d1e\Microsoft.PowerShell.Security (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\dd0ed795d7234a2ae4314de052867161\System.Transactions.ni.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\9494eda0c9af503cb61fe450b5ba9c1a\Microsoft.PowerShell.Commands (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\199f66bc1a6fe937deb9e320cbcaacd7\Microsoft.Management.Infrastr (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00004504) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00004504) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002196) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002196) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002196) "Atena.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002196) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00002196) "Atena.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00002196) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00002196) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00002196) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00002196) "Atena.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00002196) "Atena.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002196) "Atena.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002196) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00002196) "Atena.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002196) "Atena.exe" called "LoadLibrary" with a parameter bcryptprimitives (UID: 00000000-00002196) "Atena.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002196) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005556) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005556) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005556) "Atena.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005556) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00005556) "Atena.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00005556) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00005556) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00005556) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00005556) "Atena.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00005556) "Atena.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005556) "Atena.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005556) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00005556) "Atena.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005556) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-shcore-scaling-l1-1-1.dll (UID: 00000000-00005556) "Atena.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005556) "Atena.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DXCore.dll (UID: 00000000-00005556) "Atena.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00005556) "Atena.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\mf.dll (UID: 00000000-00005556) "Atena.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\mfplat.dll (UID: 00000000-00005556) "Atena.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\atena\D3DCompiler_47.dll (UID: 00000000-00005556) "Atena.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\atena\libglesv2.dll (UID: 00000000-00005556) "Atena.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\atena\libegl.dll (UID: 00000000-00005556) "Atena.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\atena\libGLESv2.dll (UID: 00000000-00005556) "Atena.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00005556) "Atena.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\atena\vulkan-1.dll (UID: 00000000-00005556) "Atena.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005556) "Atena.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\dxgi.dll (UID: 00000000-00005556) "Atena.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\atena\.\.\vk_swiftshader.dll (UID: 00000000-00005556) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00005556) "Atena.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\atena\vk_swiftshader.dll (UID: 00000000-00005556) "Atena.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\atena\dxil.dll (UID: 00000000-00005556) "Atena.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\atena\dxcompiler.dll (UID: 00000000-00005556) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005460) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005460) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005460) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005460) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\86af2f4f2745738837c95f24472c32ca\Microsoft.PowerShell.ConsoleH (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation. (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\f4889fa032f8023fe280a54700d6d3a5\Microsoft.Management.Infrastr (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\2d1ff2ab3131de6a507f22ccc53b273a\System.DirectoryServices.ni.d (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\49750ea038273f75321e479ef1525d1e\Microsoft.PowerShell.Security (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\dd0ed795d7234a2ae4314de052867161\System.Transactions.ni.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\9494eda0c9af503cb61fe450b5ba9c1a\Microsoft.PowerShell.Commands (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\199f66bc1a6fe937deb9e320cbcaacd7\Microsoft.Management.Infrastr (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00007184) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005824) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005824) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005824) "Atena.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005824) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00005824) "Atena.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00005824) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00005824) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00005824) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00005824) "Atena.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00005824) "Atena.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005824) "Atena.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005824) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00005824) "Atena.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005824) "Atena.exe" called "LoadLibrary" with a parameter api-ms-win-shcore-scaling-l1-1-1.dll (UID: 00000000-00005824) "Atena.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005824) "Atena.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00005824) "Atena.exe" called "LoadLibrary" with a parameter d3d11.dll (UID: 00000000-00005824) "Atena.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\mf.dll (UID: 00000000-00005824) "Atena.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\mfplat.dll (UID: 00000000-00005824)45:T2c54,Found reference to API (Indicator: "MulDiv"; File: "Atena.exe") Found reference to API (Indicator: "DeleteFileW"; File: "Atena.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "Atena.exe") Found reference to API (Indicator: "FindNextFileW"; File: "Atena.exe") Found reference to API (Indicator: "FindClose"; File: "Atena.exe") Found reference to API (Indicator: "SetFilePointer"; File: "Atena.exe") Found reference to API (Indicator: "ReadFile"; File: "Atena.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "Atena.exe") Found reference to API (Indicator: "lstrlenA"; File: "Atena.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "Atena.exe") Found reference to API (Indicator: "GetPrivateProfileStringW"; File: "Atena.exe") Found reference to API (Indicator: "WritePrivateProfileStringW"; File: "Atena.exe") Found reference to API (Indicator: "FreeLibrary"; File: "Atena.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "Atena.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "Atena.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "Atena.exe") Found reference to API (Indicator: "GlobalFree"; File: "Atena.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "Atena.exe") Found reference to API (Indicator: "lstrcmpW"; File: "Atena.exe") Found reference to API (Indicator: "lstrcmpiW"; File: "Atena.exe") Found reference to API (Indicator: "CloseHandle"; File: "Atena.exe") Found reference to API (Indicator: "SetFileTime"; File: "Atena.exe") Found reference to API (Indicator: "CompareFileTime"; File: "Atena.exe") Found reference to API (Indicator: "SearchPathW"; File: "Atena.exe") Found reference to API (Indicator: "GetShortPathNameW"; File: "Atena.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "Atena.exe") Found reference to API (Indicator: "MoveFileW"; File: "Atena.exe") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "Atena.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "Atena.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "Atena.exe") Found reference to API (Indicator: "Sleep"; File: "Atena.exe") Found reference to API (Indicator: "GetTickCount"; File: "Atena.exe") Found reference to API (Indicator: "GetFileSize"; File: "Atena.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "Atena.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "Atena.exe") Found reference to API (Indicator: "CopyFileW"; File: "Atena.exe") Found reference to API (Indicator: "ExitProcess"; File: "Atena.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "Atena.exe") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "Atena.exe") Found reference to API (Indicator: "GetTempPathW"; File: "Atena.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "Atena.exe") Found reference to API (Indicator: "GetVersion"; File: "Atena.exe") Found reference to API (Indicator: "SetErrorMode"; File: "Atena.exe") Found reference to API (Indicator: "lstrlenW"; File: "Atena.exe") Found reference to API (Indicator: "lstrcpynW"; File: "Atena.exe") Found reference to API (Indicator: "GetDiskFreeSpaceW"; File: "Atena.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "Atena.exe") Found reference to API (Indicator: "GlobalLock"; File: "Atena.exe") Found reference to API (Indicator: "CreateThread"; File: "Atena.exe") Found reference to API (Indicator: "GetLastError"; File: "Atena.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "Atena.exe") Found reference to API (Indicator: "CreateProcessW"; File: "Atena.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "Atena.exe") Found reference to API (Indicator: "lstrcmpiA"; File: "Atena.exe") Found reference to API (Indicator: "CreateFileW"; File: "Atena.exe") Found reference to API (Indicator: "GetTempFileNameW"; File: "Atena.exe") Found reference to API (Indicator: "WriteFile"; File: "Atena.exe") Found reference to API (Indicator: "lstrcpyA"; File: "Atena.exe") Found reference to API (Indicator: "MoveFileExW"; File: "Atena.exe") Found reference to API (Indicator: "lstrcatW"; File: "Atena.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "Atena.exe") Found reference to API (Indicator: "GetProcAddress"; File: "Atena.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "Atena.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "Atena.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "Atena.exe") Found reference to API (Indicator: "FillRect"; File: "Atena.exe") Found reference to API (Indicator: "GetClientRect"; File: "Atena.exe") Found reference to API (Indicator: "BeginPaint"; File: "Atena.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "Atena.exe") Found reference to API (Indicator: "InvalidateRect"; File: "Atena.exe") Found reference to API (Indicator: "EnableWindow"; File: "Atena.exe") Found reference to API (Indicator: "ReleaseDC"; File: "Atena.exe") Found reference to API (Indicator: "GetDC"; File: "Atena.exe") Found reference to API (Indicator: "LoadImageW"; File: "Atena.exe") Found reference to API (Indicator: "IsWindow"; File: "Atena.exe") Found reference to API (Indicator: "wsprintfW"; File: "Atena.exe") Found reference to API (Indicator: "ShowWindow"; File: "Atena.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "Atena.exe") Found reference to API (Indicator: "PostQuitMessage"; File: "Atena.exe") Found reference to API (Indicator: "SetWindowTextW"; File: "Atena.exe") Found reference to API (Indicator: "SetTimer"; File: "Atena.exe") Found reference to API (Indicator: "DestroyWindow"; File: "Atena.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "Atena.exe") Found reference to API (Indicator: "CharNextW"; File: "Atena.exe") Found reference to API (Indicator: "CreateWindowExW"; File: "Atena.exe") Found reference to API (Indicator: "SystemParametersInfoW"; File: "Atena.exe") Found reference to API (Indicator: "RegisterClassW"; File: "Atena.exe") Found reference to API (Indicator: "ScreenToClient"; File: "Atena.exe") Found reference to API (Indicator: "GetWindowRect"; File: "Atena.exe") Found reference to API (Indicator: "EnableMenuItem"; File: "Atena.exe") Found reference to API (Indicator: "GetSystemMenu"; File: "Atena.exe") Found reference to API (Indicator: "IsWindowEnabled"; File: "Atena.exe") Found reference to API (Indicator: "SetWindowPos"; File: "Atena.exe") Found reference to API (Indicator: "GetSysColor"; File: "Atena.exe") Found reference to API (Indicator: "SetCursor"; File: "Atena.exe") Found reference to API (Indicator: "LoadCursorW"; File: "Atena.exe") Found reference to API (Indicator: "IsWindowVisible"; File: "Atena.exe") Found reference to API (Indicator: "CloseClipboard"; File: "Atena.exe") Found reference to API (Indicator: "SetClipboardData"; File: "Atena.exe") Found reference to API (Indicator: "EmptyClipboard"; File: "Atena.exe") Found reference to API (Indicator: "OpenClipboard"; File: "Atena.exe") Found reference to API (Indicator: "TrackPopupMenu"; File: "Atena.exe") Found reference to API (Indicator: "AppendMenuW"; File: "Atena.exe") Found reference to API (Indicator: "CreatePopupMenu"; File: "Atena.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "Atena.exe") Found reference to API (Indicator: "CharPrevW"; File: "Atena.exe") Found reference to API (Indicator: "CharNextA"; File: "Atena.exe") Found reference to API (Indicator: "wsprintfA"; File: "Atena.exe") Found reference to API (Indicator: "DispatchMessageW"; File: "Atena.exe") Found reference to API (Indicator: "PeekMessageW"; File: "Atena.exe") Found reference to API (Indicator: "SelectObject"; File: "Atena.exe") Found reference to API (Indicator: "CreateFontIndirectW"; File: "Atena.exe") Found reference to API (Indicator: "DeleteObject"; File: "Atena.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "Atena.exe") Found reference to API (Indicator: "SHFileOperationW"; File: "Atena.exe") Found reference to API (Indicator: "SHGetFileInfoW"; File: "Atena.exe") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "Atena.exe") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "Atena.exe") Found reference to API (Indicator: "ShellExecuteExW"; File: "Atena.exe") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; File: "Atena.exe") Found reference to API (Indicator: "RegEnumValueW"; File: "Atena.exe") Found reference to API (Indicator: "RegEnumKeyW"; File: "Atena.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "Atena.exe") Found reference to API (Indicator: "RegSetValueExW"; File: "Atena.exe") Found reference to API (Indicator: "RegCloseKey"; File: "Atena.exe") Found reference to API (Indicator: "RegDeleteValueW"; File: "Atena.exe") Found reference to API (Indicator: "RegDeleteKeyW"; File: "Atena.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "Atena.exe") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "Atena.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "Atena.exe") Found reference to API (Indicator: "SetFileSecurityW"; File: "Atena.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "Atena.exe") Found reference to API (Indicator: "RegCreateKeyExW"; File: "Atena.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "Atena.exe") Found reference to API (Indicator: "OleUninitialize"; File: "Atena.exe") Found reference to API (Indicator: "OleInitialize"; File: "Atena.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "Atena.exe") Found reference to API (Indicator: "VerQueryValueW"; File: "Atena.exe") Found reference to API (Indicator: "GetFileVersionInfoW"; File: "Atena.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; File: "Atena.exe") Found reference to API (Indicator: "SHGetFolderPathW"; File: "Atena.exe") Found reference to API (Indicator: "RegDeleteKeyExW"; File: "Atena.exe") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "Atena.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "Atena.exe") Found reference to API (Indicator: "SetDefaultDllDirectories"; File: "Atena.exe") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "Atena.exe") Found reference to API (Indicator: "getsockname"; Source: "00000000-00002308.00000000.295185.0055C000.00000004.mdmp, 00000000-00002308.00000000.295185.00580000.00000004.mdmp, 00000000-00002308.00000001.297105.00514000.00000004.mdmp, 00000000-00002308.00000001.297105.0055C000.00000004.mdmp") Found reference to API (Indicator: "getpeername"; Source: "00000000-00002308.00000000.295185.0055C000.00000004.mdmp, 00000000-00002308.00000000.295185.00580000.00000004.mdmp, 00000000-00002308.00000001.297105.00514000.00000004.mdmp, 00000000-00002308.00000001.297105.0055C000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00002308.00000000.295185.5BF10000.00000004.mdmp")46:T6e0,"Software\Microsoft\Windows\CurrentVersion" in Source: Atena.exe "ne\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00002196.00000001.300567.3DFD0000.00000004.mdmp 00000000-00002196.00000002.302485.3DFD0000.00000004.mdmp "y\Machine\Software\Class" in Source: 00000000-00002196.00000001.300567.3DFD0000.00000004.mdmp 00000000-00002196.00000002.302485.3DFD0000.00000004.mdmp "\Machine\Software\Classes\C" in Source: 00000000-00002196.00000001.300567.3DFD0000.00000004.mdmp 00000000-00002196.00000002.302485.3DFD0000.00000004.mdmp "chine\Software\Classes\WOW6" in Source: 00000000-00002196.00000001.300567.3DFD0000.00000004.mdmp 00000000-00002196.00000002.302485.3DFD0000.00000004.mdmp "{ key: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AeDebug', value: 'Debugger' }," in Source: 00000000-00002308.00000000.295185.0007C000.00000004.mdmp 00000000-00002308.00000001.297105.0007C000.00000004.mdmp 00000000-00002308.00000002.299027.0007C000.00000004.mdmp "{ key: 'HKLM\\SOFTWARE\\Classes\\exefile\\shell\\Debug', value: '' }," in Source: 00000000-00002308.00000000.295185.0007C000.00000004.mdmp 00000000-00002308.00000001.297105.0007C000.00000004.mdmp 00000000-00002308.00000002.299027.0007C000.00000004.mdmp "{ key: 'HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run', value: '' }" in Source: 00000000-00002308.00000000.295185.0007C000.00000004.mdmp 00000000-00002308.00000001.297105.0007C000.00000004.mdmp 00000000-00002308.00000002.299027.0007C000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002308.00000000.295185.5BF10000.00000004.mdmp 00000000-00002308.00000002.299027.5BF10000.00000004.mdmp47:T953,Process Atena.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4748:64:WilError_03" Process Atena.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4748:168:WilStaging_02" Process Atena.exe created mutex with name "Local\SM0:4748:168:WilStaging_02" Process Atena.exe created mutex with name "Local\SM0:4748:64:WilError_03" Process Atena.exe created mutex with name "c31d2e09-cba9-5449-bb9b-9701e980ae73" Process Atena.exe created mutex with name "SM0:4748:64:WilError_03" Process Atena.exe created mutex with name "Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults" Process Atena.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4748:64:WilError_03" Process Atena.exe created mutex with name "\Sessions\1\BaseNamedObjects\c31d2e09-cba9-5449-bb9b-9701e980ae73" Process Atena.exe created mutex with name "\Sessions\1\BaseNamedObjects\Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults" Process Atena.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2308:304:WilStaging_02" Process Atena.exe created mutex with name "Local\SM0:2308:304:WilStaging_02" Process Atena.exe created mutex with name "SM0:2308:120:WilError_03" Process Atena.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2308:120:WilError_03" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8140:304:WilStaging_02" Process cmd.exe created mutex with name "Local\SM0:8140:304:WilStaging_02" Process net1.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6180:304:WilStaging_02" Process net1.exe created mutex with name "Local\SM0:6180:304:WilStaging_02" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8908:304:WilStaging_02" Process cmd.exe created mutex with name "Local\SM0:8908:304:WilStaging_02" Process net1.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5688:304:WilStaging_02" Process net1.exe created mutex with name "Local\SM0:5688:304:WilStaging_02" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2724:304:WilStaging_02" Process cmd.exe created mutex with name "Local\SM0:2724:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6836:304:WilStaging_02"48:T10e6,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135] "Atena.exe" failed to load missing module "d3d11.dll" - [base:0; Status:c000000d]49:T621,"d3dcompiler_47.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "ffmpeg.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "dxil.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "vulkan-1.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "libEGL.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "nsis7z.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "elevate.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "StdUtils.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "System.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "SpiderBanner.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT4a:T3732,"ne\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00002196.00000001.300567.3DFD0000.00000004.mdmp "y\Machine\Software\Class" in Source: 00000000-00002196.00000001.300567.3DFD0000.00000004.mdmp "\Machine\Software\Classes\C" in Source: 00000000-00002196.00000001.300567.3DFD0000.00000004.mdmp "chine\Software\Classes\WOW6" in Source: 00000000-00002196.00000001.300567.3DFD0000.00000004.mdmp "ne\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00002196.00000002.302485.3DFD0000.00000004.mdmp "y\Machine\Software\Class" in Source: 00000000-00002196.00000002.302485.3DFD0000.00000004.mdmp "\Machine\Software\Classes\C" in Source: 00000000-00002196.00000002.302485.3DFD0000.00000004.mdmp "chine\Software\Classes\WOW6" in Source: 00000000-00002196.00000002.302485.3DFD0000.00000004.mdmp " { key: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AeDebug', value: 'Debugger' }," in Source: 00000000-00002308.00000000.295185.0007C000.00000004.mdmp " { key: 'HKLM\\SOFTWARE\\Classes\\exefile\\shell\\Debug', value: '' }," in Source: 00000000-00002308.00000000.295185.0007C000.00000004.mdmp " { key: 'HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run', value: '' }" in Source: 00000000-00002308.00000000.295185.0007C000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002308.00000000.295185.5BF10000.00000004.mdmp " { key: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AeDebug', value: 'Debugger' }," in Source: 00000000-00002308.00000001.297105.0007C000.00000004.mdmp " { key: 'HKLM\\SOFTWARE\\Classes\\exefile\\shell\\Debug', value: '' }," in Source: 00000000-00002308.00000001.297105.0007C000.00000004.mdmp " { key: 'HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run', value: '' }" in Source: 00000000-00002308.00000001.297105.0007C000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FF" in Source: 00000000-00002308.00000001.297105.5BF10000.00000004.mdmp " { key: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AeDebug', value: 'Debugger' }," in Source: 00000000-00002308.00000002.299027.0007C000.00000004.mdmp " { key: 'HKLM\\SOFTWARE\\Classes\\exefile\\shell\\Debug', value: '' }," in Source: 00000000-00002308.00000002.299027.0007C000.00000004.mdmp " { key: 'HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run', value: '' }" in Source: 00000000-00002308.00000002.299027.0007C000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002308.00000002.299027.5BF10000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FF" in Source: 00000000-00002308.00000002.299027.5BF10000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{D" in Source: 00000000-00002308.00000002.299027.5BF10000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002308.00000002.299027.5BF10000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0000032A-0000-0000-C000-000000000046}" in Source: 00000000-00002308.00000002.299027.5BF10000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{0000032A-0000-0000-C000-000000000046}" in Source: 00000000-00002308.00000002.299027.5BF10000.00000004.mdmp "Registry\Machine\SOFTWARE\Policies\Microsoft\Windows\Appx" in Source: 00000000-00004504.00000000.298035.355C0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004504.00000000.298035.355C0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00004504.00000000.298035.355C0000.00000004.mdmp "chine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00004504.00000000.298035.355C0000.00000004.mdmp "try\Machine\Software\Classes\W" in Source: 00000000-00004504.00000000.298035.355C0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004504.00000000.298035.355C0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004504.00000000.298035.355C0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004504.00000001.299089.355C0000.00000004.mdmp "try\Machine\Software\Classes\W" in Source: 00000000-00004504.00000001.299089.355C0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004504.00000001.299089.355C0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004504.00000001.299089.355C0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004504.00000001.299089.4F9F0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00004504.00000001.299089.4FCE0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004504.00000001.299089.4FCE0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}" in Source: 00000000-00004504.00000001.299089.4FCE0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00004504.00000001.299089.4FCE0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00004504.00000001.299089.4FD4B000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004504.00000001.299089.4FD4B000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00004504.00000001.299089.4FD4B000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00004504.00000001.299089.4FD4B000.00000004.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00004504.00000001.299089.B4CC3000.00000002.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00004504.00000001.299089.B4CC3000.00000002.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00004504.00000001.299089.B4CC3000.00000002.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates\ManifestedMergeStubSdbs" in Source: 00000000-00005556.00000000.298683.E6FD0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005556.00000000.298683.E6FD0000.00000004.mdmp "Software\Microsoft\Direct3D\Direct3D12" in Source: 00000000-00005556.00000001.300602.94304000.00000002.mdmp "Software\Microsoft\VisualStudio\MSPDB" in Source: 00000000-00005556.00000001.300602.94304000.00000002.mdmp "Found no registry files in HKEY_CURRENT_USER\SOFTWARE\Khronos\Vulkan\ImplicitLayers" in Source: 00000000-00005556.00000002.302522.8A1EF000.00000004.mdmp "SOFTWARE\Khronos\Vulkan\Drivers" in Source: 00000000-00005556.00000002.302522.9B72C000.00000002.mdmp "SOFTWARE\Khronos\Vulkan\ImplicitLayers" in Source: 00000000-00005556.00000002.302522.9B72C000.00000002.mdmp "SOFTWARE\Khronos\Vulkan\ExplicitLayers" in Source: 00000000-00005556.00000002.302522.9B72C000.00000002.mdmp "SOFTWARE\Khronos\Vulkan\LoaderSettings" in Source: 00000000-00005556.00000002.302522.9B72C000.00000002.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates\ManifestedMergeStubSdbs" in Source: 00000000-00005556.00000002.302522.E6FD0000.00000004.mdmp "21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005556.00000002.302522.E6FD0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006180.00000000.295474.CA442000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00006180.00000000.295474.CA442000.00000002.mdmp "E\Software\M" in Source: 00000000-00006836.00000000.296295.D6000000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006836.00000000.296295.D6000000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00006836.00000000.296295.D6000000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00006836.00000001.296916.5E5E3000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00006836.00000001.296916.5E5E3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00006836.00000001.296916.5E5E3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00006836.00000001.296916.5E5E3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00006836.00000001.296916.5E5E3000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00006836.00000001.296916.5E5E3000.00000002.mdmp "E\Software\M" in Source: 00000000-00006836.00000001.296916.D6000000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00006836.00000001.296916.D6000000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006836.00000001.296916.F0550000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006836.00000001.296916.F0550000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006836.00000001.296916.F0809000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00006836.00000001.296916.F0809000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007184.00000000.299575.2A2D0000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00007184.00000000.299575.2A2D0000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00007184.00000000.299575.2A2D0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00007184.00000000.299575.2C540000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00007184.00000000.299575.2C540000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00007184.00000000.299575.2C540000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00007184.00000000.299575.2C540000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00007184.00000000.299575.2C540000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00007184.00000000.299575.2C540000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00007184.00000000.299575.2C540000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00007184.00000000.299575.2C540000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00007184.00000000.299575.5E5E3000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00007184.00000000.299575.5E5E3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00007184.00000000.299575.5E5E3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00007184.00000000.299575.5E5E3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00007184.00000000.299575.5E5E3000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00007184.00000000.299575.5E5E3000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007184.00000001.300233.2A2D0000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00007184.00000001.300233.2A2D0000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00007184.00000001.300233.2A2D0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007184.00000001.300233.44830000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00007184.00000001.300233.44AD0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00007184.00000001.300233.44AD0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}" in Source: 00000000-00007184.00000001.300233.44AD0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007184.00000001.300233.44AD0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{0000032A-0000-0000-C000-000000000046}" in Source: 00000000-00007184.00000001.300233.44AD0000.00000004.mdmp "\Registry\Machine\Software\Class" in Source: 00000000-00007184.00000001.300233.44B48000.00000004.mdmp4b:T555,Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) atena/1.0.0 Chrome/142.0.7444.226 Electron/39.2.6 Safari/537.36" (Indicator: "mozilla/5.0 ("; Source: "00000000-00002196.00000001.300567.00114000.00000004.mdmp") Found string "'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36'" (Indicator: "mozilla/5.0 ("; Source: "00000000-00002308.00000000.295185.0007C000.00000004.mdmp, 00000000-00002308.00000001.297105.0007C000.00000004.mdmp, 00000000-00002308.00000002.299027.0007C000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" (Indicator: "mozilla/5.0 ("; Source: "00000000-00002308.00000001.297105.0007C000.00000004.mdmp, 00000000-00002308.00000002.299027.0007C000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" (Indicator: "user-agent: "; Source: "00000000-00002308.00000001.297105.0007C000.00000004.mdmp, 00000000-00002308.00000002.299027.0007C000.00000004.mdmp") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) atena/1.0.0 Chrome/142.0.7444.226 Electron/39.2.6 Safari/537.36" (Indicator: "mozilla/5.0 ("; Source: "00000000-00002308.00000001.297105.00478000.00000004.mdmp, 00000000-00002308.00000002.299027.00438000.00000004.mdmp")4c:T6d83,"Atena.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 769e0000 "Atena.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 769e0000 "Atena.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 769e0000 "Atena.exe" loaded module "KERNEL32" at base 74e50000 "Atena.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72ad0000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 745b0000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\USERENV.DLL" at base 74630000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\SETUPAPI.DLL" at base 758f0000 "Atena.exe" loaded module "NTDLL.DLL" at base 770b0000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 744e0000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73b60000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 72aa0000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 72a90000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 72a30000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\CLBCATQ.DLL" at base 74dc0000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\NTMARTA.DLL" at base 744b0000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 74da0000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 72a20000 "Atena.exe" loaded module "KERNEL32.DLL" at base 74e50000 "Atena.exe" loaded module "%TEMP%\NSKE0DB.TMP\SYSTEM.DLL" at base 72a10000 "Atena.exe" loaded module "%TEMP%\NSKE0DB.TMP\STDUTILS.DLL" at base 729f0000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\RICHED20.DLL" at base 72970000 "Atena.exe" loaded module "COMCTL32.DLL" at base 74b30000 "Atena.exe" loaded module "RPCRT4.DLL" at base 750d0000 "Atena.exe" loaded module "%TEMP%\NSKE0DB.TMP\SPIDERBANNER.DLL" at base 72780000 "Atena.exe" loaded module "PSAPI" at base 769a0000 "Atena.exe" loaded module "%TEMP%\NSKE0DB.TMP\NSIS7Z.DLL" at base 72700000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 76790000 "Atena.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75f20000 "Atena.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 76270000 "Atena.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 76270000 "Atena.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 76f70000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 76c60000 "Atena.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 74590000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 73270000 "Atena.exe" loaded module "SHELL32.DLL" at base 75190000 "Atena.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73100000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.SYSTEM.LAUNCHER.DLL" at base 722b0000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 731a0000 "Atena.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.FILEEXPLORER.COMMON.DLL" at base 721e0000 "Atena.exe" loaded module "COMBASE.DLL" at base 76420000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75190000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\NTSHRUI.DLL" at base 72160000 "Atena.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.STORAGE.DLL" at base 73270000 "Atena.exe" loaded module "CSCAPI.DLL" at base 739f0000 "Atena.exe" loaded module "%TEMP%\NSKE0DB.TMP\WINSHELL.DLL" at base 10000000 "Atena.exe" loaded module "%WINDIR%\SYSWOW64\OLEAUT32.DLL" at base 75850000 "Atena.exe" loaded module "OLEAUT32" at base 75850000 "Atena.exe" loaded module "%WINDIR%\SYSWOW64\ONECORECOMMONPROXYSTUB.DLL" at base 72080000 "Atena.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 72d60000 "Atena.exe" loaded module "KERNEL32" at base 7ff8c4300000 "Atena.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff8c2d40000 "Atena.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff8c2d40000 "Atena.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff8c2d40000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ff8c5010000 "Atena.exe" loaded module "KERNEL32.DLL" at base 7ff8c4300000 "Atena.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff8c2d40000 "Atena.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff8c2d40000 "Atena.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff8c2d40000 "Atena.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff899510000 "Atena.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ff8c2d40000 "Atena.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7ff8c3330000 "Atena.exe" loaded module "POWRPROF.DLL" at base 7ff8c29c0000 "Atena.exe" loaded module "USER32.DLL" at base 7ff8c3e20000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff8c0120000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff8c1fb0000 "Atena.exe" loaded module "SHELL32.DLL" at base 7ff8c4430000 "Atena.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 7ff8c5590000 "Atena.exe" loaded module "ADVAPI32.DLL" at base 12e5c3e0000 "Atena.exe" loaded module "KBDUS.DLL" at base 7ff8b4d60000 "Atena.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff8c3950000 "Atena.exe" loaded module "API-MS-WIN-SHCORE-SCALING-L1-1-1.DLL" at base 7ff8c5590000 "Atena.exe" loaded module "OLE32.DLL" at base 7ff8c4d80000 "Atena.exe" loaded module "OLEAUT32.DLL" at base 7ff8c4f30000 "Atena.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ff8c1b40000 "Atena.exe" loaded module "NTDLL.DLL" at base 7ff8c56d0000 "Atena.exe" loaded module "KERNELBASE" at base 7ff8c2d40000 "Atena.exe" loaded module "BCRYPTPRIMITIVES" at base 7ff8c3330000 "Atena.exe" loaded module "RPCRT4.DLL" at base 7ff8c3550000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ff8b9e50000 "Atena.exe" loaded module "COMCTL32.DLL" at base 7ff8a9340000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ff8bafa0000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\NLANSP_C.DLL" at base 7ff8b3220000 "Atena.exe" loaded module "GDI32.DLL" at base 7ff8c3ce0000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ff8c3fd0000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ff8c4d80000 "Atena.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff8c3950000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.UI.DLL" at base 7ff8b20b0000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\MMDEVAPI.DLL" at base 7ff8ba870000 "Atena.exe" loaded module "WTSAPI32.DLL" at base 7ff8bc5e0000 "Atena.exe" loaded module "CFGMGR32.DLL" at base 7ff8c26f0000 "Atena.exe" loaded module "MSCMS.DLL" at base 7ff8bb830000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff8c1ab0000 "Atena.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 7ff8c2d40000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 7ff8be140000 "Atena.exe" loaded module "API-MS-WIN-POWER-BASE-L1-1-0.DLL" at base 7ff8c29c0000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 7ff8ba600000 "cmd.exe" loaded module "KERNEL32" at base 7ff8c4300000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff8c2d40000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff8c2d40000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff8c2d40000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ff8c5010000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff8c2d40000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff8c2d40000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff8c2d40000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff899510000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ff8c4300000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ff8c56d0000 "cmd.exe" loaded module "KERNELBASE" at base 7ff8c2d40000 "cmd.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ff8c1b40000 "net1.exe" loaded module "KERNEL32" at base 7ff8c4300000 "net1.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff8c2d40000 "net1.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff8c2d40000 "net1.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff8c2d40000 "net1.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ff8c5010000 "net1.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff8c2d40000 "net1.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff8c2d40000 "net1.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff8c2d40000 "net1.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff899510000 "net1.exe" loaded module "RPCRT4.DLL" at base 7ff8c3550000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff8c2d40000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff8c2d40000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff8c2d40000 "powershell.exe" loaded module "KERNEL32" at base 7ff8c4300000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff899510000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ff8c4300000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ff8c40f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff899470000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ff8c4c90000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff8c1b40000 "powershell.exe" loaded module "VERSION.DLL" at base 7ff8b7e50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ff894430000 "powershell.exe" loaded module "USER32.DLL" at base 7ff8c3e20000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ff8c2d40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ff89d0b0000 "powershell.exe" loaded module "NTDLL" at base 7ff8c56d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff8c3950000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ff8c3550000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\3B9003E4F27D92E40668F0EFAD11E022\MSCORLIB.NI.DLL" at base 7ff892110000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 7ff8c4d80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff8c3950000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ff8c4f30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\CE0FD4F5B50BAA17E7B80E4EE874AD11\SYSTEM.NI.DLL" at base 7ff8914f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\990501E6199819806F01C8ECAC88BAAC\SYSTEM.CORE.NI.DLL" at base 7ff890a60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\86AF2F4F2745738837C95F24472C32CA\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ff8992f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff8c1ab0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 189d82d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\EA893D7E336A196C927C3F1251A1D1A9\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ff88e9e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 7ff8c3950000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff8c3950000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 7ff8c56d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "PSAPI.DLL" at base 7ff8c3e10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 7ff8c4430000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ff8c2af0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff8c3190000 "powershell.exe" loaded module "AMSI.DLL" at base 7ff8b4d10000 "powershell.exe" loaded module "WLDP.DLL" at base 7ff8c22e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff8b7e50000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPOAV.DLL" at base 7ff8b4c90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ff89e670000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ff89d090000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7ff89a0e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PWRSHSIP.DLL" at base 7ff8c0030000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ff8c3190000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\DJ1S0U3S.DLL" at base 7ff899280000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\F4889FA032F8023FE280A54700D6D3A5\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ff8991e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff898040000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\F0078C8C05B31633E5966C5629E65602\SYSTEM.XML.NI.DLL" at base 7ff88e130000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\6287E09015A311A64C4FE0304818F8C3\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff897ed0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\2D1FF2AB3131DE6A507F22CCC53B273A\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ff897d60000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\VERSION.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\BF3D2E6042D943E0FEC9CCC0D72C8F3B\SYSTEM.DATA.NI.DLL" at base 7ff88d7a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ff8940c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ff8c23d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ff8c2d40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff897b70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\49750EA038273F75321E479EF1525D1E\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ff8986c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\DD0ED795D7234A2AE4314DE052867161\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ff897a90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ff898670000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 7ff8b7860000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ff8c1d90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff8c0120000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPCLIENT.DLL" at base 7ff8b8c50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ff8c4300000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff8c40f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ff8c3950000 "powershell.exe" loaded module "OLEAUT32" at base 7ff8c4f30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\9494EDA0C9AF503CB61FE450B5BA9C1A\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ff897420000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.M870D558A#\199F66BC1A6FE937DEB9E320CBCAACD7\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 7ff8979e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 7ff8c2d40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MSVCRT.DLL" at base 0 "powershell.exe" loaded module "MSVCRT.DLL" at base 7ff8c41a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 0 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 7ff8b3210000 "powershell.exe" loaded module "MI.DLL" at base 7ff8b7370000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MI.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 7ff8c2d40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WMIDCOM.DLL" at base 7ff8b69c0000 "powershell.exe" loaded module "GDI32.DLL" at base 7ff8c3ce0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ff8c2d40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ff8b6210000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ff8b52d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ff8c2d40000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ff8c2d40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ff8b57a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 7ff8c4300000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 7ff8c2d40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 21437630000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ff89d090000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ff89b980000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7ff899280000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PWRSHSIP.DLL" at base 7ff8b3210000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\DJ1S0U3S.DLL" at base 7ff8b3a50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\F4889FA032F8023FE280A54700D6D3A5\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ff8b39b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\6287E09015A311A64C4FE0304818F8C3\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff89db00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\2D1FF2AB3131DE6A507F22CCC53B273A\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ff89d990000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff89d850000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ff89c9e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff898050000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\49750EA038273F75321E479EF1525D1E\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ff8b3940000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\DD0ED795D7234A2AE4314DE052867161\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ff8991a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ff8b6a90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\9494EDA0C9AF503CB61FE450B5BA9C1A\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ff897e10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.M870D558A#\199F66BC1A6FE937DEB9E320CBCAACD7\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 7ff89b460000 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 7ff8c00d0000 "Atena.exe" loaded module "ADVAPI32.DLL" at base 2ad3e430000 "Atena.exe" loaded module "ADVAPI32.DLL" at base 173e7200000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\DXCORE.DLL" at base 7ff8c0200000 "Atena.exe" loaded module "DXGI.DLL" at base 7ff8c0250000 "Atena.exe" loaded module "EXT-MS-WIN-CORE-RESOURCEPOLICY-L1-1-0.DLL" at base 7ff8c05b0000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\MF.DLL" at base 7ff8b38b0000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\MFPLAT.DLL" at base 7ff8ae120000 "Atena.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\ATENA\D3DCOMPILER_47.DLL" at base 7ff893fa0000 "Atena.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\ATENA\LIBGLESV2.DLL" at base 7ff886d40000 "Atena.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\ATENA\LIBEGL.DLL" at base 7ff8b3040000 "Atena.exe" loaded module "DWMAPI.DLL" at base 7ff8c0530000 "Atena.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\ATENA\VULKAN-1.DLL" at base 7ff89b690000 "Atena.exe" loaded module "%WINDIR%\SYSTEM32\DXGI.DLL" at base 7ff8c0250000 "Atena.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\ATENA\.\.\VK_SWIFTSHADER.DLL" at base 7ff8939d0000 "Atena.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\ATENA\VK_SWIFTSHADER.DLL" at base 7ff8939d0000 "Atena.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\ATENA\DXIL.DLL" at base 7ff89b510000 "Atena.exe" loaded module "%LOCALAPPDATA%\PROGRAMS\ATENA\DXCOMPILER.DLL" at base 7ff885450000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff8b3990000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ff8b3a30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\86AF2F4F2745738837C95F24472C32CA\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ff89daf0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 24f2c090000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\DJ1S0U3S.DLL" at base 7ff8b6aa0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\F4889FA032F8023FE280A54700D6D3A5\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ff89da50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ff8b3970000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ff8b3950000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7ff89da00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PWRSHSIP.DLL" at base 7ff8b6a90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\6287E09015A311A64C4FE0304818F8C3\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff89d890000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\2D1FF2AB3131DE6A507F22CCC53B273A\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ff89cbe0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff89caa0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ff897e10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff89b3e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\49750EA038273F75321E479EF1525D1E\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ff89d0b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\DD0ED795D7234A2AE4314DE052867161\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ff89c9c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ff89b390000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\9494EDA0C9AF503CB61FE450B5BA9C1A\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ff897a60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.M870D558A#\199F66BC1A6FE937DEB9E320CBCAACD7\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 7ff899460000 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 7ff8b3940000 "Atena.exe" loaded module "ADVAPI32.DLL" at base 1ae0ce30000 "Atena.exe" loaded module "D3D11.DLL" at base 0 "Atena.exe" loaded module "D3D11.DLL" at base 7ff8bf3700004d:T796,"Atena.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "Atena.exe" was detected as "Microsoft Linker" and name: "Linker" "d3dcompiler_47.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "d3dcompiler_47.dll" was detected as "Microsoft Linker" and name: "Linker" "ffmpeg.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "ffmpeg.dll" was detected as "Microsoft Linker" and name: "Linker" "dxil.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "dxil.dll" was detected as "Microsoft Linker" and name: "Linker" "vulkan-1.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "vulkan-1.dll" was detected as "Microsoft Linker" and name: "Linker" "libEGL.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "libEGL.dll" was detected as "Microsoft Linker" and name: "Linker" "nsis7z.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "nsis7z.dll" was detected as "Microsoft Linker" and name: "Linker" "elevate.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "elevate.exe" was detected as "Microsoft Linker" and name: "Linker" "StdUtils.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "StdUtils.dll" was detected as "Microsoft Linker" and name: "Linker" "System.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "System.dll" was detected as "Microsoft Linker" and name: "Linker" "SpiderBanner.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "SpiderBanner.dll" was detected as "Microsoft Linker" and name: "Linker" "WinShell.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "WinShell.dll" was detected as "Microsoft Linker" and name: "Linker"4e:T1181,"Atena.exe" touched "ShellWindows" (Path: "HKCU\WOW6432NODE\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\TREATAS") "Atena.exe" touched "PSOAInterface" (Path: "HKCU\WOW6432NODE\CLSID\{00020424-0000-0000-C000-000000000046}\TREATAS") "Atena.exe" touched "PSDispatch" (Path: "HKCU\WOW6432NODE\CLSID\{00020420-0000-0000-C000-000000000046}\TREATAS") "Atena.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "Atena.exe" touched "Recycle Bin Manager" (Path: "HKCU\WOW6432NODE\CLSID\{4A04656D-52AA-49DE-8A09-CB178760E748}\INSTANCE") "Atena.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "Atena.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "Atena.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "Atena.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\TREATAS") "Atena.exe" touched "Shell Copy Hook" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{217FC9C0-3AEA-1069-A2DB-08002B30309D}\INPROCSERVER32") "Atena.exe" touched "Shell extensions for sharing" (Path: "HKCU\WOW6432NODE\CLSID\{40DD6E20-7C17-11CE-A804-00AA003CA9F6}\INSTANCE") "Atena.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "Atena.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "Atena.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "Atena.exe" touched "Known Folder Manager" (Path: "HKCU\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "Atena.exe" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "Atena.exe" touched "Property Store over folder final" (Path: "HKCU\WOW6432NODE\CLSID\{0340F119-A598-4ED9-B0AC-6F6A12D3E755}\TREATAS") "Atena.exe" touched "Search Gatherer Notification" (Path: "HKCU\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\TREATAS") "Atena.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "Atena.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}") "Atena.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\TREATAS") "Atena.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\TREATAS") "Atena.exe" touched "TF_InputProcessorProfiles" (Path: "HKCU\CLSID\{33C53A50-F456-4884-B049-85FD643ECFED}\TREATAS") "Atena.exe" touched "TF_ThreadMgr" (Path: "HKCU\CLSID\{529A9E6B-6587-4F23-AB9E-9C7D683E3C50}\TREATAS") "Atena.exe" touched "TF_CategoryMgr" (Path: "HKCU\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\TREATAS") "Atena.exe" touched "TF_DisplayAttributeMgr" (Path: "HKCU\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\TREATAS") "Atena.exe" touched "MMDeviceEnumerator class" (Path: "HKCU\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\TREATAS") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS")4f:T5ab,Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\cmd.exe" [Source: 00000000-00002308-00000BC0-3607754408] Observed system executable string:"%WINDIR%\system32\cmd.exe" [Source: 00000000-00002308-00000BC0-3607756967] Observed system executable string:"%WINDIR%\system32\cmd.exe /d /s /c "net session"" [Source: 00000000-00002308-00000C47-6627246452] Observed system executable string:"%WINDIR%\system32\cmd.exe /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\SystemD" [Source: 00000000-00002308-00000C47-37763526810] Observed system executable string:"%WINDIR%\system32\cmd.exe /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath '%TEMP%\at" [Source: 00000000-00002308-00000C47-101157816568] Observed system executable string:"%WINDIR%\system32\net.exe" [Source: 00000000-00008140-00000C47-2286829114] Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\conhost.exe" [Source: 00000000-00008140-00000BC0-3607870136] Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\net.exe" [Source: 00000000-00008140-00000BC0-3608871047] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00002724-00000C47-2871158108] Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00002724-00000BC0-3622124577]50:Ta09,Process "Atena.exe" (UID: 00000000-00002308) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-8LD9T6N"" Process "Atena.exe" (UID: 00000000-00002308) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, PSModulePath, CommonProgramFiles, Path, PATHEXT, ProgramFiles" Process "Atena.exe" (UID: 00000000-00002308) was launched with missing environment variables: "PROMPT, PROCESSOR_ARCHITEW6432" Process "net.exe" (UID: 00000000-00003224) was launched with new environment variables: "PROMPT="$P$G"" Process "net.exe" (UID: 00000000-00003224) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00008908) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00008908) was launched with missing environment variables: "PROMPT" Process "net.exe" (UID: 00000000-00006032) was launched with new environment variables: "PROMPT="$P$G"" Process "net.exe" (UID: 00000000-00006032) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00002724) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00002724) was launched with missing environment variables: "PROMPT" Process "powershell.exe" (UID: 00000000-00006836) was launched with new environment variables: "PROMPT="$P$G"" Process "powershell.exe" (UID: 00000000-00006836) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00007140) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00007140) was launched with missing environment variables: "PROMPT" Process "powershell.exe" (UID: 00000000-00004504) was launched with new environment variables: "PROMPT="$P$G"" Process "powershell.exe" (UID: 00000000-00004504) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "Atena.exe" (UID: 00000000-00002196) was launched with missing environment variables: "PROMPT" Process "cmd.exe" (UID: 00000000-00005460) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "powershell.exe" (UID: 00000000-00007184) was launched with new environment variables: "PROMPT="$P$G"" Process "powershell.exe" (UID: 00000000-00007184) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "Atena.exe" (UID: 00000000-00005824) was launched with missing environment variables: "PROMPT"51:T471,"Atena.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Atena.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Atena.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Atena.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\GEO"; Key: "NAME") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "net1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "net1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH")52:Td4d,Observed system executable string:"%WINDIR%\system32\UXTHEME.dll" [Source: 00000000-00004748-00000C2B-3575975540] Observed system executable string:"%WINDIR%\system32\USERENV.dll" [Source: 00000000-00004748-00000C2B-3576012712] Observed system executable string:"%WINDIR%\system32\SETUPAPI.dll" [Source: 00000000-00004748-00000C2B-3576059253] Observed system executable string:"%WINDIR%\system32\APPHELP.dll" [Source: 00000000-00004748-00000C2B-3576165499] Observed system executable string:"%WINDIR%\system32\PROPSYS.dll" [Source: 00000000-00004748-00000C2B-3576207083] Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00004748-00000C2B-3576246342] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00004748-00000C2B-3576309337] Observed system executable string:"%WINDIR%\system32\OLEACC.dll" [Source: 00000000-00004748-00000C2B-3576348460] Observed system executable string:"%WINDIR%\system32\CLBCATQ.dll" [Source: 00000000-00004748-00000C2B-3576386163] Observed system executable string:"%WINDIR%\system32\NTMARTA.dll" [Source: 00000000-00004748-00000C2B-3576424782] Observed system executable string:"%WINDIR%\system32\VERSION.dll" [Source: 00000000-00004748-00000C2B-3576461322] Observed system executable string:"%WINDIR%\system32\SHFOLDER.dll" [Source: 00000000-00004748-00000C2B-3576499653] Observed system executable string:"%WINDIR%\system32\RichEd20.dll" [Source: 00000000-00004748-00000C2B-3577370846] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00006836-00000C2E-1706004534] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00006836-00000C2B-3624027369] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00006836-00000C2B-3624186100] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00006836-00000C2B-3624293224] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll" [Source: 00000000-00006836-00000C2B-3624800664] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00006836-00000C2B-3624889525] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00006836-00000C2B-3624985774] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00006836-00000C2B-3625111022] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll" [Source: 00000000-00006836-00000C2B-3625203428] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll" [Source: 00000000-00006836-00000C2B-3625338155] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00006836-00000C2B-3625435891] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00006836-00000C2B-3625759408]53:T773,Spawned process "Atena.exe" (UID: 00000000-00002308) Spawned process "cmd.exe" with commandline "/d /s /c "net session"" (UID: 00000000-00008140) Spawned process "net.exe" with commandline "net session" (UID: 00000000-00003224) Spawned process "net1.exe" with commandline "%WINDIR%\\system32\\net1 session" (UID: 00000000-00006180) Spawned process "cmd.exe" with commandline "/d /s /c "net session"" (UID: 00000000-00008908) Spawned process "net.exe" with commandline "net session" (UID: 00000000-00006032) Spawned process "net1.exe" with commandline "%WINDIR%\\system32\\net1 session" (UID: 00000000-00005688) Spawned process "cmd.exe" with commandline "/d /s /c "powershell -Command "Add-MpPreference -ExclusionPath ' ..." (UID: 00000000-00002724) Spawned process "powershell.exe" with commandline "powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPP ..." (UID: 00000000-00006836), Spawned process "cmd.exe" with commandline "/d /s /c "powershell -Command "Add-MpPreference -ExclusionPath ' ..." (UID: 00000000-00007140), Spawned process "powershell.exe" with commandline "powershell -Command "Add-MpPreference -ExclusionPath '%TEMP%\\a ..." (UID: 00000000-00004504) Spawned process "Atena.exe" with commandline ""%APPDATA%\\atena" --field-trial-handle=1824,i,14591210823481219 ..." (UID: 00000000-00002196) Spawned process "Atena.exe" with commandline ""%APPDATA%\\atena" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00005556) Spawned process "cmd.exe" with commandline "/d /s /c "powershell -Command "Add-MpPreference -ExclusionPath ' ..." (UID: 00000000-00005460) Spawned process "powershell.exe" with commandline "powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPP ..." (UID: 00000000-00007184), Spawned process "Atena.exe" with commandline ""%APPDATA%\\atena" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAA ..." (UID: 00000000-00005824)54:T773,Spawned process "Atena.exe" (UID: 00000000-00002308) Spawned process "cmd.exe" with commandline "/d /s /c "net session"" (UID: 00000000-00008140) Spawned process "net.exe" with commandline "net session" (UID: 00000000-00003224) Spawned process "net1.exe" with commandline "%WINDIR%\\system32\\net1 session" (UID: 00000000-00006180) Spawned process "cmd.exe" with commandline "/d /s /c "net session"" (UID: 00000000-00008908) Spawned process "net.exe" with commandline "net session" (UID: 00000000-00006032) Spawned process "net1.exe" with commandline "%WINDIR%\\system32\\net1 session" (UID: 00000000-00005688) Spawned process "cmd.exe" with commandline "/d /s /c "powershell -Command "Add-MpPreference -ExclusionPath ' ..." (UID: 00000000-00002724) Spawned process "powershell.exe" with commandline "powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPP ..." (UID: 00000000-00006836), Spawned process "cmd.exe" with commandline "/d /s /c "powershell -Command "Add-MpPreference -ExclusionPath ' ..." (UID: 00000000-00007140), Spawned process "powershell.exe" with commandline "powershell -Command "Add-MpPreference -ExclusionPath '%TEMP%\\a ..." (UID: 00000000-00004504) Spawned process "Atena.exe" with commandline ""%APPDATA%\\atena" --field-trial-handle=1824,i,14591210823481219 ..." (UID: 00000000-00002196) Spawned process "Atena.exe" with commandline ""%APPDATA%\\atena" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00005556) Spawned process "cmd.exe" with commandline "/d /s /c "powershell -Command "Add-MpPreference -ExclusionPath ' ..." (UID: 00000000-00005460) Spawned process "powershell.exe" with commandline "powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPP ..." (UID: 00000000-00007184), Spawned process "Atena.exe" with commandline ""%APPDATA%\\atena" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAA ..." (UID: 00000000-00005824)55:T3544,"vk_swiftshader.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections"- Location: [%TEMP%\nskE0DB.tmp\7z-out\vk_swiftshader.dll]- [targetUID: 00000000-00004748] "Atena.exe" has type "PE32+ executable for MS Windows 10.00 (GUI) x86-64 14 sections"- Location: [%TEMP%\nskE0DB.tmp\7z-out\Atena.exe]- [targetUID: 00000000-00004748] "dxcompiler.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections"- Location: [%TEMP%\nskE0DB.tmp\7z-out\dxcompiler.dll]- [targetUID: 00000000-00004748] "libGLESv2.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections"- Location: [%TEMP%\nskE0DB.tmp\7z-out\libGLESv2.dll]- [targetUID: 00000000-00004748] "d3dcompiler_47.dll" has type "PE32+ executable for MS Windows 6.02 (DLL) x86-64 8 sections"- Location: [%TEMP%\nskE0DB.tmp\7z-out\d3dcompiler_47.dll]- [targetUID: 00000000-00004748] "ffmpeg.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\nskE0DB.tmp\7z-out\ffmpeg.dll]- [targetUID: 00000000-00004748] "dxil.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nskE0DB.tmp\7z-out\dxil.dll]- [targetUID: 00000000-00004748] "vulkan-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections"- Location: [%TEMP%\nskE0DB.tmp\7z-out\vulkan-1.dll]- [targetUID: 00000000-00004748] "v8_context_snapshot.bin" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\v8_context_snapshot.bin]- [targetUID: 00000000-00004748] "libEGL.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections"- Location: [%TEMP%\nskE0DB.tmp\7z-out\libEGL.dll]- [targetUID: 00000000-00004748] "nsis7z.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nskE0DB.tmp\nsis7z.dll]- [targetUID: 00000000-00004748] "snapshot_blob.bin" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\snapshot_blob.bin]- [targetUID: 00000000-00004748] "Uninstall Atena.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Nullsoft Installer self-extracting archive 5 sections"- Location: [%LOCALAPPDATA%\Programs\atena\Uninstall Atena.exe]- [targetUID: 00000000-00004748] "elevate.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 6 sections"- Location: [%TEMP%\nskE0DB.tmp\7z-out\resources\elevate.exe]- [targetUID: 00000000-00004748] "StdUtils.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nskE0DB.tmp\StdUtils.dll]- [targetUID: 00000000-00004748] "System.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nskE0DB.tmp\System.dll]- [targetUID: 00000000-00004748] "SpiderBanner.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nskE0DB.tmp\SpiderBanner.dll]- [targetUID: 00000000-00004748] "WinShell.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 2 sections"- Location: [%TEMP%\nskE0DB.tmp\WinShell.dll]- [targetUID: 00000000-00004748] "Atena.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Has Working directory Icon number=0 Unicoded HasExpIcon "%USERPROFILE%\AppData\Local\Programs\atena\Atena.exe" MachineID 7zysmaqdekxouef KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Archive ctime=Mon Dec 8 05:40:34 2025 atime=Mon Dec 8 05:40:34 2025 mtime=Sun Dec 7 19:44:56 2025 length=211101184 window=normal IDListSize 0x0214 Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\AppData\Local\Programs\atena\Atena.exe""- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Atena.lnk]- [targetUID: 00000000-00004748] "Atena.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Has Working directory Icon number=0 Unicoded HasExpIcon "%USERPROFILE%\AppData\Local\Programs\atena\Atena.exe" MachineID 7zysmaqdekxouef KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Archive ctime=Mon Dec 8 05:40:34 2025 atime=Mon Dec 8 05:40:38 2025 mtime=Sun Dec 7 19:44:56 2025 length=211101184 window=normal IDListSize 0x0214 Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\AppData\Local\Programs\atena\Atena.exe""- Location: [%USERPROFILE%\Desktop\Atena.lnk]- [targetUID: 00000000-00004748] "__PSScriptPolicyTest_5aedeie4.ymc.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_5aedeie4.ymc.ps1]- [targetUID: 00000000-00004504] "resources.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\resources.pak]- [targetUID: 00000000-00004748] "icudtl.dat" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\icudtl.dat]- [targetUID: 00000000-00004748] "LICENSES.chromium.html" has type "HTML document text HTML document ASCII text"- Location: [%TEMP%\nskE0DB.tmp\7z-out\LICENSES.chromium.html]- [targetUID: 00000000-00004748] "app-64.7z" has type "7-zip archive data version 0.4"- Location: [%TEMP%\nskE0DB.tmp\app-64.7z]- [targetUID: 00000000-00004748] "ml.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\ml.pak]- [targetUID: 00000000-00004748] "ta.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\ta.pak]- [targetUID: 00000000-00004748] "kn.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\kn.pak]- [targetUID: 00000000-00004748] "te.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\te.pak]- [targetUID: 00000000-00004748] "hi.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\hi.pak]- [targetUID: 00000000-00004748] "bn.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\bn.pak]- [targetUID: 00000000-00004748] "gu.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\gu.pak]- [targetUID: 00000000-00004748] "mr.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\mr.pak]- [targetUID: 00000000-00004748] "th.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\th.pak]- [targetUID: 00000000-00004748] "el.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\el.pak]- [targetUID: 00000000-00004748] "uk.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\uk.pak]- [targetUID: 00000000-00004748] "ru.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\ru.pak]- [targetUID: 00000000-00004748] "bg.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\bg.pak]- [targetUID: 00000000-00004748] "ar.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\ar.pak]- [targetUID: 00000000-00004748] "sr.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\sr.pak]- [targetUID: 00000000-00004748] "fa.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\fa.pak]- [targetUID: 00000000-00004748] "ur.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\ur.pak]- [targetUID: 00000000-00004748] "am.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\am.pak]- [targetUID: 00000000-00004748] "he.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\he.pak]- [targetUID: 00000000-00004748] "ja.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\ja.pak]- [targetUID: 00000000-00004748] "vi.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\vi.pak]- [targetUID: 00000000-00004748] "lt.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\lt.pak]- [targetUID: 00000000-00004748] "lv.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\lv.pak]- [targetUID: 00000000-00004748] "hu.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\hu.pak]- [targetUID: 00000000-00004748] "fr.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\fr.pak]- [targetUID: 00000000-00004748] "sk.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\sk.pak]- [targetUID: 00000000-00004748] "cs.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\cs.pak]- [targetUID: 00000000-00004748] "pl.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\pl.pak]- [targetUID: 00000000-00004748] "fil.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\fil.pak]- [targetUID: 00000000-00004748] "ro.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\ro.pak]- [targetUID: 00000000-00004748] "sl.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\sl.pak]- [targetUID: 00000000-00004748] "de.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\de.pak]- [targetUID: 00000000-00004748] "ca.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\ca.pak]- [targetUID: 00000000-00004748] "ko.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\ko.pak]- [targetUID: 00000000-00004748] "hr.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\hr.pak]- [targetUID: 00000000-00004748] "es-419.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\es-419.pak]- [targetUID: 00000000-00004748] "es.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\es.pak]- [targetUID: 00000000-00004748] "pt-PT.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\pt-PT.pak]- [targetUID: 00000000-00004748] "pt-BR.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\pt-BR.pak]- [targetUID: 00000000-00004748] "tr.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\tr.pak]- [targetUID: 00000000-00004748] "it.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\it.pak]- [targetUID: 00000000-00004748] "sw.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\sw.pak]- [targetUID: 00000000-00004748] "da.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\da.pak]- [targetUID: 00000000-00004748] "ms.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\ms.pak]- [targetUID: 00000000-00004748] "nl.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\nl.pak]- [targetUID: 00000000-00004748] "fi.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\fi.pak]- [targetUID: 00000000-00004748] "sv.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\sv.pak]- [targetUID: 00000000-00004748] "et.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\et.pak]- [targetUID: 00000000-00004748] "nb.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\nb.pak]- [targetUID: 00000000-00004748] "af.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\af.pak]- [targetUID: 00000000-00004748] "id.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\id.pak]- [targetUID: 00000000-00004748] "zh-CN.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\zh-CN.pak]- [targetUID: 00000000-00004748] "en-US.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\en-US.pak]- [targetUID: 00000000-00004748] "zh-TW.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\zh-TW.pak]- [targetUID: 00000000-00004748] "en-GB.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\locales\en-GB.pak]- [targetUID: 00000000-00004748] "app.asar" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\resources\app.asar]- [targetUID: 00000000-00004748] "chrome_200_percent.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\chrome_200_percent.pak]- [targetUID: 00000000-00004748] "chrome_100_percent.pak" has type "data"- Location: [%TEMP%\nskE0DB.tmp\7z-out\chrome_100_percent.pak]- [targetUID: 00000000-00004748] "F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx" has type "data"- [targetUID: N/A] "error.log" has type "ASCII text"- Location: [%LOCALAPPDATA%\errorlx\error.log]- [targetUID: 00000000-00002308] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00004504] "LICENSE.electron.txt" has type "ASCII text"- Location: [%TEMP%\nskE0DB.tmp\7z-out\LICENSE.electron.txt]- [targetUID: 00000000-00004748] "F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val" has type "data"- [targetUID: N/A] "07f95e8e-77a9-42f3-aa0b-accaee4103a0.tmp" has type "JSON text data"- Location: [%APPDATA%\atena\07f95e8e-77a9-42f3-aa0b-accaee4103a0.tmp]- [targetUID: 00000000-00002308] "cache.json" has type "JSON text data"- Location: [%TEMP%\cache.json]- [targetUID: 00000000-00002308] "F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock" has type "ASCII text with no line terminators"- [targetUID: N/A] "__PSScriptPolicyTest_kw32b3ei.ufk.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_kw32b3ei.ufk.ps1]- [targetUID: 00000000-00006836] "__PSScriptPolicyTest_wetodyjo.jwb.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_wetodyjo.jwb.ps1]- [targetUID: 00000000-00007184] "__PSScriptPolicyTest_kr0mjhdg.jwl.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_kr0mjhdg.jwl.psm1]- [targetUID: 00000000-00007184] "__PSScriptPolicyTest_probpi1p.lmz.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_probpi1p.lmz.psm1]- [targetUID: 00000000-00006836] "__PSScriptPolicyTest_sgddexsh.krk.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_sgddexsh.krk.psm1]- [targetUID: 00000000-00004504]56:Ta91,"Atena.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME"; Key: ""; Value: "") "Atena.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID"; Key: ""; Value: "") "Atena.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: ""; Value: "") "Atena.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\CUSTOMATTRIBUTES"; Key: ""; Value: "") "Atena.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\DIAGNOSIS"; Key: ""; Value: "") "Atena.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER"; Key: ""; Value: "") "Atena.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: ""; Value: "") "Atena.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY\CUSTOMATTRIBUTES"; Key: ""; Value: "") "Atena.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "Atena.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "Atena.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "Atena.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "Atena.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TREATASCLASSINDEX\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "Atena.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "Atena.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "Atena.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "Atena.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "Atena.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "Atena.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TREATASCLASSINDEX\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "Atena.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "")57:T8bb,"vk_swiftshader.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections"- Location: [%TEMP%\nskE0DB.tmp\7z-out\vk_swiftshader.dll]- [targetUID: 00000000-00004748] "dxcompiler.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections"- Location: [%TEMP%\nskE0DB.tmp\7z-out\dxcompiler.dll]- [targetUID: 00000000-00004748] "libGLESv2.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections"- Location: [%TEMP%\nskE0DB.tmp\7z-out\libGLESv2.dll]- [targetUID: 00000000-00004748] "d3dcompiler_47.dll" has type "PE32+ executable for MS Windows 6.02 (DLL) x86-64 8 sections"- Location: [%TEMP%\nskE0DB.tmp\7z-out\d3dcompiler_47.dll]- [targetUID: 00000000-00004748] "ffmpeg.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\nskE0DB.tmp\7z-out\ffmpeg.dll]- [targetUID: 00000000-00004748] "dxil.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nskE0DB.tmp\7z-out\dxil.dll]- [targetUID: 00000000-00004748] "vulkan-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections"- Location: [%TEMP%\nskE0DB.tmp\7z-out\vulkan-1.dll]- [targetUID: 00000000-00004748] "libEGL.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections"- Location: [%TEMP%\nskE0DB.tmp\7z-out\libEGL.dll]- [targetUID: 00000000-00004748] "nsis7z.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nskE0DB.tmp\nsis7z.dll]- [targetUID: 00000000-00004748] "StdUtils.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nskE0DB.tmp\StdUtils.dll]- [targetUID: 00000000-00004748] "System.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nskE0DB.tmp\System.dll]- [targetUID: 00000000-00004748] "SpiderBanner.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nskE0DB.tmp\SpiderBanner.dll]- [targetUID: 00000000-00004748] "WinShell.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 2 sections"- Location: [%TEMP%\nskE0DB.tmp\WinShell.dll]- [targetUID: 00000000-00004748]58:Tf27,"Atena.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATIONTYPE"; Value: "") "Atena.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "SERVER"; Value: "") "Atena.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "DLLPATH"; Value: "") "Atena.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "THREADING"; Value: "") "Atena.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "TRUSTLEVEL"; Value: "") "Atena.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "REMOTESERVER"; Value: "") "Atena.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEASUSER"; Value: "") "Atena.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINSHAREDBROKER"; Value: "") "Atena.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINBROKERFORMEDIUMILCONTAINER"; Value: "") "Atena.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "PERMISSIONS"; Value: "") "Atena.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEONHOSTFLAGS"; Value: "") "Atena.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXEPATH"; Value: "") "Atena.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "COMMANDLINE"; Value: "") "Atena.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITYTYPE"; Value: "") "Atena.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "PERMISSIONS"; Value: "") "Atena.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "ACTIVATABLECLASSES"; Value: "") "Atena.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVERTYPE"; Value: "") "Atena.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "APPID"; Value: "") "Atena.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITY"; Value: "") "Atena.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVICENAME"; Value: "") "Atena.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXPLICITPSMACTIVATIONTYPE"; Value: "") "Atena.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}\PROXYSTUBCLSID32"; Key: ""; Value: "") "Atena.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"; Key: "ACTIVATEONHOSTFLAGS"; Value: "")59:T64d,"Atena.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22621.1635_none_6ebca75c88023f94\comctl32.dll" "Atena.exe" trying to touch file "C:\Windows\SysWOW64\imm32.dll" "Atena.exe" trying to touch file "C:\Windows\WindowsShell.Manifest" "Atena.exe" trying to touch file "C:\Windows\SysWOW64\oleaut32.dll" "Atena.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "Atena.exe" trying to touch file "C:\Windows\SysWOW64\fltLib.dll" "Atena.exe" trying to touch file "C:\Windows\SysWOW64\cryptsp.dll" "Atena.exe" trying to touch file "C:\windows\temp\VxOle32.dll" "Atena.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "Atena.exe" trying to touch file "\Global??\FltMgrMsg" "Atena.exe" trying to touch file "C:\WINDOWS\system32\UXTHEME.dll" "Atena.exe" trying to touch file "C:\Windows\SysWOW64\uxtheme.dll" "Atena.exe" trying to touch file "C:\WINDOWS\system32\USERENV.dll" "Atena.exe" trying to touch file "C:\Windows\SysWOW64\userenv.dll" "Atena.exe" trying to touch file "C:\WINDOWS\system32\APPHELP.dll" "Atena.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "Atena.exe" trying to touch file "C:\WINDOWS\system32\PROPSYS.dll" "Atena.exe" trying to touch file "C:\Windows\SysWOW64\propsys.dll" "Atena.exe" trying to touch file "C:\WINDOWS\system32\DWMAPI.dll" "Atena.exe" trying to touch file "C:\Windows\SysWOW64\dwmapi.dll" "Atena.exe" trying to touch file "C:\WINDOWS\system32\CRYPTBASE.dll" "Atena.exe" trying to touch file "C:\Windows\SysWOW64\cryptbase.dll" "Atena.exe" trying to touch file "\Device\KsecDD"5a:T8ad,"Atena.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "Atena.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nskE0DB.tmp\System.dll" "Atena.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nskE0DB.tmp\StdUtils.dll" "Atena.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nskE0DB.tmp\SpiderBanner.dll" "Atena.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nskE0DB.tmp\nsis7z.dll" "Atena.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\atena-updater\installer.exe" "Atena.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\atena\Uninstall Atena.exe" "Atena.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nskE0DB.tmp\WinShell.dll" "Atena.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\atena\CRYPTSP.DLL" "Atena.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\atena\KBDUS.DLL" "Atena.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\update.exe" "Atena.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\atena\CRYPTBASE.DLL" "Atena.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\atena\profapi.dll" "Atena.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\atena\WTSAPI32.dll" "Atena.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\atena\mscms.dll" "Atena.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\atena\WINSTA.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_1_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll"5b:T474,Found string "--use-openssl-ca" (Indicator: "openssl-"; Source: "00000000-00002196.00000000.298648.00048000.00000004.mdmp, 00000000-00002196.00000000.298648.00058000.00000004.mdmp, 00000000-00002196.00000001.300567.00048000.00000004.mdmp, 00000000-00002196.00000002.302485.00058000.00000004.mdmp") Found string "I --openssl-config" (Indicator: "openssl-"; Source: "00000000-00002196.00000000.298648.00058000.00000004.mdmp, 00000000-00002196.00000002.302485.00058000.00000004.mdmp") Found string "--use-openssl-ca" (Indicator: "openssl-"; Source: "00000000-00002308.00000000.295185.00040000.00000004.mdmp, 00000000-00002308.00000000.295185.00050000.00000004.mdmp, 00000000-00002308.00000001.297105.00040000.00000004.mdmp, 00000000-00002308.00000001.297105.00050000.00000004.mdmp, 00000000-00002308.00000002.299027.00040000.00000004.mdmp, 00000000-00002308.00000002.299027.00050000.00000004.mdmp") Found string "I --openssl-config" (Indicator: "openssl-"; Source: "00000000-00002308.00000000.295185.00050000.00000004.mdmp, 00000000-00002308.00000001.297105.00050000.00000004.mdmp, 00000000-00002308.00000002.299027.00050000.00000004.mdmp")5c:Td49,Found reference to API "GetHostNameW" (Indicator: "gethostname"; Source: "00000000-00002308-00000C2C-3606663730") file/memory contains long string with (Indicator: " connect "; Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") Found reference to API "=1 {This device will be saved for 1 day and you can connect without a code next time. This is set by your administrator.}" (Indicator: " connect "; Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") Found reference to API "other {This device will be saved for {DAYS} days and you can connect without a code next time. This is set by your administrator.}}{HOURS, plural," (Indicator: " connect "; Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") Found reference to API "=1 {This device will be saved for 1 hour and you can connect without a code next time. This is set by your administrator.}" (Indicator: " connect "; Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") Found reference to API "other {This device will be saved for {HOURS} hours and you can connect without a code next time. This is set by your administrator.}}{MONTHS, plural," (Indicator: " connect "; Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") Found reference to API "=1 {This device will be saved for 1 month and you can connect without a code next time. This is set by your administrator.}" (Indicator: " connect "; Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") Found reference to API "other {This device will be saved for {MONTHS} months and you can connect without a code next time. This is set by your administrator.}}{YEARS, plural," (Indicator: " connect "; Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") Found reference to API "=1 {This device will be saved for 1 year and you can connect without a code next time. This is set by your administrator.}" (Indicator: " connect "; Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") file/memory contains long string with (Indicator: " bind "; Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") Found reference to API "USB device from $2 (product $1)USB devices from $1USB device ($2:$1)USB devices from vendor $1Any serial port$1 wants to connect to a HID deviceUnknown Device ($1)Finding HID devices" (Indicator: " connect "; Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") Found reference to API "t use a secure connection this time. An attacker might be trying to eavesdrop or modify your network connection. $1You usually connect to sites securely, but Chrome couldn" (Indicator: " connect "; Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") Found reference to API "getHostname" (Indicator: "gethostname"; Source: "00000000-00002308.00000000.295185.002B0000.00000004.mdmp, 00000000-00002308.00000000.295185.0035C000.00000004.mdmp, 00000000-00002308.00000000.295185.004A0000.00000004.mdmp, 00000000-00002308.00000000.295185.0055C000.00000004.mdmp, 00000000-00002308.00000001.297105.00604000.00000004.mdmp, 00000000-00002308.00000002.299027.004A0000.00000004.mdmp, 00000000-00002308.00000002.299027.00604000.00000004.mdmp") Found reference to API "// Socket was destroyed before the connection was established" (Indicator: " socket "; Source: "00000000-00002308.00000001.297105.0026C000.00000004.mdmp")5d:T1653,Heuristic match: "k;.lu" Heuristic match: "p{*.pa" Heuristic match: "ux.mk" Heuristic match: "b;.mh" Heuristic match: "[:..re" Heuristic match: "`=b.pm" Pattern match: "http://nsis.sf.net/nsis_error" Heuristic match: "root.linahook.com" Heuristic match: "= 'disableblockatfirstseen'; parametertype = 'system.boolean'; bindings = 'in'; value = $__cmdletization_defaultvalue; isvaluepresent = $__cmdletization_defaultvalueispresent} } $__cmdletization_methodparameters.add($__cmdletization_methodpar" Pattern match: "https://nodejs.org/download/release/v22.21.1/win-x64/node.lib" Pattern match: "https://nodejs.org/download/release/v22.21.1/node-v22.21.1.tar.gz" Pattern match: "https://nodejs.org/download/release/v22.21.1/node-v22.21.1-headers.tar.gz" Heuristic match: "blink.net" Pattern match: "chrome.google.com/webstore?hl=enctrlpress" Pattern match: "https://myactivity.google.com/" Pattern match: "https://policies.google.com/" Pattern match: "https://support.google.com/chromebook?p=app_intent" Pattern match: "myactivity.google.com/product/gemini?utm_source=geminimanage" Heuristic match: "[*.]google.com" Pattern match: "https://chrome.google.com/webstore/category/extensions" Pattern match: "https://www.example.comurl" Pattern match: "https://support.google.com/chrome/?p=passkeys" Pattern match: "www.google.com/chrome/privacy/eula_text.htmlh&elpprofile" Pattern match: "measurementlab.net/privacy" Pattern match: "https://chromeenterprise.google/policies/#browserswitcherenabled" Pattern match: "https://chromeenterprise.google/policies/#browserswitcherexternalsitelisturl" Pattern match: "https://chromeenterprise.google/policies/#browserswitcheruseiesitelist" Pattern match: "https://chromeenterprise.google/policies/#browserswitcherurlgreylist" Pattern match: "myactivity.google.com/myactivity/?utm_source=chrome_nhttps://myactivity.google.com/myactivity/?utm_source=chrome_h" Pattern match: "https://chromestatus.com/features#browsers.chrome.status%3a%22deprecated%22" Pattern match: "http://example.com" Pattern match: "https://support.google.com/chrome/answer/6098869" Heuristic match: "t support a secure connectionattackers can see and change information you send or receive from the site.it" Heuristic match: "string.prototype.at" Heuristic match: "%typedarray%.prototype.at" Pattern match: "https://root.${server_url}/download/${filename" Heuristic match: "pd.ga" Heuristic match: "e.net" Heuristic match: "pc.jo" Heuristic match: "pe.ae" Heuristic match: "pe.mn" Heuristic match: "performanceentry.name" Pattern match: "https://github.com/electron/electron/issues" Pattern match: "https://fs.microsoft.com/fs/windows/config.json" Pattern match: "https://fs.microsoft.com/fs/windows/config.json,config,0" Pattern match: "crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl0y" Pattern match: "directory.d-trust.net/cn=d-trust%20br%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlist" Pattern match: "crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl0y" Pattern match: "directory.d-trust.net/cn=d-trust%20ev%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlist" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "https://chromewebstore.google.com/" Heuristic match: "izenpe.com" Pattern match: "http://www.cert.fnmt.es/dpcs/" Pattern match: "http://repository.swisssign.com/" Pattern match: "https://wwww.certigna.fr/autorites/" Pattern match: "crl.comodoca.com/comodocertificationauthority.crl" Pattern match: "http://www.firmaprofesional.com/cps0\" Pattern match: "www.accv.es/fileadmin/archivos/certificados/raizaccv1_der.crl" Pattern match: "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1.crt0" Pattern match: "http://ocsp.accv.es" Pattern match: "http://crl.certigna.fr/certignarootca.crl01" Pattern match: "http://crl.dhimyotis.com/certignarootca.crl" Heuristic match: "host: root.linahook.com" Pattern match: "www.digicert.com1" Pattern match: "www.digicert.com1$0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1!0" Pattern match: "http://www.accv.es" Pattern match: "http://www.accv.es/legislacion_c.htm" Pattern match: "0www.entrust.net/cps" Heuristic match: "info@e-szigno.hu" Pattern match: "http://www.quovadisglobal.com/cps0" Heuristic match: "info@izenpe.com" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://crl.securetrust.com/sgca.crl0" Pattern match: "crl.comodoca.com/comodocertificationauthority.crl0" Pattern match: "directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist0c" Pattern match: "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0" Pattern match: "directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%20ev%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist0f" Pattern match: "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "http://www.cert.fnmt.es/dpcs/0" Heuristic match: "m .ph" Pattern match: "http://www.iec.ch" Pattern match: "crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl" Pattern match: "crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl" Pattern match: "https://wwww.certigna.fr/autorites/0m" Pattern match: "http://crl.dhimyotis.com/certignarootca.crl0" Pattern match: "https://chrome.google.com/webstore" Pattern match: "directory.d-trust.net/cn=d-trust%20br%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlist0" Pattern match: "directory.d-trust.net/cn=d-trust%20ev%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlist0"5e:T98f3,Found URL "https://nodejs.org/download/release/v22.21.1/win-x64/node.lib--debug-portactivate" - Source: "00000000-00002196.00000000.298648.00048000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v22.21.1/node-v22.21.1.tar.gzhttps://nodejs.org/download/release/v22.21.1/node-v22.21.1-headers.tar.gzactivate" - Source: "00000000-00002196.00000000.298648.0006C000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v22.21.1/win-x64/node.lib--debug-portactivate" - Source: "00000000-00002196.00000001.300567.00048000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v22.21.1/node-v22.21.1.tar.gzhttps://nodejs.org/download/release/v22.21.1/node-v22.21.1-headers.tar.gzactivate" - Source: "00000000-00002196.00000002.302485.0006C000.00000004.mdmp") Found URL "https://chrome.google.com/webstore?hl=enctrlpress" - Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") Found URL "http://'" - Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") Found URL "https://'" - Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") Found URL "https://myactivity.google.com/" - Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") Found URL "https://policies.google.com/" - Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") Found URL "https://support.google.com/chromebook?p=app_intent" - Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") Found URL "https://myactivity.google.com/product/gemini?utm_source=geminimanage" - Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") Found URL "https://chrome.google.com/webstore/category/extensions" - Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") Found URL "https://www.example.comurl" - Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") Found URL "https://support.google.com/chrome/?p=passkeys'>about" - Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") Found URL "https://www.google.com/chrome/privacy/eula_text.htmlh&elpprofile" - Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") Found URL "https://chromeenterprise.google/policies/" - Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") Found URL "http://," - Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") Found URL "https://," - Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") Found URL "https://passwords.google.comgoogle" - Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") Found URL "https://myactivity.google.com/myactivity/?utm_source=chrome_nhttps://myactivity.google.com/myactivity/?utm_source=chrome_h-p" - Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") Found URL "https://chromestatus.com/features" - Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") Found URL "https://support.google.com/chrome/a/?p=browser_profile_details" - Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") Found URL "http://example.com" - Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") Found URL "https://example.com.use" - Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") Found URL "https://support.google.com/chrome/a/answer/9122284" - Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") Found URL "http://.

" - Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") Found URL "http://," - Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") Found URL "http://example.com." - Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") Found URL "https://support.google.com/chrome/answer/6098869" - Source: "00000000-00002196.00000002.302485.40BB0000.00000002.mdmp") Found URL "https://nodejs.org/download/release/v22.21.1/win-x64/node.lib--debug-portactivate" - Source: "00000000-00002308.00000000.295185.00040000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v22.21.1/node-v22.21.1.tar.gzhttps://nodejs.org/download/release/v22.21.1/node-v22.21.1-headers.tar.gzactivate" - Source: "00000000-00002308.00000000.295185.00050000.00000004.mdmp") Found URL "https://root.$" - Source: "00000000-00002308.00000000.295185.0007C000.00000004.mdmp") Found URL "https://github.com/electron/electron/issuesappmenufilemenuheditmenupviewmenuxwindowmenumenubuildfromtemplatesetapplicationmenu" - Source: "00000000-00002308.00000000.295185.007A8000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json12/07" - Source: "00000000-00002308.00000000.295185.5C0C0000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,012/07" - Source: "00000000-00002308.00000000.295185.5C0C0000.00000002.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20br%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlist8http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20ev%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlistponte" - Source: "00000000-00002308.00000001.297105.00004000.00000004.mdmp") Found URL "https://chromewebstore.google.com/&internal/linkedlist&internal/util/typesinternal/assertassertinternal/errorserrorsinternal/deps/cjs-module-lexer/dist/lexerinternal/deps/acorn/acorn-walk/dist/walkinternal/bootstrap/web/exposed-window-or-workerinternal/bootstrap/switches/is_not_main_threadinternal/bootstrap/switches/does_own_process_stateinternal/bootstrap/switches/is_main_threadinternal/bootstrap/switches/does_not_own_process_stateinternal/async_local_storage/async_context_frameinternal/async_local_storage/async_hooks" - Source: "00000000-00002308.00000001.297105.00004000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/fnmt-rcm1ac" - Source: "00000000-00002308.00000001.297105.00004000.00000004.mdmp") Found URL "http://repository.swisssign.com/hellenic" - Source: "00000000-00002308.00000001.297105.00004000.00000004.mdmp") Found URL "https://wwww.certigna.fr/autorites//webidlamazon1amazon" - Source: "00000000-00002308.00000001.297105.00004000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodocertificationauthority.crlatos" - Source: "00000000-00002308.00000001.297105.00004000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\0p1$0" - Source: "00000000-00002308.00000001.297105.00038000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v22.21.1/win-x64/node.lib--debug-portactivate" - Source: "00000000-00002308.00000001.297105.00040000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v22.21.1/node-v22.21.1.tar.gzhttps://nodejs.org/download/release/v22.21.1/node-v22.21.1-headers.tar.gzactivate" - Source: "00000000-00002308.00000001.297105.00050000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1_der.crlsigusr2en-usen-us0l1" - Source: "00000000-00002308.00000001.297105.00050000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1.crt0http://ocsp.accv.esg0e1quovadis" - Source: "00000000-00002308.00000001.297105.0006C000.00000004.mdmp") Found URL "http://crl.certigna.fr/certignarootca.crl01+http://crl.dhimyotis.com/certignarootca.crllzmi)" - Source: "00000000-00002308.00000001.297105.0006C000.00000004.mdmp") Found URL "https://root.$" - Source: "00000000-00002308.00000001.297105.0007C000.00000004.mdmp") Found URL "http://www.accv.es$http://www.accv.es/legislacion_c.htmrequirelazyerror" - Source: "00000000-00002308.00000001.297105.000B0000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cps0g0e1quovadis" - Source: "00000000-00002308.00000001.297105.000F4000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00002308.00000001.297105.00114000.00000004.mdmp") Found URL "http://crl.securetrust.com/sgca.crl05zjd^nw)ocitvgkjuqgzxeeud4h" - Source: "00000000-00002308.00000001.297105.00114000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodocertificationauthority.crl0u" - Source: "00000000-00002308.00000001.297105.0026C000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0okk,%$rdtpmprocesspromiseprototypethensymbolasynciteratorsymboliteratorpcj+buffererr_invalid_arg_type$pg" - Source: "00000000-00002308.00000001.297105.0026C000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" - Source: "00000000-00002308.00000001.297105.0026C000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00002308.00000001.297105.0035C000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/0s)kmue" - Source: "00000000-00002308.00000001.297105.0035C000.00000004.mdmp") Found URL "http://www.iec.chiec" - Source: "00000000-00002308.00000001.297105.00388000.00000004.mdmp") Found URL "http://www.iec.chdesc.iec" - Source: "00000000-00002308.00000001.297105.00388000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl0@0>8http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl" - Source: "00000000-00002308.00000001.297105.003A8000.00000004.mdmp") Found URL "https://wwww.certigna.fr/autorites/0mf0d0/)http://crl.certigna.fr/certignarootca.crl01+http://crl.dhimyotis.com/certignarootca.crl0]h8/q" - Source: "00000000-00002308.00000001.297105.00438000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\*0a" - Source: "00000000-00002308.00000001.297105.00438000.00000004.mdmp") Found URL "https://chrome.google.com/webstoremoduleinternal/bootstrap/switches/is_not_main_threadinternal/bootstrap/switches/does_own_process_stateinternal/bootstrap/switches/is_main_threadinternal/bootstrap/switches/does_not_own_process_stateinternal/async_local_storage/async_context_frameinternal/async_local_storage/async_hooks(internal/fs/watchers,internal/child_processstreamstream/promisesomises*internal/streams/from,internal/streams/stateinternal/test_runner/reporter/v8-serializerinternal/source_map/source_map_cache_mapinternal/modules/esm/initialize_import_metainternal/modules/esm/create_dynamic_moduleinternal/deps/v8/tools/tickprocessor-driverinternal/deps/cjs-module-lexer/dist/lexerinternal/deps/acorn/acorn-walk/dist/walkinternal/bootstrap/web/exposed-window-or-workertimers/promisesomises(internal/socket_listinternal/dgramdgram*internal/perf/observedgramypepadstart$pgrregexpprototypetop?titerato8" - Source: "00000000-00002308.00000001.297105.00468000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20br%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlist0d-trust" - Source: "00000000-00002308.00000001.297105.00478000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20ev%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlist0^ub96" - Source: "00000000-00002308.00000001.297105.00478000.00000004.mdmp") Found URL "https://github.com/electron/electron/issuesappmenufilemenuheditmenupviewmenuxwindowmenumenubuildfromtemplatesetapplicationmenu" - Source: "00000000-00002308.00000001.297105.007A8000.00000004.mdmp") Found URL "http://www.iec.chiec" - Source: "00000000-00002308.00000001.297105.007B4000.00000004.mdmp") Found URL "http://www.iec.chdesc.iec" - Source: "00000000-00002308.00000001.297105.007B4000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0+0)" - Source: "00000000-00002308.00000001.297105.008C4000.00000004.mdmp") Found URL "http://crl.securetrust.com/sgca.crl0/0-nykiadk" - Source: "00000000-00002308.00000001.297105.008C4000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl0el4bt\c[..a$z]in" - Source: "00000000-00002308.00000001.297105.00980000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl0*'a+" - Source: "00000000-00002308.00000001.297105.00980000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002308.00000001.297105.5BF10000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm" - Source: "00000000-00002308.00000001.297105.5BF10000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002308.00000001.297105.5BF10000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0b=" - Source: "00000000-00002308.00000001.297105.5BF10000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0120531151137z0/^g(o-cejy" - Source: "00000000-00002308.00000001.297105.5BF10000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json12/07" - Source: "00000000-00002308.00000001.297105.5C0C0000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,012/07" - Source: "00000000-00002308.00000001.297105.5C0C0000.00000002.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20br%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlist8http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20ev%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlistr;s>ponte" - Source: "00000000-00002308.00000002.299027.00004000.00000004.mdmp") Found URL "https://chromewebstore.google.com/&internal/linkedlist&internal/util/typesinternal/assertassertinternal/errorserrorsinternal/deps/cjs-module-lexer/dist/lexerinternal/deps/acorn/acorn-walk/dist/walkinternal/bootstrap/web/exposed-window-or-workerinternal/bootstrap/switches/is_not_main_threadinternal/bootstrap/switches/does_own_process_stateinternal/bootstrap/switches/is_main_threadinternal/bootstrap/switches/does_not_own_process_stateinternal/async_local_storage/async_context_frameinternal/async_local_storage/async_hooks" - Source: "00000000-00002308.00000002.299027.00004000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/fnmt-rcm1ac" - Source: "00000000-00002308.00000002.299027.00004000.00000004.mdmp") Found URL "http://repository.swisssign.com/hellenic" - Source: "00000000-00002308.00000002.299027.00004000.00000004.mdmp") Found URL "https://wwww.certigna.fr/autorites//webidlamazon1amazon" - Source: "00000000-00002308.00000002.299027.00004000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodocertificationauthority.crlatos" - Source: "00000000-00002308.00000002.299027.00004000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\0p1$0" - Source: "00000000-00002308.00000002.299027.00038000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v22.21.1/win-x64/node.lib--debug-portactivate" - Source: "00000000-00002308.00000002.299027.00040000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v22.21.1/node-v22.21.1.tar.gzhttps://nodejs.org/download/release/v22.21.1/node-v22.21.1-headers.tar.gzactivate" - Source: "00000000-00002308.00000002.299027.00050000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1_der.crlc:\windows\system32\cmd.exesigusr2en-usen-us0l1" - Source: "00000000-00002308.00000002.299027.00050000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1.crt0http://ocsp.accv.esg0e1quovadis" - Source: "00000000-00002308.00000002.299027.0006C000.00000004.mdmp") Found URL "http://crl.certigna.fr/certignarootca.crl01+http://crl.dhimyotis.com/certignarootca.crllzmi)" - Source: "00000000-00002308.00000002.299027.0006C000.00000004.mdmp") Found URL "https://root.$" - Source: "00000000-00002308.00000002.299027.0007C000.00000004.mdmp") Found URL "http://www.accv.es$http://www.accv.es/legislacion_c.htmrequirelazyerror" - Source: "00000000-00002308.00000002.299027.000B0000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cps0g0e1quovadis" - Source: "00000000-00002308.00000002.299027.000F4000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00002308.00000002.299027.00114000.00000004.mdmp") Found URL "http://crl.securetrust.com/sgca.crl05zjd^nw)ocitvgkjuqgzxeeud4h" - Source: "00000000-00002308.00000002.299027.00114000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodocertificationauthority.crl0u" - Source: "00000000-00002308.00000002.299027.0026C000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0okk,%$rdtpmprocesspromiseprototypethensymbolasynciteratorsymboliteratorpcj+buffererr_invalid_arg_type$pg" - Source: "00000000-00002308.00000002.299027.0026C000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" - Source: "00000000-00002308.00000002.299027.0026C000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00002308.00000002.299027.0035C000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/0s)kmue" - Source: "00000000-00002308.00000002.299027.0035C000.00000004.mdmp") Found URL "http://www.iec.chiec" - Source: "00000000-00002308.00000002.299027.00388000.00000004.mdmp") Found URL "http://www.iec.chdesc.iec" - Source: "00000000-00002308.00000002.299027.00388000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl0@0>8http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl" - Source: "00000000-00002308.00000002.299027.003A8000.00000004.mdmp") Found URL "https://wwww.certigna.fr/autorites/0mf0d0/)http://crl.certigna.fr/certignarootca.crl01+http://crl.dhimyotis.com/certignarootca.crl0]h8/q" - Source: "00000000-00002308.00000002.299027.00438000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\*0a" - Source: "00000000-00002308.00000002.299027.00438000.00000004.mdmp") Found URL "https://chrome.google.com/webstoremoduleinternal/bootstrap/switches/is_not_main_threadinternal/bootstrap/switches/does_own_process_stateinternal/bootstrap/switches/is_main_threadinternal/bootstrap/switches/does_not_own_process_stateinternal/async_local_storage/async_context_frameinternal/async_local_storage/async_hooks(internal/fs/watchers,internal/child_processstreamstream/promisesomises*internal/streams/from,internal/streams/stateinternal/test_runner/reporter/v8-serializerinternal/source_map/source_map_cache_mapinternal/modules/esm/initialize_import_metainternal/modules/esm/create_dynamic_moduleinternal/deps/v8/tools/tickprocessor-driverinternal/deps/cjs-module-lexer/dist/lexerinternal/deps/acorn/acorn-walk/dist/walkinternal/bootstrap/web/exposed-window-or-workertimers/promisesomises(internal/socket_listinternal/dgramdgram*internal/perf/observedgramypepadstart$pgrregexpprototypetop?titerato8" - Source: "00000000-00002308.00000002.299027.00468000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20br%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlist0d-trust" - Source: "00000000-00002308.00000002.299027.00478000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20ev%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlist0^ub96" - Source: "00000000-00002308.00000002.299027.00478000.00000004.mdmp") Found URL "http://www.accv.esfunctionprototypecallpcj+bufferpbkdf2jobpev@kcryptojobasynckcryptojobsyncpeb-" - Source: "00000000-00002308.00000002.299027.00624000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1.crt0http://ocsp.accv.es0$http://www.accv.es/legislacion_c.htm0un0l0jdhttp://www.accv.es/fileadmin/archivos/certificados/raizaccv1_der.crl0accv@accv.es0cghdlm" - Source: "00000000-00002308.00000002.299027.00624000.00000004.mdmp") Found URL "https://github.com/electron/electron/issuesappmenufilemenuheditmenupviewmenuxwindowmenumenubuildfromtemplatesetapplicationmenu" - Source: "00000000-00002308.00000002.299027.007A8000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0+0)" - Source: "00000000-00002308.00000002.299027.008C4000.00000004.mdmp") Found URL "http://crl.securetrust.com/sgca.crl0/0-nykiadk" - Source: "00000000-00002308.00000002.299027.008C4000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl0el4bt\c[..a$z]in" - Source: "00000000-00002308.00000002.299027.00980000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl0*'a+" - Source: "00000000-00002308.00000002.299027.00980000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002308.00000002.299027.5BF10000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm;sql" - Source: "00000000-00002308.00000002.299027.5BF10000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002308.00000002.299027.5BF10000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]q" - Source: "00000000-00002308.00000002.299027.5BF10000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json12/07" - Source: "00000000-00002308.00000002.299027.5C0C0000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,012/07" - Source: "00000000-00002308.00000002.299027.5C0C0000.00000002.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00004504.00000001.299089.355C0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004504.00000001.299089.4F9F0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00004504.00000001.299089.4F9F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004504.00000001.299089.4F9F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm]x+,2.5.29.109&q::a" - Source: "00000000-00004504.00000001.299089.4F9F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004504.00000001.299089.4F9F0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004504.00000001.299089.4F9F0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lsuuu@lhhsmookh" - Source: "00000000-00004504.00000001.299089.4F9F0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00004504.00000001.299089.4F9F0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00004504.00000001.299089.4F9F0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00004504.00000001.299089.4F9F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00004504.00000001.299089.4F9F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004504.00000001.299089.4F9F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00004504.00000001.299089.4F9F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docnagr[d" - Source: "00000000-00004504.00000001.299089.4FCE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/micwinpca_2010-07-06.crl0wk0i0g;http://www.microsoft.com/pki/certs/micwinpca_2010-07-06.crt0g4zx" - Source: "00000000-00004504.00000001.299089.4FCE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004504.00000001.299089.4FD03000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0\r]6x/6" - Source: "00000000-00004504.00000001.299089.4FD03000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/micwinpca_2010-07-06.crl0wk0i0g;http://www.microsoft.com/pki/certs/micwinpca_2010-07-06.crt0jp4&5e0d" - Source: "00000000-00004504.00000001.299089.4FD1B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004504.00000001.299089.4FD4B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0eptl(*vm:wf" - Source: "00000000-00004504.00000001.299089.4FD4B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0@mt-bivop?u3gx%nhlj(ofv!@dqzs>snhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004504.00000001.299089.4FD4B000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%ld.htmlmpoav_forcedeepscan" - Source: "00000000-00004504.00000001.299089.B4CC3000.00000002.mdmp") Found URL "https://nodejs.org/download/release/v22.21.1/win-x64/node.lib--debug-portactivate" - Source: "00000000-00005556.00000000.298683.00048000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v22.21.1/node-v22.21.1.tar.gzhttps://nodejs.org/download/release/v22.21.1/node-v22.21.1-headers.tar.gzactivate" - Source: "00000000-00005556.00000000.298683.0006C000.00000004.mdmp") Found URL "https://www.khronos.org/spir/visualizer/" - Source: "00000000-00005556.00000000.298683.873A7000.00000002.mdmp") Found URL "https://shorturl.at/drfy7)" - Source: "00000000-00005556.00000000.298683.873A7000.00000002.mdmp") Found URL "http://anglebug.com/42267082programgl::postlinkjobimplrx::programgl::checklinkstatusprogram" - Source: "00000000-00005556.00000000.298683.873A7000.00000002.mdmp") Found URL "https://nodejs.org/download/release/v22.21.1/node-v22.21.1.tar.gzhttps://nodejs.org/download/release/v22.21.1/node-v22.21.1-headers.tar.gzactivate" - Source: "00000000-00005556.00000001.300602.0006C000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v22.21.1/win-x64/node.lib--debug-portactivate" - Source: "00000000-00005556.00000002.302522.00048000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006836.00000001.296916.F0550000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.36.3.3.2.8.1.1.1@eckp1.3.36.3.3.2.8.1.1.4ecdp1.3.36.3.3.2.8.1.1.5ecdp1.3.36.3.3.2.8.1.1.5@eckp1.3.36.3.3.2.8.1.1.6ecdp1.3.36.3.3.2.8.1.1.6@eckp1.3.36.3.3.2.8.1.1.7ecdp1.3.36.3.3.2.8.1.1.7@eckp1.3.36.3.3.2.8.1.1.3ecdp1.3.36.3.3.2.8.1.1.8ecdp0" - Source: "00000000-00006836.00000001.296916.F0550000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006836.00000001.296916.F0550000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm2.5.29.17-07,2.5.29.10digicert" - Source: "00000000-00006836.00000001.296916.F0550000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006836.00000001.296916.F0550000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006836.00000001.296916.F0550000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lquuusuuuhhsmookh1.3.36.3.3.2.8.1.1.13ecdp1.3.36.3.3.2.8.1.1.13@eckp1.2.840.10045.3.1.1ecdp1.2.840.10045.3.1.7ecdppowershell-commandadd-mppreference" - Source: "00000000-00006836.00000001.296916.F0550000.00000004.mdmp") Found URL "https://go.microsoft.cofile" - Source: "00000000-00006836.00000001.296916.F0550000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00006836.00000001.296916.F0550000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00006836.00000001.296916.F0550000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00006836.00000001.296916.F0550000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/doccdab6>6" - Source: "00000000-00006836.00000001.296916.F07B0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreport1f-90-a<3580indows" - Source: "00000000-00006836.00000001.296916.F0809000.00000004.mdmp") Found URL "http://crl.mcerazmicroosystemmond6n5ha6n5iamicro@arationaa6n5ua6n5va7xq0" - Source: "00000000-00006836.00000001.296916.F0809000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00006836.00000001.296916.F0809000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0eptl(*vm:wf" - Source: "00000000-00006836.00000001.296916.F0809000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/micwinpca_2010-07-06.crt0g4zx" - Source: "00000000-00006836.00000001.296916.F0809000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0au]8&l*" - Source: "00000000-00006836.00000001.296916.F0809000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/doc1214omt," - Source: "00000000-00006836.00000001.296916.F0809000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%20" - Source: "00000000-00006836.00000001.296916.F0809000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/micwinpca_2010-07-06.crl0wk0i0g;http://www.microsoft.com/pki/certs/micwinpca_2010-07-06.crt0jp4&" - Source: "00000000-00006836.00000001.296916.F0809000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0/vmg'k5a" - Source: "00000000-00006836.00000001.296916.F0809000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0sjv" - Source: "00000000-00006836.00000001.296916.F0809000.00000004.mdmp") Found URL "http://www.iops/crliptionted" - Source: "00000000-00006836.00000001.296916.F0809000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0\r]6x/6" - Source: "00000000-00006836.00000001.296916.F0809000.00000004.mdmp") Found URL "http://2(*o1(*o" - Source: "00000000-00007184.00000001.300233.2A2D0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007184.00000001.300233.44830000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0root" - Source: "00000000-00007184.00000001.300233.44830000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007184.00000001.300233.44830000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00007184.00000001.300233.44830000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007184.00000001.300233.44830000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007184.00000001.300233.44830000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lquuup" - Source: "00000000-00007184.00000001.300233.44830000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007184.00000001.300233.44830000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00007184.00000001.300233.44830000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00007184.00000001.300233.44830000.00000004.mdmp") Found URL "http://wwwroso010-p\-*osystem.d" - Source: "00000000-00007184.00000001.300233.448C9000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007184.00000001.300233.44907000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0/vmg'k5a" - Source: "00000000-00007184.00000001.300233.44907000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007184.00000001.300233.44AD0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0eptl(*vm:wf" - Source: "00000000-00007184.00000001.300233.44AD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/micwinpca_2010-07-06.crl0wk0i0g;http://www.microsoft.com/pki/certs/micwinpca_2010-07-06.crt0jp4&washi" - Source: "00000000-00007184.00000001.300233.44AD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@'b=%washington1redmond1microsoft" - Source: "00000000-00007184.00000001.300233.44B48000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007184.00000001.300233.44B48000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0au]8&l*" - Source: "00000000-00007184.00000001.300233.44B48000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0@mt-bivop?u3gx%nhlj(ofv!@dqzs>sn