26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 45:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T42d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 16613e7c0768… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 16613e7c0768…. Threat score 100/100. 3/27 AV engines flagged this file. 2 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/16613e7c07681726ab577e6ac14114cb42691838fa3c6c4c1bef7dafa2c7c4a0","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","16613e7c07681726ab577e6ac14114cb42691838fa3c6c4c1bef7dafa2c7c4a0"],"about":{"@type":"SoftwareApplication","name":"app(060e45bf7b57d4).js","applicationCategory":["script","javascript"],"identifier":"16613e7c07681726ab577e6ac14114cb42691838fa3c6c4c1bef7dafa2c7c4a0","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":3,"total":27},"behavioralIndicators":{"malicious":2,"suspicious":6},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4d5,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp")28:T836,Found string - dex-a)} _preloadItem:function(c){if(c=S(c) !b.items[c].preloaded){var d=b.items[c];d.parsed||(d=b.parseEl(c)) y("LazyLoad",d) "image"===d.type&&(d.img=a('').on("load.mfploader",function(){d.hasSize=!0}).on("error.mfploader",function(){d.hasSize=!0 d.loadError=!0 y("LazyLoadError",d)}).attr("src",d.src)) d.preloaded=!0}}}});var U="retina";a.magnificPopup.registerModule(U,{options:{replaceSrc:function(a){return a.src.replace(/\.\w+$/,function(a){return"@2x"+a})} ratio:1} proto:{initRetina:function(){if(window.devicePixelRatio>1){var a=b.st.retina c=a.ratio;c=isNaN(c)?c():c c>1&&(w("ImageHasSize."+U,function(a,b){b.img.css({"max-width":b.img[0].naturalWidth/c,width:"100%"})}) w("ElementParse."+U,function(b,d){d.src=a.replaceSrc(d,c)}))}}}}) A()});/*! * Modernizr v2.8.3 * www.modernizr.com * * Copyright (c) Faruk Ates Paul Irish Alex Sexton * Available under the BSD and MIT licenses: www.modernizr.com/license/ *//* * Modernizr tests which native CSS3 and HTML5 features; Source: "app(060e45bf7b57d4).js") Found string - ).attr("src",d.src)) d.preloaded=!0}}}});var U="retina";a.magnificPopup.registerModule(U,{options:{replaceSrc:function(a){return a.src.replace(/\.\w+$/,function(a){return"@2x"+a})} ratio:1} proto:{initRetina:function(){if(window.devicePixelRatio>1){var a=b.st.retina c=a.ratio;c=isNaN(c)?c():c c>1&&(w("ImageHasSize."+U,function(a,b){b.img.css({"max-width":b.img[0].naturalWidth/c,width:"100%"})}) w("ElementParse."+U,function(b,d){d.src=a.replaceSrc(d,c)}))}}}}) A()});/*! * Modernizr v2.8.3 * www.modernizr.com * * Copyright (c) Faruk Ates Paul Irish Alex Sexton * Available under the BSD and MIT licenses: www.modernizr.com/license/ *//* * Modernizr tests which native CSS3 and HTML5 features are available in * the current UA and makes the results available to you in two ways: * as properties on a global Modernizr object and as classes on the * element. This information allows you to progressively enhance * your pages with a granular level of control over the; Source: "app(060e45bf7b57d4).js")29:Teb7,Found string "AutoIt3.exe" (Indicator: "autoit3.exe"; File: "app(060e45bf7b57d4).js"), Found string "C:\%SystemRoot%\system32\WindowsPowerShell\v1.0\AutoIt3.exe" (Indicator: "autoit3.exe"; Source: "00000000-00005304-00000C28-16005234431"), Found string "C:\%SystemRoot%\system32\WindowsPowerShell\v1.0\AutoIt3.exe.ps1" (Indicator: "autoit3.exe"; Source: "00000000-00005304-00000C28-16006695769"), Found string "C:\%SystemRoot%\system32\WindowsPowerShell\v1.0\AutoIt3.exe.psm1" (Indicator: "autoit3.exe"; Source: "00000000-00005304-00000C28-16008078581"), Found string "C:\%SystemRoot%\system32\WindowsPowerShell\v1.0\AutoIt3.exe.psd1" (Indicator: "autoit3.exe"; Source: "00000000-00005304-00000C28-16009468537"), Found string "C:\%SystemRoot%\system32\WindowsPowerShell\v1.0\AutoIt3.exe.COM" (Indicator: "autoit3.exe"; Source: "00000000-00005304-00000C28-16010825599"), Found string "C:\%SystemRoot%\system32\WindowsPowerShell\v1.0\AutoIt3.exe.EXE" (Indicator: "autoit3.exe"; Source: "00000000-00005304-00000C28-16012757231"), Found string "C:\%SystemRoot%\system32\WindowsPowerShell\v1.0\AutoIt3.exe.BAT" (Indicator: "autoit3.exe"; Source: "00000000-00005304-00000C28-16015134451"), Found string "C:\%SystemRoot%\system32\WindowsPowerShell\v1.0\AutoIt3.exe.CMD" (Indicator: "autoit3.exe"; Source: "00000000-00005304-00000C28-16016548437"), Found string "C:\%SystemRoot%\system32\WindowsPowerShell\v1.0\AutoIt3.exe.VBS" (Indicator: "autoit3.exe"; Source: "00000000-00005304-00000C28-16017948281"), Found string "C:\%SystemRoot%\system32\WindowsPowerShell\v1.0\AutoIt3.exe.VBE" (Indicator: "autoit3.exe"; Source: "00000000-00005304-00000C28-16019317809"), Found string "C:\%SystemRoot%\system32\WindowsPowerShell\v1.0\AutoIt3.exe.JS" (Indicator: "autoit3.exe"; Source: "00000000-00005304-00000C28-16020706011"), Found string "C:\%SystemRoot%\system32\WindowsPowerShell\v1.0\AutoIt3.exe.JSE" (Indicator: "autoit3.exe"; Source: "00000000-00005304-00000C28-16022082215"), Found string "C:\%SystemRoot%\system32\WindowsPowerShell\v1.0\AutoIt3.exe.WSF" (Indicator: "autoit3.exe"; Source: "00000000-00005304-00000C28-16023489327"), Found string "C:\%SystemRoot%\system32\WindowsPowerShell\v1.0\AutoIt3.exe.WSH" (Indicator: "autoit3.exe"; Source: "00000000-00005304-00000C28-16024855411"), Found string "C:\%SystemRoot%\system32\WindowsPowerShell\v1.0\AutoIt3.exe.MSC" (Indicator: "autoit3.exe"; Source: "00000000-00005304-00000C28-16026223063"), Found string "%ALLUSERSPROFILE%\Oracle\Java\javapath\AutoIt3.exe" (Indicator: "autoit3.exe"; Source: "00000000-00005304-00000C28-16027740587"), Found string "%ALLUSERSPROFILE%\Oracle\Java\javapath\AutoIt3.exe.ps1" (Indicator: "autoit3.exe"; Source: "00000000-00005304-00000C28-16029012641"), Found string "%ALLUSERSPROFILE%\Oracle\Java\javapath\AutoIt3.exe.psm1" (Indicator: "autoit3.exe"; Source: "00000000-00005304-00000C28-16030245469"), Found string "%ALLUSERSPROFILE%\Oracle\Java\javapath\AutoIt3.exe.psd1" (Indicator: "autoit3.exe"; Source: "00000000-00005304-00000C28-16031913809"), Found string "%ALLUSERSPROFILE%\Oracle\Java\javapath\AutoIt3.exe.COM" (Indicator: "autoit3.exe"; Source: "00000000-00005304-00000C28-16033150869"), Found string "%ALLUSERSPROFILE%\Oracle\Java\javapath\AutoIt3.exe.EXE" (Indicator: "autoit3.exe"; Source: "00000000-00005304-00000C28-16034381113"), Found string "%ALLUSERSPROFILE%\Oracle\Java\javapath\AutoIt3.exe.BAT" (Indicator: "autoit3.exe"; Source: "00000000-00005304-00000C28-16035626041"), Found string "%ALLUSERSPROFILE%\Oracle\Java\javapath\AutoIt3.exe.CMD" (Indicator: "autoit3.exe"; Source: "00000000-00005304-00000C28-16036836015"), Found string "%ALLUSERSPROFILE%\Oracle\Java\javapath\AutoIt3.exe.VBS" (Indicator: "autoit3.exe"; Source: "00000000-00005304-00000C28-16038039967")2a:T6e6,"powershell.exe" called "CryptImportKey" with parameters {"hProv": "219968" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "a8722000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "219968" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "(v"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "219968" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "(x"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "219968" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "a8772000"}2b:T315c,"WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000002e000000000098843200000000002423000700000000c8863200c4002e00f8233100003b000000002e000000000098843200c4f2160004648d7738012e00e0638d77eae08c770000000000002e00a084320000000000000000000000040000000000a8f21600d77d8d77a0f21600010000004c5b907500002e0050012e00000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005192) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000e4e7160000000000050000000000e87010e816000200004014ea160014ea16001a128f7700000000fce716000000000078a0300002038f770002000088018f770000000058ea1600a4018f7700000000626f8d7764f88d7786fa8c775411e87008e9160000000000000088773ff000005411e8700000000000000000f81d2e004ce81600b69f8d7700000000000052746c496e697469616c697a65437269746963616c53656374696f6e00000000e870000000000000000000000000b6fa8c7700e816000000000060ec160086fa8c7718e816000200000030e91600ff2b8d77 (UID: 00000000-00005192) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000d4009c0400002aa21f09c0e6160000800700b4e816000900cf009c040000feffffff435c8d77e06f2e00f80300002000000032d8b10100000000304c3000d06c2e00f06d2e0028be3a0098712e000000000054e716000000000068e9160095e189773e0e1700feffffffff2b8d779a2a8d773020e97094110000000000004800b0013c000200010000003c00000001000000000000000000000050d8b1010000000000000000f009b00111000000000000003c00000020c21f00c4e81600cc418e7730a21f0088000000fe03000002000000000000003020e97028be3a003020e970 (UID: 00000000-00005192) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000300084db160095e189777e1e1700feffffff833e8e7774128f77000000000000d36d0000000006000000000000000000000084d8160000000000ff2b8d77deca8c77b460d56dac012e0000002e00b4da16001a128f770300ed003a05000000000000f8a1300002038f77000200000400e8003a050000f8da1600a4018f77e06f2e00626f8d772000000066cb8c7700000000304c3000d06c2e00f06d2e00f0be3a0098712e00000000006cd81600ff2b8d77ecd9160095e189773e0e1700feffffffff2b8d779a2a8d77b460d56db460d56d00000000ccd91600d0a21f005cd91600 (UID: 00000000-00005192) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000ffff833e8e7774128f770000000000008f6b00000000060000000000000000000000ff2b8d778ec28c77d0f0786bac012e0000002e00ac012e0000002e001400980006000000150093000600000000000000f8a23000150093000600000016008e0006000000e06f2e00a4018f77200000000000000000000000e0153b00d06c2e00f06d2e0060eb500298712e0038eb50021cd0160000002e009cd1160095e189773e0e1700feffffffff2b8d779a2a8d77d0f0786bd0f0786b0000000070f0786b0000000084d1160058a31f0014d1160080f4ac7500001f000000000089f4ac75 (UID: 00000000-00005192) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000009d00060000000000000000000000000000000000000014009800060000000000000000000000e06f2e0000000000200000000000000000000000e0153b00d06c2e00f06d2e0088eb500298712e0000000000accf160000000000c0d1160095e189773e0e1700feffffffff2b8d779a2a8d77585a906ba00f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000585a906b88eb5002585a906b (UID: 00000000-00005192) "WScript.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005192) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005192) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000656a10e5df0266ffcc0499ffff04ccffff0400e5df020000656a0000000001000000 (UID: 00000000-00005192) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000001011ed05aa0e0b8ebdf022a9d57770000000024836c7704000000000000000000000034fddf0200000000e79c577702000780cce5df02000000003e0000001ce6df02feffffffa4e5df02cf008e77d6008e778af745753e0000001f0000001ce6df026f006e0078e5df026e007400e0e5df02 (UID: 00000000-00005192) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036008ff09de31cdedf026d824b769cb23c0004010000 (UID: 00000000-00005192) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000330032005c0057005300630072006900700074002e006500780065000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2b8d77e6da4575d8eb4a77ac012e0000002e0000000000000000000e00b6009f000000000000000000000000000000000000000f00b1009f0000000000000000000000e06f2e0000000000200000000000000000000000 (UID: 00000000-00005192) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002e00a06f3d000000000033000033340000c0c8713d00e8a83d00889f3c009801000000002e0000008000a06f3d008ceedf0204648d7738012e00e0638d77a2fc45750000000000002e00a86f3d006dd1547677a7f7e36caeb775000000000000000000000000e8a83d0050012e000100000000002e0050012e000c000000a86f3d0050012e000200000218000000e00000e0770000000000000000000000030000002ceedf02800000006000000000000000783b004377000000c0755c762844510200000000c0755c7648eedf02e02f2e0000000000b02f2e00a0eedf02ff2b8d77 (UID: 00000000-00005192) "WScript.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005192) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005304) "powershell.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005304) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000001800000000004ad318000500000081d0837600d3180004d3180000000000d80d23009c508c77e26b8c751401000014010000d0d21800b0ea547614010000f0d21800acd718005ecb81761401000000000000005d7f7608da18000e5d7f76a0d51800dcaa8376010000000000000072000000ffffffffffffffff28d3180078020000000000002500000028d318007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600334639e180d318006d824b76b42a230004010000 (UID: 00000000-00005304) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000330032005c00570069006e0064006f007700730050006f007700650072005300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e0065007800650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2b8d77dca58277d8eb4a77ac011d0000001d0000000000000000000200f20043010000000000000000000000000000000000000300ed00430100000000000000000000c8731d0000000000200000000000000000000000 (UID: 00000000-00005304) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000230001000000ffffffff020000000800000040432300404323003b4323000000000002000000a85b2100000000000100000800000000f0e4180095e18977dc091700feffffff68d218003f08557602000000a85b2100000000000100001888fb547658d21800c81c83762ed4180095fb54768cd31800a85b210000000000000000000000000014d3180000001d007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600e74739e1d4d218006d824b76b42a230004010000 (UID: 00000000-00005304) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000004b760100000000800000000000000000000034cb180023334b7668cb1800008000000080000068cb180037334b76000000006ecb1800675e39e150cb180067324b7648d01800356076e174cd1800135f7f7668cb18005ad0180000000000b0d41800482c23007cd21800205f7f7643003a005c0055007300650072007300000048004100500055004200570053007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036009f5e39e1eccb18006d824b768486230004010000 (UID: 00000000-00005304)2c:T1318,"WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000044f316004cf316003a178d750000000000000000f8f316000200000000000000000000000c0000000200000001011600c2eb5476ec5b8c774da08c7532f30300fc578c770a9f8c7538010000ffffffff94f31600000000000000000078f3160090f31600010000000000000002000000 (UID: 00000000-00005192) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000095e18977c61a1700fefffffff5f68d77634d8e77f89c30001015e9708808e900b2f48d77bafb8c77ece916000000e8700000e870804d8e779efb8c77f0000000f000e8700000000058e916005c004300ecea16000000000001000000bce9160040f58d770000000000000000a8e91600 (UID: 00000000-00005192) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000c4ec3a000100010040e6b57618e9160018e9160024598e770000000068e8b576c8713100000000001100000040e91600575a8e7700000000030000000200000000000000880000000100000058e91600459dac7500001f0000000000800000000200000000001700dc1ae8706ce91600 (UID: 00000000-00005192) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000283fd36d08000000fa3ed36d3f7868e2020000006842d36d000017002f18d36dd8a21f00d0a21f00b8d916006842d36d78da1600ce85d46dd39ead8ffefffffffa3ed36d783ed36d2f18d36d0cda16001e3ed36d2f18d36d67c1ac754460d56d28da16004642d36d4460d56d00000000 (UID: 00000000-00005192) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f01a776b08000000c41a776bbea13ee202000000d41c776b00001700e616776b68a31f0058a31f0070d11600d0f0786b30d2160053af786bd26a5f89feffffffc41a776b421a776be616776bc4d11600d91b776be616776b67c1ac75ae059075745790750000000000000000cc928c75 (UID: 00000000-00005192) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000600000001000000b11d00000200000053657276696365205061636b20310000f01a776b08000000c41a776bbea13ee202000000d41c776b0000170002000000000000008800000070d11600b0d11600459dac7500001f000000000080000000020000000000170098138f6bc4d11600 (UID: 00000000-00005192) "WScript.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005192) "WScript.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb4a77d87d3c0000f0fd7f9a5c8e770060fd7f88c9df0244f0fd7f00000000400000003f0000002800000000f0fd7f7cc9df02c15c8e77608295772800000000f0fd7f9a5c8e770060fd7fa0c9df0257898d778083957713178d75d8eb4a77 (UID: 00000000-00005192) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb4a77a02823000030fd7f9a5c8e7700f0fd7fe8be18004430fd7f00000000400000003f0000001e0000000030fd7fdcbe1800c15c8e77608295771e0000000030fd7f9a5c8e7700f0fd7f00bf180057898d778083957713178d75d8eb4a77 (UID: 00000000-00005304) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b005c00760032002e0030002e00350030003700320037005c006d00730063006f00720077006b0073002e0064006c006c002e0032002e004d0061006e00690066006500730074000000 (UID: 00000000-00005304) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000636d6d6b00006600000000006c6d6d6b540067e1d8d7ac658cee180088ee180000000000000000000000000000000000d8d7ac65e0ed18000000000050ee18008cee180020ee1800ff236d6bc83b766b60ee180031176d6b080000001c5c8c7714a18d77ffffffff2400000048ee1800 (UID: 00000000-00005304) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005304) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005304)2d:T307c,"WScript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005192) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005192) "WScript.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00005192) "WScript.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00005192) "WScript.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005192) "WScript.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005192) "WScript.exe" called "LoadLibrary" with a parameter MSISIP.DLL (UID: 00000000-00005192) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00005192) "WScript.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005192) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wshext.dll (UID: 00000000-00005192) "WScript.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005192) "WScript.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005192) "WScript.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00005192) "WScript.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005192) "WScript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005192) "WScript.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005192) "WScript.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00005192) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00005192) "WScript.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00005192) "WScript.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00005192) "WScript.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005192) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System\ad92dab7f418877d6a1e0358ce35658a\System.ni.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\8229f0505633d4bcef019b9d4fab9f18\Microsoft.PowerShell.ConsoleH (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management.A#\84c47b5a5813a5f040aee9715a0ff7c0\System.Management.Automation. (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Core\bd9ff1a4363781a57e8f7392f230a203\System.Core.ni.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\49cae79ac18bad142e1ab5a46a8ac306\Microsoft.PowerShell.Commands (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\d6acc39f6c1ea42d8b3150db6184a969\System.Configuration.Install. (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\7bf5729401cff7ea7898124e9818ed20\Microsoft.WSMan.Management.ni (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Transactions\fec007ea17ac8956cc5d6d4074dada6a\System.Transactions.ni.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\f1831ce4588265a3f72e0a581ba58f2a\Microsoft.PowerShell.Commands (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\344e681515d07b93a4f1383f0d625e1e\Microsoft.PowerShell.Commands (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\573750f17b5b8316f04a10956fdd1d97\Microsoft.PowerShell.Security (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\culture.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\77c1dc46ea139bf5e1eaa9b87ef03c7a\System.Xml.ni.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management\00c2b464e52d4e82c04d61592a12a89d\System.Management.ni.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\237ed1739105c1bebe48d41905fdb3ee\System.DirectoryServices.ni.d (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data\511c39d1efa06d262a6b2f47e2726c73\System.Data.ni.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\5859b21b683c9f7f14622b57a90c63f1\System.ServiceProcess.ni.dll (UID: 00000000-00005304) "powershell.exe" called "LoadLibrary" with a parameter netutils.dll (UID: 00000000-00005304)2e:Tac01,"WScript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter WintrustCertificateTrust (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter SoftpubAuthenticode (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter SoftpubInitialize (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter SoftpubLoadMessage (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter SoftpubLoadSignature (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter SoftpubCheckCert (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter SoftpubCleanup (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter MsiSIPIsMyTypeOfFile (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter IsFileSupportedName (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter PutSignedDataMsg (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter GetSignedDataMsg (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter CLSIDFromProgIDEx (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter SxsOleAut32RedirectTypeLibrary (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005192) "WScript.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00005192) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadBSTR (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter IsCharAlphaW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CharPrevW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetNetResourceFromLocalPathW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter NetShareEnum (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CscNetApiGetInterface (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter SLGetWindowsInformationDWORD (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter PathRemoveFileSpecW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter _set_error_mode (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter ?set_terminate@@YAP6AXXZP6AXXZ@Z (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter _get_terminate (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter SetLoadedByMscoree (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetCLRFunction (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetTraceLoggerHandle (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetTraceEnableLevel (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetTraceEnableFlags (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter TraceEvent (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter IEE (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter IEE_RetAddr (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetStartupFlags (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetStartupFlags_RetAddr (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile_RetAddr (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetCORVersion_RetAddr (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetCORVersion (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory_RetAddr (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter RemoveVectoredContinueHandler (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetWriteWatch (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter ResetWriteWatch (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CreateMemoryResourceNotification (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter QueryMemoryResourceNotification (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetVersionEx (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter lstrlen (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter lstrlenW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter lstrcpy (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter lstrcpyW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CryptGenKey (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CryptSignHashA (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CryptGetUserKey (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CryptEnumProvidersA (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryShim_RetAddr (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryShim (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter ConvertLangIdToCultureName (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter ND_RI4 (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter ND_RI4_RetAddr (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter WinSqmIsOptedIn (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValue (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectory (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandleW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CreateDirectory (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCPW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfo (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfoW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObject_RetAddr (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter RtlMoveMemory (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter RtlMoveMemoryW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter ShellExecuteEx (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationProcessW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessesW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter DuplicateHandleW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter ND_RU1 (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter ND_RU1_RetAddr (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter LsaClose (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter LsaFreeMemory (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter LsaOpenPolicy (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter LsaOpenPolicyW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter LsaLookupSids (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter LsaLookupSidsW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter TerminateProcessW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00005304) "powershell.exe" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00005304)2f:Tc69f,Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CreateEventExW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SetThreadStackGuarantee"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumber"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformation"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CreateFile2"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetSystemWow64DirectoryW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "WNetAddConnection2W"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "WNetUseConnectionW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "WNetCancelConnection2W"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "WNetGetConnectionW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "InternetSetOptionW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "InternetCrackUrlW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "HttpQueryInfoW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "InternetQueryOptionW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "InternetConnectW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "HttpOpenRequestW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "HttpSendRequestW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "FtpOpenFileW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "FtpGetFileSize"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenUrlW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "InternetQueryDataAvailable"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetProcessMemoryInfo"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "IcmpSendEcho"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CreateEnvironmentBlock"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "DestroyEnvironmentBlock"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "lstrcpyW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "VirtualFreeEx"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetLongPathNameW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CopyFileExW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "MoveFileW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SetSystemPowerState"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceNamesW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "DeviceIoControl"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CreatePipe"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "InterlockedExchange"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileSectionW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileSectionW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileSectionNamesW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SetVolumeLabelW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CreateHardLinkW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetProcessIoCounters"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetProcessId"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SetPriorityClass"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "DestroyIcon"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetSysColorBrush"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CreatePopupMenu"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "MoveWindow"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "OpenWindowStationW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SetProcessWindowStation"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "OpenDesktopW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CloseWindowStation"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CloseDesktop"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CharUpperBuffW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "EnumChildWindows"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "ScreenToClient"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetFocus"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "AttachThreadInput"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "InvalidateRect"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "IsWindowEnabled"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "EnumWindows"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetMenu"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "BeginPaint"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CopyRect"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetKeyboardState"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetAsyncKeyState"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SendInput"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfoW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "IsIconic"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetMenuItemInfoW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SetMenuItemInfoW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetMenuItemCount"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetMenuItemID"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CheckMenuRadioItem"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "DeleteMenu"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetCursorPos"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "TrackPopupMenuEx"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "InsertMenuItemW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SetMenuDefaultItem"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "EnumThreadWindows"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SetActiveWindow"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CreateIconFromResourceEx"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "LoadImageW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CharLowerBuffW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "UnregisterHotKey"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetClipboardData"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CountClipboardFormats"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SetRect"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "AdjustWindowRectEx"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CopyImage"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetCursorInfo"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "RegisterHotKey"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "ClientToScreen"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "IsCharAlphaW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "IsCharAlphaNumericW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "IsCharUpperW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetMenuStringW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetSubMenu"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetCaretPos"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "IsZoomed"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "TranslateAcceleratorW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "InflateRect"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "DrawFocusRect"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "FrameRect"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "DrawFrameControl"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "FillRect"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "PtInRect"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "DestroyAcceleratorTable"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CreateAcceleratorTableW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetWindowDC"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "wsprintfW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "RedrawWindow"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "DrawMenuBar"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "DestroyMenu"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SetMenu"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextLengthW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CreateMenu"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "ReleaseCapture"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SetCapture"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "StretchBlt"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetDIBits"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetStockObject"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CreateSolidBrush"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "RoundRect"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetObjectW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetOpenFileNameW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetSaveFileNameW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "RegConnectRegistryW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "DuplicateTokenEx"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessAsUserW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessWithLogonW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "LogonUserW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetAclInformation"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetAce"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "AddAce"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "Shell_NotifyIconW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SHFileOperationW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SHGetDesktopFolder"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SHBrowseForFolderW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "ProgIDFromCLSID"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "OleSetMenuDescriptor"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CreateStreamOnHGlobal"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "OleInitialize"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "OleUninitialize"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CoGetObject"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "IIDFromString"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp")30:T525,"powershell.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135]31:T90d,Found string "www.youtube.com/watch?v=c0asJgSyxcY" (Indicator: "youtube"; File: "app(060e45bf7b57d4).js"), Found string "www.youtube.com/embed" (Indicator: "youtube"; File: "app(060e45bf7b57d4).js"), Found string "youtube.com" (Indicator: "youtube"; File: "app(060e45bf7b57d4).js"), file/memory contains long string with (Indicator: "youtube"; File: "app(060e45bf7b57d4).js"), Found string "* Ex:{ youtube : ["//www.youtube.com/watch?v=c0asJgSyxcY" "c0asJgSyxcY"] }" (Indicator: "youtube"; File: "app(060e45bf7b57d4).js"), Found string "var youtube = src.match(/\/\/(?:www\.)?youtu(?:\.be|be\.com)\/(?:watch\?v=|embed\/)?([a-z0-9\-\_\%]+)/i);" (Indicator: "youtube"; File: "app(060e45bf7b57d4).js"), Found string "if (youtube) {" (Indicator: "youtube"; File: "app(060e45bf7b57d4).js"), Found string "youtube: youtube" (Indicator: "youtube"; File: "app(060e45bf7b57d4).js"), Found string "if (_isVideo && _isVideo.youtube) {" (Indicator: "youtube"; File: "app(060e45bf7b57d4).js"), Found string "videoClass = 'lg-has-youtube';" (Indicator: "youtube"; File: "app(060e45bf7b57d4).js"), Found string "" (Indicator: "plus.google.com"; File: "urlref_httpdimsemenov.compluginsmagnific-popup"), Found string "
" (Indicator: "youtube"; File: "urlref_httpdimsemenov.compluginsmagnific-popup"), Found string "$('.popup-youtube, .popup-vimeo, .popup-gmaps').magnificPopup({" (Indicator: "youtube"; File: "urlref_httpdimsemenov.compluginsmagnific-popup") Found string "

Lokesh Dhakar for original Lightbox script.

" (Indicator: "twitter"; File: "urlref_httpdimsemenov.compluginsmagnific-popup") Found string "

Chris Coyier for awesome CSS techniques.

" (Indicator: "twitter"; File: "urlref_httpdimsemenov.compluginsmagnific-popup") Found string "

Brad Frost for conditional lightbox technique.

" (Indicator: "twitter"; File: "urlref_httpdimsemenov.compluginsmagnific-popup") file/memory contains long string with (Indicator: "twitter"; File: "urlref_httpdimsemenov.compluginsmagnific-popup")32:T281c,"WScript.exe" loaded module "OLE32.DLL" at base 75fc0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 77a20000 "WScript.exe" loaded module "WINTRUST.DLL" at base 75910000 "WScript.exe" loaded module "CRYPTSP.DLL" at base 75190000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74f20000 "WScript.exe" loaded module "ADVAPI32.DLL" at base 77a20000 "WScript.exe" loaded module "CRYPTBASE.DLL" at base 75680000 "WScript.exe" loaded module "MSISIP.DLL" at base 73760000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 75990000 "WScript.exe" loaded module "IMM32.DLL" at base 761f0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 70e80000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 6dd30000 "WScript.exe" loaded module "RPCRTREMOTE.DLL" at base 75720000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 6b8f0000 "WScript.exe" loaded module "SHELL32.DLL" at base 76790000 "WScript.exe" loaded module "PROPSYS.DLL" at base 74470000 "WScript.exe" loaded module "COMCTL32.DLL" at base 746b0000 "WScript.exe" loaded module "OLEAUT32.DLL" at base 77780000 "WScript.exe" loaded module "APPHELP.DLL" at base 75630000 "WScript.exe" loaded module "KERNEL32.DLL" at base 76500000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6a650000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76500000 "WScript.exe" loaded module "SETUPAPI.DLL" at base 76300000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74470000 "WScript.exe" loaded module "NTMARTA.DLL" at base 74440000 "WScript.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76120000 "WScript.exe" loaded module "PROFAPI.DLL" at base 757a0000 "WScript.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75970000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 75b70000 "WScript.exe" loaded module "SECUR32.DLL" at base 754b0000 "WScript.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75980000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75630000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70ce0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "powershell.exe" loaded module "KERNEL32" at base 76500000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76790000 "powershell.exe" loaded module "OLE32.DLL" at base 75fc0000 "powershell.exe" loaded module "USERENV.DLL" at base 75940000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76120000 "powershell.exe" loaded module "COMCTL32.DLL" at base 746b0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 77a20000 "powershell.exe" loaded module "KERNEL32.DLL" at base 76500000 "powershell.exe" loaded module "SHELL32.DLL" at base 76790000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 77780000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76500000 "powershell.exe" loaded module "SETUPAPI.DLL" at base 76300000 "powershell.exe" loaded module "RPCRT4.DLL" at base 76140000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74470000 "powershell.exe" loaded module "NTMARTA.DLL" at base 74440000 "powershell.exe" loaded module "APPHELP.DLL" at base 75630000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6e130000 "powershell.exe" loaded module "PROPSYS.DLL" at base 74470000 "powershell.exe" loaded module "LINKINFO.DLL" at base 6e0b0000 "powershell.exe" loaded module "PROFAPI.DLL" at base 757a0000 "powershell.exe" loaded module "USER32.DLL" at base 766c0000 "powershell.exe" loaded module "NTSHRUI.DLL" at base 72e80000 "powershell.exe" loaded module "SRVCLI.DLL" at base 75380000 "powershell.exe" loaded module "CSCAPI.DLL" at base 70830000 "powershell.exe" loaded module "SLC.DLL" at base 73b80000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 764a0000 "powershell.exe" loaded module "CRYPTSP.DLL" at base 75190000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74f20000 "powershell.exe" loaded module "CRYPTBASE.DLL" at base 75680000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72450000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "VERSION.DLL" at base 74c20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL" at base 65560000 "powershell.exe" loaded module "MSCOREE.DLL" at base 724e0000 "powershell.exe" loaded module "NTDLL" at base 77880000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 724e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\9F895C66454577EFF9C77442D0C84F71\MSCORLIB.NI.DLL" at base 64a60000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\OLE32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\AD92DAB7F418877D6A1E0358CE35658A\SYSTEM.NI.DLL" at base 642b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\8229F0505633D4BCEF019B9D4FAB9F18\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 66210000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT.A#\84C47B5A5813A5F040AEE9715A0FF7C0\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 63740000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "PSAPI.DLL" at base 77a00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 77880000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CORE\BD9FF1A4363781A57E8F7392F230A203\SYSTEM.CORE.NI.DLL" at base 65fd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\49CAE79AC18BAD142E1AB5A46A8AC306\MICROSOFT.POWERSHELL.COMMANDS.DIAGNOSTICS.NI.DLL" at base 6b600000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATIO#\D6ACC39F6C1EA42D8B3150DB6184A969\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 6b5d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.WSMAN.MAN#\7BF5729401CFF7EA7898124E9818ED20\MICROSOFT.WSMAN.MANAGEMENT.NI.DLL" at base 636b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.TRANSACTIONS\FEC007EA17AC8956CC5D6D4074DADA6A\SYSTEM.TRANSACTIONS.NI.DLL" at base 63610000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\2.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6b470000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\F1831CE4588265A3F72E0A581BA58F2A\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 63470000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\344E681515D07B93A4F1383F0D625E1E\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 633a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\573750F17B5B8316F04A10956FDD1D97\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 66310000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL" at base 71cd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\77C1DC46EA139BF5E1EAA9B87EF03C7A\SYSTEM.XML.NI.DLL" at base 62e60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT\00C2B464E52D4E82C04D61592A12A89D\SYSTEM.MANAGEMENT.NI.DLL" at base 62d50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DIRECTORYSER#\237ED1739105C1BEBE48D41905FDB3EE\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 62c30000 "powershell.exe" loaded module "SHFOLDER.DLL" at base 71cd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 754b0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 75610000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DATA\511C39D1EFA06D262A6B2F47E2726C73\SYSTEM.DATA.NI.DLL" at base 625d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.DATA\2.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 622f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL" at base 62290000 "powershell.exe" loaded module "GDI32.DLL" at base 75cc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DIASYMREADER.DLL" at base 62200000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6a650000 "powershell.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75970000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 75b70000 "powershell.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75980000 "powershell.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 71df0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75630000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.SERVICEPROCE#\5859B21B683C9F7F14622B57A90C63F1\SYSTEM.SERVICEPROCESS.NI.DLL" at base 6b990000 "powershell.exe" loaded module "NETUTILS.DLL" at base 73e3000033:T144d,"WScript.exe" touched "JScript Language" (Path: "HKCU\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}") "WScript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}") "WScript.exe" touched "Windows Script Host Shell Object" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}") "WScript.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "WScript.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "WScript.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "WScript.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "WScript.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "WScript.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "WScript.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "WScript.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "WScript.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "WScript.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "WScript.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "WScript.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "WScript.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "WScript.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "WScript.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "WScript.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "WScript.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "WScript.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "WScript.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "WScript.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "WScript.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "WScript.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "WScript.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "powershell.exe" touched "Custom Destination List" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}") "powershell.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "powershell.exe" touched "Start Menu Pin" (Path: "HKCU\CLSID\{A2A9545D-A0C2-42B4-9708-A0B2BADD77C8}\TREATAS") "powershell.exe" touched "Taskband Pin" (Path: "HKCU\CLSID\{90AA3A4E-1CBA-4233-B8BB-535773D48449}\TREATAS") "powershell.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "Internet Shortcut" (Path: "HKCU\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "User Pinned" (Path: "HKCU\CLSID\{1F3427C8-5C10-4210-AA03-2EE45287D668}\SHELLFOLDER") "powershell.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837}\INPROCSERVER32") "powershell.exe" touched "User Assist" (Path: "HKCU\CLSID\{DD313E04-FEFF-11D1-8ECD-0000F87A470C}\TREATAS") "powershell.exe" touched "Shared Task Scheduler" (Path: "HKCU\CLSID\{603D3801-BD81-11D0-A3A5-00C04FD706EC}\TREATAS") "powershell.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS")34:T100e,Output: "_itjuyfoaf() /*! Magnific Popup - v1.1.0 - 2016-02-20 * http://dimsemenov.com/plugins/magnific-popup/ * Copyright (c) 2016 Dmitry Semenov; */ ! function(a) { "function" == typeof define && define.amd ? define(["jquery"], a) : a("object" == typeof exports ? require("jquery") : window.jQuery || window.Zepto) }(function(a) { var b, c, d, e, f, g, h = "Close", i = "BeforeClose", j = "AfterClose", k = "BeforeAppend", l = "MarkupParse", m = "Open", n = "Change", o = "mfp", p = "." + o, q = "mfp-ready", r = "mfp-removing", s = "mfp-prevent-close", t = function() {}, u = !!window.jQuery, v = a(window), w = function(a, c) { b.ev.on(o + a + p, c) }, x = function(b, c, d, e) { var f = document.createElement("div"); return f.className = "mfp-" + b, d && (f.innerHTML = d), e ? c && c.appendChild(f) : (f = a(f), c && f.appendTo(c)), f }, y = function(c, d) { b.ev.triggerHandler(o + c, d), b.st.callbacks && (c = c.charAt(0).toLowerCase() + c.slice(1), b.st.callbacks[c] && b.st.callbacks[c].apply(b, a.isArray(d) ? d : [d])) }, z = function(c) { return c === g && b.currTemplate.closeBtn || (b.currTemplate.closeBtn = a(b.st.closeMarkup.replace("%title%", b.st.tClose)), g = c), b.currTemplate.closeBtn }, A = function() { a.magnificPopup.instance || (b = new t, b.init(), a.magnificPopup.instance = b) }, B = function() { var a = document.createElement("p").style, b = ["ms", "O", "Moz", "Webkit"]; if (void 0 !== a.transition) return !0; for (; b.length;) if (b.pop() + "Transition" in a) return !0; return !1 }; t.prototype = { constructor: t, init: function() { var c = navigator.appVersion; b.isLowIE = b.isIE8 = document.all && !document.addEventListener, b.isAndroid = /android/gi.test(c), b.isIOS = /iphone|ipad|ipod/gi.test(c), b.supportsTransition = B(), b.probablyMobile = b.isAndroid || b.isIOS || /(Opera Mini)|Kindle|webOS|BlackBerry|(Opera Mobi)|(Windows Phone)|IEMobile/i.test(navigator.userAgent), d = a(document), b.popupsCache = {} }, open: function(c) { var e; if (c.isObj === !1) { b.items = c.items.toArray(), b.index = 0; var g, h = c.items; for (e = 0; e < h.length; e++) if (g = h[e], g.parsed && (g = g.el[0]), g === c.el[0]) { b.index = e; break } } else b.items = a.isArray(c.items) ? c.items : [c.items], b.index = c.index || 0; if (b.isOpen) return void b.updateItemHTML(); b.types = [], f = "", c.mainEl && c.mainEl.length ? b.ev = c.mainEl.eq(0) : b.ev = d, c.key ? (b.popupsCache[c.key] || (b.popupsCache[c.key] = {}), b.currTemplate = b.popupsCache[c.key]) : b.currTemplate = {}, b.st = a.extend(!0, {}, a.magnificPopup.defaults, c), b.fixedContentPos = "auto" === b.st.fixedContentPos ? !b.probablyMobile : b.st.fixedContentPos, b.st.modal && (b.st.closeOnContentClick = !1, b.st.closeOnBgClick = !1, b.st.showCloseBtn = !1, b.st.enableEscapeKey = !1), b.bgOverlay || (b.bgOverlay = x("bg").on("click" + p, function() { b.close() }), b.wrap = x("wrap").attr("tabindex", -1).on("click" + p, function(a) { b._checkIfClose(a.target) && b.close() }), b.container = x("container", b.wrap)), b.contentContainer = x( ..."35:T4139,Observed system executable string:"/C:\ PROGRA~2Vyd* MICROS~1VQt* WindowsSTARTM~1ProgramsVyd*ACCESS~1WINDOW~1WINDOW~1.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPSdet-cnguhpjbdki/C:\ PROGRA~2Vyd* MICROS~1VQt* WindowsSTARTM~1ProgramsVyd*ACCESS~1WINDOW~1WINDOW~1.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPSdet-cnguhpjbdki/C:\iWyjWindowsiWyj*iWyjSystem32iWyj*WINDOW~1v1.0powershell_ise.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exe1SPS1SPSdet-cnguhpjbdki/C:\iWyjWindowsiWyj*hh.exeC:\Windows\hh.exe%systemroot%\hh.exe1SPS1SPSdet-cnguhpjbdki" [Source: IHY0H00BNVRX3VCJHKAA.temp] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00005192-00000C41-3548955606] Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ni 'C:/tepp' -Type Directory -Force;cd 'C:/tepp'; Invoke-Web" [Source: 00000000-00005192-00000C41-3548955606] Observed system executable string:"%WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe" [Source: 00000000-00005304-00000C28-5495330806] Observed system executable string:"%WINDIR%\system32\AutoIt3.exe" [Source: 00000000-00005304-00000C28-16046340571] Observed system executable string:"%WINDIR%\system32\AutoIt3.exe.ps1" [Source: 00000000-00005304-00000C28-16047720333] Observed system executable string:"%WINDIR%\system32\AutoIt3.exe.psm1" [Source: 00000000-00005304-00000C28-16048761299] Observed system executable string:"%WINDIR%\system32\AutoIt3.exe.psd1" [Source: 00000000-00005304-00000C28-16049787859] Observed system executable string:"%WINDIR%\system32\AutoIt3.exe.COM" [Source: 00000000-00005304-00000C28-16050863329] Observed system executable string:"%WINDIR%\system32\AutoIt3.exe.EXE" [Source: 00000000-00005304-00000C28-16051926163] Observed system executable string:"%WINDIR%\system32\AutoIt3.exe.BAT" [Source: 00000000-00005304-00000C28-16052969179] Observed system executable string:"%WINDIR%\system32\AutoIt3.exe.CMD" [Source: 00000000-00005304-00000C28-16054004003] Observed system executable string:"%WINDIR%\system32\AutoIt3.exe.VBS" [Source: 00000000-00005304-00000C28-16055044979] Observed system executable string:"%WINDIR%\system32\AutoIt3.exe.VBE" [Source: 00000000-00005304-00000C28-16056080365] Observed system executable string:"%WINDIR%\system32\AutoIt3.exe.JS" [Source: 00000000-00005304-00000C28-16057115307] Observed system executable string:"%WINDIR%\system32\AutoIt3.exe.JSE" [Source: 00000000-00005304-00000C28-16058159377] Observed system executable string:"%WINDIR%\system32\AutoIt3.exe.WSF" [Source: 00000000-00005304-00000C28-16059212595] Observed system executable string:"%WINDIR%\system32\AutoIt3.exe.WSH" [Source: 00000000-00005304-00000C28-16060249405] Observed system executable string:"%WINDIR%\system32\AutoIt3.exe.MSC" [Source: 00000000-00005304-00000C28-16061895647] Observed system executable string:"%WINDIR%\AutoIt3.exe" [Source: 00000000-00005304-00000C28-16062955045] Observed system executable string:"%WINDIR%\AutoIt3.exe.ps1" [Source: 00000000-00005304-00000C28-16063993217] Observed system executable string:"%WINDIR%\AutoIt3.exe.psm1" [Source: 00000000-00005304-00000C28-16065015805] Observed system executable string:"%WINDIR%\AutoIt3.exe.psd1" [Source: 00000000-00005304-00000C28-16066026823] Observed system executable string:"%WINDIR%\AutoIt3.exe.COM" [Source: 00000000-00005304-00000C28-16067040039] Observed system executable string:"%WINDIR%\AutoIt3.exe.EXE" [Source: 00000000-00005304-00000C28-16068053473] Observed system executable string:"%WINDIR%\AutoIt3.exe.BAT" [Source: 00000000-00005304-00000C28-16069075679] Observed system executable string:"%WINDIR%\AutoIt3.exe.CMD" [Source: 00000000-00005304-00000C28-16070081241] Observed system executable string:"%WINDIR%\AutoIt3.exe.VBS" [Source: 00000000-00005304-00000C28-16071082341] Observed system executable string:"%WINDIR%\AutoIt3.exe.VBE" [Source: 00000000-00005304-00000C28-16072092723] Observed system executable string:"%WINDIR%\AutoIt3.exe.JS" [Source: 00000000-00005304-00000C28-16073095585] Observed system executable string:"%WINDIR%\AutoIt3.exe.JSE" [Source: 00000000-00005304-00000C28-16074099095] Observed system executable string:"%WINDIR%\AutoIt3.exe.WSF" [Source: 00000000-00005304-00000C28-16075546769] Observed system executable string:"%WINDIR%\AutoIt3.exe.WSH" [Source: 00000000-00005304-00000C28-16076565611] Observed system executable string:"%WINDIR%\AutoIt3.exe.MSC" [Source: 00000000-00005304-00000C28-16077575659] Observed system executable string:"%WINDIR%\System32\Wbem\AutoIt3.exe" [Source: 00000000-00005304-00000C28-16078600931] Observed system executable string:"%WINDIR%\System32\Wbem\AutoIt3.exe.ps1" [Source: 00000000-00005304-00000C28-16079628667] Observed system executable string:"%WINDIR%\System32\Wbem\AutoIt3.exe.psm1" [Source: 00000000-00005304-00000C28-16080674389] Observed system executable string:"%WINDIR%\System32\Wbem\AutoIt3.exe.psd1" [Source: 00000000-00005304-00000C28-16081705175] Observed system executable string:"%WINDIR%\System32\Wbem\AutoIt3.exe.COM" [Source: 00000000-00005304-00000C28-16082730043] Observed system executable string:"%WINDIR%\System32\Wbem\AutoIt3.exe.EXE" [Source: 00000000-00005304-00000C28-16083756393] Observed system executable string:"%WINDIR%\System32\Wbem\AutoIt3.exe.BAT" [Source: 00000000-00005304-00000C28-16084782685] Observed system executable string:"%WINDIR%\System32\Wbem\AutoIt3.exe.CMD" [Source: 00000000-00005304-00000C28-16085809155] Observed system executable string:"%WINDIR%\System32\Wbem\AutoIt3.exe.VBS" [Source: 00000000-00005304-00000C28-16086834399] Observed system executable string:"%WINDIR%\System32\Wbem\AutoIt3.exe.VBE" [Source: 00000000-00005304-00000C28-16088397935] Observed system executable string:"%WINDIR%\System32\Wbem\AutoIt3.exe.JS" [Source: 00000000-00005304-00000C28-16089455261] Observed system executable string:"%WINDIR%\System32\Wbem\AutoIt3.exe.JSE" [Source: 00000000-00005304-00000C28-16090496761] Observed system executable string:"%WINDIR%\System32\Wbem\AutoIt3.exe.WSF" [Source: 00000000-00005304-00000C28-16091544145] Observed system executable string:"%WINDIR%\System32\Wbem\AutoIt3.exe.WSH" [Source: 00000000-00005304-00000C28-16092577681] Observed system executable string:"%WINDIR%\System32\Wbem\AutoIt3.exe.MSC" [Source: 00000000-00005304-00000C28-16093619565] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\AutoIt3.exe" [Source: 00000000-00005304-00000C28-16094793719] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\AutoIt3.exe.ps1" [Source: 00000000-00005304-00000C28-16095892007] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\AutoIt3.exe.psm1" [Source: 00000000-00005304-00000C28-16096963679] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\AutoIt3.exe.psd1" [Source: 00000000-00005304-00000C28-16098032875] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\AutoIt3.exe.COM" [Source: 00000000-00005304-00000C28-16099087345] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\AutoIt3.exe.EXE" [Source: 00000000-00005304-00000C28-16100142219] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\AutoIt3.exe.BAT" [Source: 00000000-00005304-00000C28-16101193327] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\AutoIt3.exe.CMD" [Source: 00000000-00005304-00000C28-16102658269] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\AutoIt3.exe.VBS" [Source: 00000000-00005304-00000C28-16103730007] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\AutoIt3.exe.VBE" [Source: 00000000-00005304-00000C28-16104788935] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\AutoIt3.exe.JS" [Source: 00000000-00005304-00000C28-16105843217] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\AutoIt3.exe.JSE" [Source: 00000000-00005304-00000C28-16106899129] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\AutoIt3.exe.WSF" [Source: 00000000-00005304-00000C28-16107948823] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\AutoIt3.exe.WSH" [Source: 00000000-00005304-00000C28-16109018279] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\AutoIt3.exe.MSC" [Source: 00000000-00005304-00000C28-16110071713] Observed system executable string:"%WINDIR%\system32\get-AutoIt3.exe" [Source: 00000000-00005304-00000C28-16220506413] Observed system executable string:"%WINDIR%\system32\get-AutoIt3.exe.ps1" [Source: 00000000-00005304-00000C28-16221547729] Observed system executable string:"%WINDIR%\system32\get-AutoIt3.exe.psm1" [Source: 00000000-00005304-00000C28-16222603835] Observed system executable string:"%WINDIR%\system32\get-AutoIt3.exe.psd1" [Source: 00000000-00005304-00000C28-16223651431] Observed system executable string:"%WINDIR%\system32\get-AutoIt3.exe.COM" [Source: 00000000-00005304-00000C28-16224714549] Observed system executable string:"%WINDIR%\system32\get-AutoIt3.exe.EXE" [Source: 00000000-00005304-00000C28-16225754107] Observed system executable string:"%WINDIR%\system32\get-AutoIt3.exe.BAT" [Source: 00000000-00005304-00000C28-16227282189] Observed system executable string:"%WINDIR%\system32\get-AutoIt3.exe.CMD" [Source: 00000000-00005304-00000C28-16228341723] Observed system executable string:"%WINDIR%\system32\get-AutoIt3.exe.VBS" [Source: 00000000-00005304-00000C28-16229384047] Observed system executable string:"%WINDIR%\system32\get-AutoIt3.exe.VBE" [Source: 00000000-00005304-00000C28-16230427541] Observed system executable string:"%WINDIR%\system32\get-AutoIt3.exe.JS" [Source: 00000000-00005304-00000C28-16231496347] Observed system executable string:"%WINDIR%\system32\get-AutoIt3.exe.JSE" [Source: 00000000-00005304-00000C28-16232542657] Observed system executable string:"%WINDIR%\system32\get-AutoIt3.exe.WSF" [Source: 00000000-00005304-00000C28-16233582289] Observed system executable string:"%WINDIR%\system32\get-AutoIt3.exe.WSH" [Source: 00000000-00005304-00000C28-16234624237] Observed system executable string:"%WINDIR%\system32\get-AutoIt3.exe.MSC" [Source: 00000000-00005304-00000C28-16235669119] Observed system executable string:"%WINDIR%\get-AutoIt3.exe" [Source: 00000000-00005304-00000C28-16236709333] Observed system executable string:"%WINDIR%\get-AutoIt3.exe.ps1" [Source: 00000000-00005304-00000C28-16237741421] Observed system executable string:"%WINDIR%\get-AutoIt3.exe.psm1" [Source: 00000000-00005304-00000C28-16238842295] Observed system executable string:"%WINDIR%\get-AutoIt3.exe.psd1" [Source: 00000000-00005304-00000C28-16239857107] Observed system executable string:"%WINDIR%\get-AutoIt3.exe.COM" [Source: 00000000-00005304-00000C28-16241274937] Observed system executable string:"%WINDIR%\get-AutoIt3.exe.EXE" [Source: 00000000-00005304-00000C28-16242295237] Observed system executable string:"%WINDIR%\get-AutoIt3.exe.BAT" [Source: 00000000-00005304-00000C28-16243307965] Observed system executable string:"%WINDIR%\get-AutoIt3.exe.CMD" [Source: 00000000-00005304-00000C28-16244337585] Observed system executable string:"%WINDIR%\get-AutoIt3.exe.VBS" [Source: 00000000-00005304-00000C28-16245348275] Observed system executable string:"%WINDIR%\get-AutoIt3.exe.VBE" [Source: 00000000-00005304-00000C28-16246377869] Observed system executable string:"%WINDIR%\get-AutoIt3.exe.JS" [Source: 00000000-00005304-00000C28-16247394093] Observed system executable string:"%WINDIR%\get-AutoIt3.exe.JSE" [Source: 00000000-00005304-00000C28-16248403105] Observed system executable string:"%WINDIR%\get-AutoIt3.exe.WSF" [Source: 00000000-00005304-00000C28-16249432971] Observed system executable string:"%WINDIR%\get-AutoIt3.exe.WSH" [Source: 00000000-00005304-00000C28-16250448465] Observed system executable string:"%WINDIR%\get-AutoIt3.exe.MSC" [Source: 00000000-00005304-00000C28-16251460879] Observed system executable string:"%WINDIR%\System32\Wbem\get-AutoIt3.exe" [Source: 00000000-00005304-00000C28-16252481155] Observed system executable string:"%WINDIR%\System32\Wbem\get-AutoIt3.exe.ps1" [Source: 00000000-00005304-00000C28-16253510969] Observed system executable string:"%WINDIR%\System32\Wbem\get-AutoIt3.exe.psm1" [Source: 00000000-00005304-00000C28-16254980443] Observed system executable string:"%WINDIR%\System32\Wbem\get-AutoIt3.exe.psd1" [Source: 00000000-00005304-00000C28-16256034063] Observed system executable string:"%WINDIR%\System32\Wbem\get-AutoIt3.exe.COM" [Source: 00000000-00005304-00000C28-16257074049] Observed system executable string:"%WINDIR%\System32\Wbem\get-AutoIt3.exe.EXE" [Source: 00000000-00005304-00000C28-16258109205] Observed system executable string:"%WINDIR%\System32\Wbem\get-AutoIt3.exe.BAT" [Source: 00000000-00005304-00000C28-16259138081] Observed system executable string:"%WINDIR%\System32\Wbem\get-AutoIt3.exe.CMD" [Source: 00000000-00005304-00000C28-16260182515] Observed system executable string:"%WINDIR%\System32\Wbem\get-AutoIt3.exe.VBS" [Source: 00000000-00005304-00000C28-16261214731] Observed system executable string:"%WINDIR%\System32\Wbem\get-AutoIt3.exe.VBE" [Source: 00000000-00005304-00000C28-16262245685] Observed system executable string:"%WINDIR%\System32\Wbem\get-AutoIt3.exe.JS" [Source: 00000000-00005304-00000C28-16263280877] Observed system executable string:"%WINDIR%\System32\Wbem\get-AutoIt3.exe.JSE" [Source: 00000000-00005304-00000C28-16264312279] Observed system executable string:"%WINDIR%\System32\Wbem\get-AutoIt3.exe.WSF" [Source: 00000000-00005304-00000C28-16265339011] Observed system executable string:"%WINDIR%\System32\Wbem\get-AutoIt3.exe.WSH" [Source: 00000000-00005304-00000C28-16266368105] Observed system executable string:"%WINDIR%\System32\Wbem\get-AutoIt3.exe.MSC" [Source: 00000000-00005304-00000C28-16267408393] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\get-AutoIt3.exe" [Source: 00000000-00005304-00000C28-16268889917] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\get-AutoIt3.exe.ps1" [Source: 00000000-00005304-00000C28-16269963787] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\get-AutoIt3.exe.psm1" [Source: 00000000-00005304-00000C28-16271028385] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\get-AutoIt3.exe.psd1" [Source: 00000000-00005304-00000C28-16272091285] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\get-AutoIt3.exe.COM" [Source: 00000000-00005304-00000C28-16273150439] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\get-AutoIt3.exe.EXE" [Source: 00000000-00005304-00000C28-16274204827] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\get-AutoIt3.exe.BAT" [Source: 00000000-00005304-00000C28-16275345577] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\get-AutoIt3.exe.CMD" [Source: 00000000-00005304-00000C28-16276427009] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\get-AutoIt3.exe.VBS" [Source: 00000000-00005304-00000C28-16277499555] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\get-AutoIt3.exe.VBE" [Source: 00000000-00005304-00000C28-16278575773] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\get-AutoIt3.exe.JS" [Source: 00000000-00005304-00000C28-16279652465] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\get-AutoIt3.exe.JSE" [Source: 00000000-00005304-00000C28-16280730387] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\get-AutoIt3.exe.WSF" [Source: 00000000-00005304-00000C28-16281817359] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\get-AutoIt3.exe.WSH" [Source: 00000000-00005304-00000C28-16283391727] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\get-AutoIt3.exe.MSC" [Source: 00000000-00005304-00000C28-16284481957]36:T468,"WScript.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "powershell.exe" reads file "C:\Users\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini" "powershell.exe" reads file "C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini" "powershell.exe" reads file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini" "powershell.exe" reads file "C:\Users\Public\desktop.ini" "powershell.exe" reads file "C:\Users\Public\Desktop\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini" "powershell.exe" reads file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini" "powershell.exe" reads file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini" "powershell.exe" reads file "C:\Program Files\desktop.ini"37:Tf55,Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00005192-00000C25-37829569] Observed system executable string:"%WINDIR%\system32\CRYPT32.dll" [Source: 00000000-00005192-00000C25-38070208] Observed system executable string:"%WINDIR%\system32\wshext.dll" [Source: 00000000-00005192-00000C25-38169962] Observed system executable string:"%WINDIR%\system32\shell32.dll" [Source: 00000000-00005304-00000C25-40919035] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00005304-00000C25-42013376] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" [Source: 00000000-00005304-00000C25-42826173] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll" [Source: 00000000-00005304-00000C25-43175841] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll" [Source: 00000000-00005304-00000C25-43234279] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll" [Source: 00000000-00005304-00000C25-43259283] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System\ad92dab7f418877d6a1e0358ce35658a\System.ni.dll" [Source: 00000000-00005304-00000C25-43434482] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" [Source: 00000000-00005304-00000C25-43680321] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00005304-00000C25-43760223] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00005304-00000C25-43794311] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Core\bd9ff1a4363781a57e8f7392f230a203\System.Core.ni.dll" [Source: 00000000-00005304-00000C25-44252294] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Transactions\fec007ea17ac8956cc5d6d4074dada6a\System.Transactions.ni.dll" [Source: 00000000-00005304-00000C25-44542634] Observed system executable string:"%WINDIR%\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll" [Source: 00000000-00005304-00000C25-44584374] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\culture.dll" [Source: 00000000-00005304-00000C25-44768348] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll" [Source: 00000000-00005304-00000C25-44779422] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll" [Source: 00000000-00005304-00000C25-44789800] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll" [Source: 00000000-00005304-00000C25-44804594] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\77c1dc46ea139bf5e1eaa9b87ef03c7a\System.Xml.ni.dll" [Source: 00000000-00005304-00000C25-44859834] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management\00c2b464e52d4e82c04d61592a12a89d\System.Management.ni.dll" [Source: 00000000-00005304-00000C25-44888002] Observed system executable string:"%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll" [Source: 00000000-00005304-00000C25-45201659] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data\511c39d1efa06d262a6b2f47e2726c73\System.Data.ni.dll" [Source: 00000000-00005304-00000C25-45515660] Observed system executable string:"%WINDIR%\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll" [Source: 00000000-00005304-00000C25-45547875]38:T781,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "")39:Tc55,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "WSCRIPT"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS SCRIPT HOST\SETTINGS"; Key: "IGNOREUSERSETTINGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS SCRIPT HOST\SETTINGS"; Key: "ENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS SCRIPT HOST\SETTINGS"; Key: "ENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: "CEIPENABLE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "EVERYONEINCLUDESANONYMOUS"; Value: "")3a:T857,"WScript.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "WScript.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "powershell.exe" touched file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.config" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" "powershell.exe" touched file "C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb" "powershell.exe" touched file "C:\Windows\System.Management.Automation.pdb" "powershell.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "powershell.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "powershell.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\IHY0H00BNVRX3VCJHKAA.temp" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFfa3cd.TMP" "powershell.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations"3b:T843,"WScript.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "WScript.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "WScript.exe" trying to access non-existent file "\Device\HarddiskVolume2\POWERSHELL.EXE" "WScript.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\POWERSHELL.EXE" "WScript.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\system\POWERSHELL.EXE" "WScript.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\POWERSHELL.EXE" "WScript.exe" trying to access non-existent file "\Device\HarddiskVolume2\ProgramData\Oracle\Java\javapath_target_623756\POWERSHELL.EXE" "WScript.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\wbem\POWERSHELL.EXE" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\CRYPTBASE.DLL" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL"3c:T9a3,"WScript.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WSCRIPT.EXE.LOCAL" "WScript.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\powershell.exe:ZONE.IDENTIFIER" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\desktop.ini" "powershell.exe" trying to access non-existent file "C:\ProgramData\Microsoft\desktop.ini" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.config" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb" "powershell.exe" trying to access non-existent file "C:\Windows\System.Management.Automation.pdb" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.EXE.LOCAL" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\DESKTOP.INI" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\ProgramData\Microsoft\DESKTOP.INI" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\IHY0H00BNVRX3VCJHKAA.TEMP" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.EXE.CONFIG" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v2.0.50727\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\SECURITY.CONFIG"3d:T2b55,Pattern match: "http://dimsemenov.com/plugins/magnific-popup/" Pattern match: "www.youtube.com/watch?v=c0asJgSyxcY" Pattern match: "muddledramblings.com/table-of-css3-border-radius-compliance" Pattern match: "modernizr.github.com/Modernizr/touch.html" Heuristic match: "miketaylr.com" Pattern match: "http://siliconerumble.com:443" Pattern match: "player.vimeo.com/video" Pattern match: "github.com/Modernizr/Modernizr/issues/issue/21" Pattern match: "crbug.com/36415" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "msdn.microsoft.com/en-us/library/ms533897%28VS.85%29.aspx" Pattern match: "srufaculty.sru.edu/david.dailey/svg/newstuff/clipPath4.svg" Pattern match: "javascript.nwbox.com/CSSSupport" Pattern match: "github.com/Modernizr/Modernizr/issues/213#issuecomment-1149491" Pattern match: "https://github.com/kriskowal/es5-shim/blob/master/es5-shim.js" Pattern match: "www.modernizr.com" Pattern match: "github.com/Modernizr/Modernizr/issues/396" Heuristic match: "vimeo.com" Pattern match: "es5.github.com/#x15.3.4.5" Pattern match: "github.com/Modernizr/Modernizr/issues/issue/97" Pattern match: "github.com/Modernizr/Modernizr/issues/513" Pattern match: "github.com/NielsLeenheer/html5test/blob/9106a8/#L845" Pattern match: "www.modernizr.com/license" Heuristic match: "yepnopejs.com" Pattern match: "http://dimsemenov.com/plugins/magnific-popup" Pattern match: "www.quirksmode.org/dom/html5.html" Pattern match: "http://sachinchoolur.github.io/lightGallery/demos/html-markup.html" Pattern match: "github.com/Modernizr/Modernizr/issues/342" Pattern match: "miketaylr.com/code/input-type-attr.html" Pattern match: "github.com/Modernizr/Modernizr/issues/146" Pattern match: "paulirish.com/demo/inline-svg" Pattern match: "github.com/Modernizr/Modernizr/issues/546" Pattern match: "github.com/Modernizr/Modernizr/issues/#issue/59/comment/516632" Pattern match: "http://sachinchoolur.github.io/lightGallery" Pattern match: "www.youtube.com/embed" Pattern match: "www.modernizr.com/download" Pattern match: "css-tricks.com/rgba-browser-support" Pattern match: "gist.github.com/786768" Pattern match: "https://code.google.com/p/chromium/issues/detail?id=26723" Heuristic match: "youtube.com" Pattern match: "github.com/Modernizr/Modernizr/issues/333" Pattern match: "kangax.github.com/iseventsupported" Pattern match: "www.whatwg.org/specs/web-apps/current-work/multipage/the-input-element.html#input-type-attr-summary" Pattern match: "http://siliconerumble.com:443/msitotdjhak" Pattern match: "github.com/Modernizr/Modernizr/issues/538" Pattern match: "http://dimsemenov.com/plugins/magnific-popup/*" Pattern match: "www.youtube.com/embed/%id%?autoplay=1},vimeo:{index:vimeo.com/,id:/,src://player.vimeo.com/video/%id%?autoplay=1},gmaps:{index://maps.google.,src:%id%&output=embed}}},proto:{initIframe:function(){b.types.push(P),w" Heuristic match: "ms.length>1&&c.arrows&&!b.arrowLeft){var d=c.arrowMarkup,e=b.arrowLeft=a(d.replace(/%title%/gi,c.tPrev).replace(/%dir%/gi,left)).addClass(s),f=b.arrowRight=a(d.replace(/%title%/gi,c.tNext).replace(/%dir%/gi,right)).addClass(s);e.click(function(){b.prev" Pattern match: "www.modernizr.com/download/" Pattern match: "erik.eae.net/archives/2008/03/10/21.48.10/" Pattern match: "dev.w3.org/csswg/css3-flexbox" Pattern match: "bugzil.la/732441" Pattern match: "mozilla.org/en-US/firefox/organizations/faq/" Pattern match: "github.com/Modernizr/Moderniz" Pattern match: "javascript.nwbox.com/CSSSupport/" Pattern match: "ub.com/Modernizr/Modernizr/issues/538" Pattern match: "bugzil.la/365772" Pattern match: "webk.it/74252" Pattern match: "http://sachinchoolur.github.io/lightGallery/*" Heuristic match: "l'); _src = _this.$items.eq(index).attr('href') || _this.$items.eq(index).attr('data-src'); if (_this.$items.eq(index).attr('data-responsive')) { var srcItms = _this.$items.eq(index).attr('data-responsive').split(','); " Pattern match: "kangax.github.com/iseventsupported/" Pattern match: "github.com/Modernizr/Modernizr/issues/issue/97/" Pattern match: "goo.gl/v3V4Gp" Pattern match: "github.com/NielsLeenheer" Pattern match: "developer.mozilla.org/En/Media_formats_supported_by_the_audio_and_video_elements" Pattern match: "https://code.google.com/p/chromium/is" Pattern match: "www.modernizr.com/license/" Pattern match: "webk.it/70117" Pattern match: "webk.it/43956" Pattern match: "bugzil.la/688158" Pattern match: "css-tricks.com/rgba-browser-support/" Pattern match: "webkit.org/blog/175/introducing-css-gradients/" Pattern match: "developer.mozilla.org/en/CSS/-moz-linear-gradient" Pattern match: "developer.mozilla.org/en/CSS/-moz-radial-gradient" Pattern match: "dev.w3.org/csswg/css3-images/#gradients-" Pattern match: "bit.ly/iphoneoscodecs" Pattern match: "http://sachinchoolur.github.io/lightGallery/" Pattern match: "http://ogp.me/ns#" Pattern match: "http://dimsemenov.com/magnific-og-400x400.jpg" Pattern match: "https://plus.google.com/102586375605352607718" Pattern match: "https://github.com/dimsemenov/Magnific-Popup" Pattern match: "http://farm9.staticflickr.com/8241/8589392310_7b6127e243_b.jpg" Pattern match: "http://farm9.staticflickr.com/8241/8589392310_7b6127e243_s.jpg" Pattern match: "http://farm9.staticflickr.com/8379/8588290361_ecf8c27021_b.jpg" Pattern match: "http://farm9.staticflickr.com/8379/8588290361_ecf8c27021_s.jpg" Pattern match: "http://farm4.staticflickr.com/3721/9207329484_ba28755ec4_o.jpg" Pattern match: "http://codepen.io/dimsemenov/pen/vKrqs" Pattern match: "http://farm9.staticflickr.com/8242/8558295633_f34a55c1c6_b.jpg" Pattern match: "http://farm9.staticflickr.com/8382/8558295631_0f56c1284f_b.jpg" Pattern match: "http://farm9.staticflickr.com/8225/8558295635_b1c5ce2794_b.jpg" Pattern match: "http://farm9.staticflickr.com/8383/8563475581_df05e9906d_b.jpg" Pattern match: "http://farm9.staticflickr.com/8235/8559402846_8b7f82e05d_b.jpg" Pattern match: "http://farm9.staticflickr.com/8235/8558295467_e89e95e05a_b.jpg" Pattern match: "http://farm9.staticflickr.com/8378/8559402848_9fcd90d20b_b.jpg" Pattern match: "http://farm4.staticflickr.com/3763/9204547649_0472680945_o.jpg" Pattern match: "http://farm4.staticflickr.com/3763/9204547649_7de96ee188_t.jpg" Pattern match: "http://farm3.staticflickr.com/2856/9207329420_7f2a668b06_o.jpg" Pattern match: "http://farm3.staticflickr.com/2856/9207329420_e485948b01_t.jpg" Pattern match: "http://www.youtube.com/watch?v=0O2aH4XLbto" Pattern match: "https://vimeo.com/45830194" Pattern match: "https://maps.google.com/maps?q=221B+Baker+Street,+London,+United+Kingdom&hl=en&t=v&hnear=221B+Baker+St,+London+NW1+6XE,+United+Kingdom" Pattern match: "http://codepen.io/dimsemenov/pen/GAIkt" Pattern match: "http://example.com/fakeg" Pattern match: "http://coding.smashingmagazine.com/2013/05/02/truly-responsive-lightbox/" Pattern match: "http://gruntjs.com" Pattern match: "http://bradfrostweb.com/blog/post/conditional-lightbox/" Pattern match: "http://codepen.io/dimsemenov/pen/sHoxp" Pattern match: "http://dimsemenov.us1.list-manage.com/subscribe/post?u=ef6026d946a7b5d41d92c02e4&id=54fae727da" Pattern match: "https://github.com/dimsemenov/Magnific-Popup/issues?state=open" Pattern match: "http://dimsemenov.com/subscribe.html" Pattern match: "https://github.com/dimsemenov/Magnific-Popup/issues" Pattern match: "https://twitter.com/lokesh" Pattern match: "https://twitter.com/chriscoyier" Pattern match: "https://twitter.com/brad_frost" Pattern match: "https://twitter.com/intent/tweet?text=Magnific%20Popup%20-%20responsive%20lightbox%20plugin&url=http%3A%2F%2Fbit.ly%2Fmagnificpopup&via=dimsemenov" Pattern match: "http://www.facebook.com/sharer.php?u=http%3A%2F%2Fdimsemenov.com%2Fplugins%2Fmagnific-popup%2F%3Futm_source%3Dfb%26utm_medium%3Dsocial%26utm_campaign%3Dmfp" Pattern match: "https://plus.google.com/share?url=http%3A%2F%2Fdimsemenov.com%2Fplugins%2Fmagnific-popup%2F%3Futm_source%3Dgplus%26utm_medium%3Dsocial%26utm_campaign%3Dmfp" Pattern match: "http://ghbtns.com/github-btn.html?user=dimsemenov&repo=magnific-popup&type=watch&count=true&size=large" Pattern match: "http://dimsemenov.com" Pattern match: "https://ssl" Pattern match: "mc.yandex.ru/metrika/watch.js" Pattern match: "https://raw.github.com/dimsemenov/Magnific-Popup/master/src/css/main.scss" Pattern match: "http://bit.ly/magnific-popup" Pattern match: "http://yandex.st/highlightjs/7.3/highlight.min.js" Heuristic match: "%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\7bf5729401cff7ea7898124e9818ed20\Microsoft.WSMan.Management.ni" Heuristic match: "C:\%SystemRoot%\system32\WindowsPowerShell\v1.0\Invoke-WebRequest.COM" Heuristic match: "%ALLUSERSPROFILE%\Oracle\Java\javapath\Invoke-WebRequest.COM" Heuristic match: "%WINDIR%\system32\Invoke-WebRequest.COM" Heuristic match: "%WINDIR%\Invoke-WebRequest.COM" Heuristic match: "%WINDIR%\System32\Wbem\Invoke-WebRequest.COM" Heuristic match: "%WINDIR%\System32\WindowsPowerShell\v1.0\Invoke-WebRequest.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python38-32\Scripts\Invoke-WebRequest.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python38-32\Invoke-WebRequest.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python36-32\Scripts\Invoke-WebRequest.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python36-32\Invoke-WebRequest.COM" Heuristic match: "C:\%SystemRoot%\system32\WindowsPowerShell\v1.0\AutoIt3.exe.COM" Heuristic match: "%ALLUSERSPROFILE%\Oracle\Java\javapath\AutoIt3.exe.COM" Heuristic match: "%WINDIR%\system32\AutoIt3.exe.COM" Heuristic match: "%WINDIR%\AutoIt3.exe.COM" Heuristic match: "%WINDIR%\System32\Wbem\AutoIt3.exe.COM" Heuristic match: "%WINDIR%\System32\WindowsPowerShell\v1.0\AutoIt3.exe.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python38-32\Scripts\AutoIt3.exe.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python38-32\AutoIt3.exe.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python36-32\Scripts\AutoIt3.exe.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python36-32\AutoIt3.exe.COM" Heuristic match: "C:\%SystemRoot%\system32\WindowsPowerShell\v1.0\get-AutoIt3.exe.COM" Heuristic match: "%ALLUSERSPROFILE%\Oracle\Java\javapath\get-AutoIt3.exe.COM" Heuristic match: "%WINDIR%\system32\get-AutoIt3.exe.COM" Heuristic match: "%WINDIR%\get-AutoIt3.exe.COM" Heuristic match: "%WINDIR%\System32\Wbem\get-AutoIt3.exe.COM" Heuristic match: "%WINDIR%\System32\WindowsPowerShell\v1.0\get-AutoIt3.exe.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python38-32\Scripts\get-AutoIt3.exe.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python38-32\get-AutoIt3.exe.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python36-32\Scripts\get-AutoIt3.exe.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python36-32\get-AutoIt3.exe.COM" Heuristic match: "PATHEXT=.COM;.EXE;.BA" Pattern match: "http://www.autoitscript.com/autoit3/" Heuristic match: "mI.Us"3e:T9ce,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe (UID: 00000000-00005304) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005304) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00005304) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005304) "powershell.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00005304) "powershell.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00005304) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00005304) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00005304) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00005304) "powershell.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00005304) "powershell.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00005304) "powershell.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00005304) "powershell.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00005304) "powershell.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00005304) "powershell.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00005304) "powershell.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00005304) "powershell.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00005304) "powershell.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00005304) "powershell.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00005304) "powershell.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00005304) "powershell.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00005304) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00005304) "powershell.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00005304) "powershell.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00005304)3f:T51f,Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp")40:T6e0,Found reference to API "GetFileInformationByHandleExW" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "FtpGetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp")41:T48e,"powershell.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\IHY0H00BNVRX3VCJHKAA.temp" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFfa3cd.TMP" with delete access "powershell.exe" opened "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\SECURITY.CONFIG.CCH.5304.907360299" with delete access "powershell.exe" opened "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\ENTERPRISESEC.CONFIG.CCH.5304.907360299" with delete access "powershell.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\CLR SECURITY CONFIG\V2.0.50727.312\SECURITY.CONFIG.CCH.5304.907360330" with delete access42:T84d,Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "AddAce" (Indicator: "AddAce"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00005632.00000001.66373.00F20000.00000002.mdmp")43:T4e6,"WScript.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "") "WScript.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "") "WScript.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "") "WScript.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "") "powershell.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "") "powershell.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "") "powershell.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "") "powershell.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "")44:T6b8,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGHEAPFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGHEAPFLAGS"; Value: "")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"16613e7c07681726ab577e6ac14114cb42691838fa3c6c4c1bef7dafa2c7c4a0","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791038862046,"unified_at":"2026-10-03T14:47:42.046Z","metadata":{"hashes":{"sha256":"16613e7c07681726ab577e6ac14114cb42691838fa3c6c4c1bef7dafa2c7c4a0","sha1":"3f39780bffd9b6b04dba52843622497606808020","md5":"b428fd3b31d80dbdbbe4ee4949cfbe54","sha512":"dd77e51e0d6c573d7fe7a3d5ac50b23fe0d81a3323ad89f80a8a3eadd61dc2cff9a6f86ea7632315ec3549e7528053b3634ebc8aec158a3023ca434ea85988c3","ssdeep":"6144:Fe7hgXeerjqlI2Iro+lJe7hgXeerjqlI2Iro+8:FIhgSlI23mJIhgSlI23V","ssdeep_chunks":["6144:Fe7hgXe","6144:e7hgXee","6144:7hgXeer","6144:hgXeerj","6144:gXeerjq","6144:Xeerjql","6144:eerjqlI","6144:erjqlI2","6144:rjqlI2I","6144:jqlI2Ir","6144:qlI2Iro","6144:lI2Iro+","6144:I2Iro+l","6144:2Iro+lJ","6144:Iro+lJe","6144:ro+lJe7","6144:o+lJe7h","6144:+lJe7hg","6144:lJe7hgX","6144:Je7hgXe","6144:I2Iro+8","12288:Fe7hgXe","12288:e7hgXee","12288:7hgXeer","12288:hgXeerj","12288:gXeerjq","12288:Xeerjql","12288:eerjqlI","12288:erjqlI2","12288:rjqlI2I","12288:jqlI2Ir","12288:qlI2Iro","12288:lI2Iro+","12288:I2Iro+l","12288:2Iro+lJ","12288:Iro+lJe","12288:ro+lJe7","12288:o+lJe7h","12288:+lJe7hg","12288:lJe7hgX","12288:Je7hgXe","12288:I2Iro+8","6144:FIhgSlI","6144:IhgSlI2","6144:hgSlI23","6144:gSlI23m","6144:SlI23mJ","6144:lI23mJI","6144:I23mJIh","6144:23mJIhg","6144:3mJIhgS","6144:mJIhgSl","6144:JIhgSlI","6144:gSlI23V"],"imphash":"Unknown"},"file_info":{"file_name":"app(060e45bf7b57d4).js","file_type":["script","javascript"],"file_type_id":"js","file_size":258866,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1699539506000,"last_seen":1699539506000,"last_multi_scan":1699539506000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":3,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":66},"sandbox_signatures":{"informative_count":174,"suspicious_count":6,"malicious_count":2,"total":182},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"GT:JS.Backdoor.2.BD72BF34","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"GT:JS.Backdoor.2.BD72BF34 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan/JS.DarkGate.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Windows Script Host executes Powershell"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Contains ability to register hotkeys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"suspicious","value":"Writes data to a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"suspicious","value":"Contains ability to modify thread functionality - possible hijack (API string)"},{"type":"informative","value":"Contains ability to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"},{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to terminate services/features (Powershell command string)"},{"type":"informative","value":"Contains ability to block user input (API string)"},{"type":"informative","value":"Tries to map intranet network resources to internet zone"},{"type":"informative","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"suspicious","value":"Tries to terminate services/features using Powershell"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"},{"type":"informative","value":"Contains ability to empty the recycle bin (API string)"},{"type":"informative","value":"Deletes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Marks file for deletion"},{"type":"informative","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Calls an API typically used to acquire handle to a key container within a CSP"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","identifiers":[{"type":"informative","value":"Renames files with double extension (often done by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of a forensics/monitoring tool"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the windows installation date"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access recent files"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user names for specified SIDs"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to get content from a webpage (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"},{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Calls an API typically to import cryptographic keys into a CSP"}],"sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"$28","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"\"powershell.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms\" to \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RFfa3cd.TMP\"\n \"powershell.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\IHY0H00BNVRX3VCJHKAA.temp\" to \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Tries to map intranet network resources to internet zone","description":"\"WScript.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to block user input (API string)","description":"Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-547","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 5304)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Possibly checks for the presence of a forensics/monitoring tool","description":"$29","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-45","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically to import cryptographic keys into a CSP","description":"$2a","origin":"API Call","mitre_attack_id":"T1486","relevance":1,"id":"api-233","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to acquire handle to a key container within a CSP","description":"\"powershell.exe\" called \"CryptAcquireContextA\" with parameters {\"phProv\": \"68992100\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531872\"}\n \"powershell.exe\" called \"CryptAcquireContextA\" with parameters {\"phProv\": \"e0872100\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531872\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-228","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Found decoded Javascript strings\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Calls an API typically to import cryptographic keys into a CSP","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"WScript.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005192)\n \"powershell.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005304)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"WScript.exe\" called \"IsWow64Process\" with parameter \"5192\" - (UID: 00000000-00005192)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"5304\" - (UID: 00000000-00005304)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00005304)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"WScript.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005192)\n \"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005304)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"powershell.exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00005304)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"WScript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00005192)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00005304)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005304)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"GetMonitorInfoW\" (Indicator: \"GetMonitorInfo\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindow\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"GetWindowTextLengthW\" (Indicator: \"GetWindowText\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayoutNameW\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"APPENDPATH\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"PATH\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\AUTOIT3.EXE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\AUTOIT3.EXE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\AUTOIT3.EXE\"; Key: \"APPENDPATH\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\AUTOIT3.EXE\"; Key: \"PATH\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to access recent files","description":"\"powershell.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms\"\n \"powershell.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\IHY0H00BNVRX3VCJHKAA.TEMP\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\IHY0H00BNVRX3VCJHKAA.temp\"\n \"powershell.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RFfa3cd.TMP\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-169","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"WScript.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Caches (UID: 00000000-00005192)\n \"powershell.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Caches (UID: 00000000-00005304)\n \"powershell.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations (UID: 00000000-00005304)\n \"powershell.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00005304)\n \"powershell.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00005304)\n \"powershell.exe\" called \"CreateDirectoryW\" with parameter C:\\tepp (UID: 00000000-00005304)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"WScript.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -Command ni 'C:/tepp' -Type Directory -Force;cd 'C:/tepp'; Invoke-Web\" - (UID: 00000000-00005192)\n \"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\AutoIt3\\AutoIt3.exe\" totdjhak.au3\" - (UID: 00000000-00005304)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2e","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"CreateProcessWithLogonW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegConnectRegistryW\" (Indicator: \"RegConnectRegistry\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFile2\" (Indicator: \"CreateFile\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"IcmpCreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"LoadUserProfileW\" (Indicator: \"LoadUserProfile\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"LogonUserW\" (Indicator: \"LogonUser\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys (API string)","description":"Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.009","relevance":1,"id":"string-545","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00005632.00000001.66373.00F20000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\AutoIt v3\\AutoIt\" in Source: 00000000-00005632.00000001.66373.00F20000.00000002.mdmp\n \"SOFTWARE\\Classes\\\" in Source: 00000000-00005632.00000001.66373.00F20000.00000002.mdmp\n \"SYSTEM\\CurrentControlSet\\Control\\Nls\\Language\" in Source: 00000000-00005632.00000001.66373.00F20000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n \"Global\\CLR_PerfMon_WrapMutex\"\n \"_SHuassist.mtx\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$30","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"$31","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$32","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\9f895c66454577eff9c77442d0c84f71\\mscorlib.ni.dll\" at 64A60000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76140000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76140000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"11001200289cfe75@jscript.dll\"\n \"0f0010003c9cfe75@jscript.dll\"\n \"150016003cca886b@ADVAPI32.dll\"\n \"0e000f00ecca886b@ADVAPI32.dll\"\n \"0e000f0048cb886b@ADVAPI32.dll\"\n \"1100120024d3886b@ADVAPI32.dll\"\n \"11001200c0d3886b@ADVAPI32.dll\"\n \"1200130004d4886b@ADVAPI32.dll\"\n \"120013005cd4886b@ADVAPI32.dll\"\n \"14001500ecf3886b@ADVAPI32.dll\"\n \"1400150004f4886b@ADVAPI32.dll\"\n \"140015001cf4886b@ADVAPI32.dll\"\n \"1700180034f4886b@ADVAPI32.dll\"\n \"0d000e004cf4886b@ADVAPI32.dll\"\n \"0f00100078f5886b@ADVAPI32.dll\"\n \"14001500b8f5886b@ADVAPI32.dll\"\n \"14001500d0f5886b@ADVAPI32.dll\"\n \"0c000d0018f6886b@ADVAPI32.dll\"\n \"0c000d0028f6886b@ADVAPI32.dll\"\n \"0e000f0038f6886b@ADVAPI32.dll\"\n \"18001900a0f7886b@RPCRT4.dll\"\n \"13001400ccf7886b@RPCRT4.dll\"\n \"14001500e0f7886b@RPCRT4.dll\"\n \"16001700f8f7886b@RPCRT4.dll\"\n \"0b000c005cf0886b@WS2_32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"app(060e45bf7b57d4).js\" was detected as \"plain text\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$33","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Parsed Javascript","description":"$34","origin":"Static Parser","relevance":5,"id":"static-25","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$35","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"powershell.exe\" (UID: 00000000-00005304) was launched with modified environment variables: \"Path\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Reads configuration files (.ini files)","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"654cea32f0390396850747ff"}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"Found string \"