26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 51:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 17277418809b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 17277418809b…. Malware family: Trojan.Generic. Threat score 100/100. 13/26 AV engines flagged this file. 13 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/17277418809bfc803df5fcb1aff0b1268fac38210e2eca8a555bee9f85492e9a","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","17277418809bfc803df5fcb1aff0b1268fac38210e2eca8a555bee9f85492e9a"],"about":{"@type":"SoftwareApplication","name":"Invoice details.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"17277418809bfc803df5fcb1aff0b1268fac38210e2eca8a555bee9f85492e9a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":13,"total":26},"behavioralIndicators":{"malicious":13,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T13cf,Found reference to "RijndaelEncryptionProvider" (Indicator: "Rijndael"; File: "00000000-00001268.00000001.260621.01342000.00000020.mdmp") Found reference to "RNGCryptoServiceProvider" (Indicator: "RNGCryptoServiceProvider"; File: "00000000-00001268.00000001.260621.01342000.00000020.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; File: "00000000-00001268.00000001.260621.01342000.00000020.mdmp") Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; File: "00000000-00001268.00000001.260621.01342000.00000020.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "00000000-00001268.00000001.260621.01342000.00000020.mdmp") Found reference to "SHA1CryptoServiceProvider" (Indicator: "SHA1CryptoServiceProvider"; File: "00000000-00001268.00000001.260621.01342000.00000020.mdmp") Found reference to "HMACSHA256" (Indicator: "HMAC"; File: "00000000-00001268.00000001.260621.01342000.00000020.mdmp") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; File: "00000000-00001268.00000001.260621.01342000.00000020.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; File: "00000000-00001268.00000001.260621.01342000.00000020.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; File: "00000000-00001268.00000001.260621.01342000.00000020.mdmp") Found reference to "DeriveBytes" (Indicator: "DeriveBytes"; File: "00000000-00001268.00000001.260621.01342000.00000020.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; File: "00000000-00001268.00000001.260621.01342000.00000020.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; File: "00000000-00001268.00000001.260621.01342000.00000020.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "00000000-00001268.00000001.260621.01342000.00000020.mdmp") Found reference to "CryptographicException" (Indicator: "CryptographicException"; File: "00000000-00001268.00000001.260621.01342000.00000020.mdmp") Found reference to "AesGcm" (Indicator: "Aes"; File: "00002888.00000B48.15287315.00092000.wprm") Found reference to "AesGcm" (Indicator: "AesGcm"; File: "00002888.00000B48.15287315.00092000.wprm") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "00002888.00000B48.15287315.00092000.wprm") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; File: "00002888.00000B48.15287315.00092000.wprm") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDES"; File: "00002888.00000B48.15287315.00092000.wprm") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDESCryptoServiceProvider"; File: "00002888.00000B48.15287315.00092000.wprm") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00004668-00000CBC-3096699479") Found reference to "RijndaelEncryptionProvider" (Indicator: "Rijndael"; Source: "00000000-00001268.00000001.260621.01342000.00000020.mdmp, 00000000-00001268.00000001.260621.05200000.00000004.mdmp") Found reference to "RNGCryptoServiceProvider" (Indicator: "RNGCryptoServiceProvider"; Source: "00000000-00001268.00000001.260621.01342000.00000020.mdmp, 00000000-00001268.00000001.260621.05200000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00001268.00000001.260621.01342000.00000020.mdmp, 00000000-00001268.00000001.260621.05200000.00000004.mdmp") Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; Source: "00000000-00001268.00000001.260621.01342000.00000020.mdmp, 00000000-00001268.00000001.260621.05200000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00001268.00000001.260621.01342000.00000020.mdmp, 00000000-00001268.00000001.260621.05200000.00000004.mdmp") Found reference to "SHA1CryptoServiceProvider" (Indicator: "SHA1CryptoServiceProvider"; Source: "00000000-00001268.00000001.260621.01342000.00000020.mdmp, 00000000-00001268.00000001.260621.05200000.00000004.mdmp") Found reference to "HMACSHA256" (Indicator: "HMAC"; Source: "00000000-00001268.00000001.260621.01342000.00000020.mdmp, 00000000-00001268.00000001.260621.05200000.00000004.mdmp") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; Source: "00000000-00001268.00000001.260621.01342000.00000020.mdmp, 00000000-00001268.00000001.260621.05200000.00000004.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; Source: "00000000-00001268.00000001.260621.01342000.00000020.mdmp, 00000000-00001268.00000001.260621.05200000.00000004.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; Source: "00000000-00001268.00000001.260621.01342000.00000020.mdmp, 00000000-00001268.00000001.260621.05200000.00000004.mdmp") Found reference to "DeriveBytes" (Indicator: "DeriveBytes"; Source: "00000000-00001268.00000001.260621.01342000.00000020.mdmp, 00000000-00001268.00000001.260621.05200000.00000004.mdmp")28:T446,Invoice details.exe has big resource with name: "Swztaysrzo" size: "861935" and abnormal entropy:"7.999694683905506" Invoice details.exe has big resource with name: "Nancy.ErrorHandling.Resources.404.html" size: "30055" and abnormal entropy:"6.090897215069141" Invoice details.exe has big resource with name: "Nancy.ErrorHandling.Resources.500.html" size: "21863" and abnormal entropy:"6.1250504542026345" Invoice details.exe has big resource with name: "Nancy.Diagnostics.Resources.info.png" size: "17045" and abnormal entropy:"7.972835358504665" IsInherited.exe has big resource with name: "Swztaysrzo" size: "861935" and abnormal entropy:"7.999694683905506" IsInherited.exe has big resource with name: "Nancy.ErrorHandling.Resources.404.html" size: "30055" and abnormal entropy:"6.090897215069141" IsInherited.exe has big resource with name: "Nancy.ErrorHandling.Resources.500.html" size: "21863" and abnormal entropy:"6.1250504542026345" IsInherited.exe has big resource with name: "Nancy.Diagnostics.Resources.info.png" size: "17045" and abnormal entropy:"7.972835358504665"29:T118e,Found string - ;a=a.split(/\s+/);for(c=0,d=a.length;c)[^>]*$|#([\w\-]*)$)/ j=/\S/ k=/^\s+/ l=/\s+$/ m=/^<(\w+)\s*\/?>(?:<\/\1>)?$/ n=/^[\] :{}\s]*$/ o=/\\(?:["\\\/bfnrt]|u[0-9a-fA-F]{4})/g p=/"[^"\\\n\r]*"|true|false|null|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?/g,q=/(?:^|:|,)(?:\s*\[)+/g,r=/(webkit)[ \/]([\w.]+)/,s=/(opera)(?:.*version)?[ \/]([\w.]+)/,t=/(msie) ([\w.]+)/,u=/(mozilla)(?:.*? rv:([\w.]+))?/,v=/-([a-z]|[0-9])/ig,w=/^-ms-/,x=function(a,b){return(b+"").toUpperCase()},y=d.userAgent,z,A,B,C=Object.prototype.toString,D=Object.prototype.hasOwnProperty,E=Array.prototype.push,F=Array.prototype.slice,G=String.prototype.trim,H=Array.prototype.indexOf,I={};e.fn=e.prototype={constructor:e,init:function(a,d,f){var g,h,j,k;if(!a)return this;if(a.nodeT; Source: "Invoice details.exe"), Found string - ll?"on":a.value}}}),f.each(["radio","checkbox"],function(){f.valHooks[this]=f.extend(f.valHooks[this],{set:function(a,b){if(f.isArray(b))return a.checked=f.inArray(f(a).val(),b)>=0}})});var z=/^(?:textarea|input|select)$/i,A=/^([^\.]*)?(?:\.(.+))?$/,B=/\bhover(\.\S+)?\b/,C=/^key/,D=/^(?:mouse|contextmenu)|click/,E=/^(?:focusinfocus|focusoutblur)$/,F=/^(\w*)(?:#([\w\-]+))?(?:\.([\w\-]+))?$/,G=function(a){var b=F.exec(a);b&&(b[1]=(b[1]||"").toLowerCase(),b[3]=b[3]&&new RegExp("(?:^|\\s)"+b[3]+"(?:\\s|$)"));return b},H=function(a,b){var c=a.attributes||{};return(!b[1]||a.nodeName.toLowerCase()===b[1])&&(!b[2]||(c.id||{}).value===b[2])&&(!b[3]||b[3].test((c["class"]||{}).value))},I=function(a){return f.event.special.hover?a:a.replace(B,"mouseenter$1 mouseleave$1")};f.event={add:function(a,c,d,e,g){var h,i,j,k,l,m,n,o,p,q,r,s;if(!(a.nodeType===3||a.nodeType===8||!c||!d||!(h=f._data(a)))){d.handler&&(p=d,d=p.handler),d.guid||(d.guid=f.guid++),j=h.events,j||(h.events=j={}),i=h.handle,i||(h.handle=i=function(a){retu; Source: "Invoice details.exe"), Found string - ;a=a.split(/\s+/);for(c=0,d=a.length;c)[^>]*$|#([\w\-]*)$)/,j=/\S/,k=/^\s+/,l=/\s+$/,m=/^<(\w+)\s*\/?>(?:<\/\1>)?$/,n=/^[\],:{}\s]*$/,o=/\\(?:["\\\/bfnrt]|u[0-9a-fA-F]{4})/g p=/"[^"\\\n\r]*"|true|false|null|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?/g,q=/(?:^|:|,)(?:\s*\[)+/g,r=/(webkit)[ \/]([\w.]+)/,s=/(opera)(?:.*version)?[ \/]([\w.]+)/,t=/(msie) ([\w.]+)/,u=/(mozilla)(?:.*? rv:([\w.]+))?/,v=/-([a-z]|[0-9])/ig,w=/^-ms-/,x=function(a,b){return(b+"").toUpperCase()},y=d.userAgent,z,A,B,C=Object.prototype.toString,D=Object.prototype.hasOwnProperty,E=Array.prototype.push,F=Array.prototype.slice,G=String.prototype.trim,H=Array.prototype.indexOf,I={};e.fn=e.prototype={constructor:e,init:function(a,d,f){var g,h,j,k;if(!a)return this;if(a.node; Source: "00000000-00001268.00000001.260621.01342000.00000020.mdmp"), Found string - ll?"on":a.value}}}),f.each(["radio","checkbox"],function(){f.valHooks[this]=f.extend(f.valHooks[this],{set:function(a,b){if(f.isArray(b))return a.checked=f.inArray(f(a).val(),b)>=0}})});var z=/^(?:textarea|input|select)$/i,A=/^([^\.]*)?(?:\.(.+))?$/,B=/\bhover(\.\S+)?\b/,C=/^key/,D=/^(?:mouse|contextmenu)|click/,E=/^(?:focusinfocus|focusoutblur)$/,F=/^(\w*)(?:#([\w\-]+))?(?:\.([\w\-]+))?$/,G=function(a){var b=F.exec(a);b&&(b[1]=(b[1]||"").toLowerCase(),b[3]=b[3]&&new RegExp("(?:^|\\s)"+b[3]+"(?:\\s|$)"));return b},H=function(a,b){var c=a.attributes||{};return(!b[1]||a.nodeName.toLowerCase()===b[1])&&(!b[2]||(c.id||{}).value===b[2])&&(!b[3]||b[3].test((c["class"]||{}).value))},I=function(a){return f.event.special.hover?a:a.replace(B,"mouseenter$1 mouseleave$1")};f.event={add:function(a,c,d,e,g){var h,i,j,k,l,m,n,o,p,q,r,s;if(!(a.nodeType===3||a.nodeType===8||!c||!d||!(h=f._data(a)))){d.handler&&(p=d,d=p.handler),d.guid||(d.guid=f.guid++),j=h.events,j||(h.events=j={}),i=h.handle,i||(h.handle=i=function(a){ret; Source: "00000000-00001268.00000001.260621.01342000.00000020.mdmp"), Found string - \\.\pipe\PSHost.133911753520286828.3352.DefaultAppDomain.powershell; Source: "00000000-00003352-00000C56-3075396621")2a:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIbVQYJKoZIhvcNAQcCoIIbRjCCG0ICAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQU+zz3vaNz0s6W8CREgPojmh03NLSgghYqMIIEEjCCAvqgAwIBAgIPAMEAizw8iBHRPvZj7N9AMA0GCSqGSIb3DQ" "cchString": "9628" "dwFlags": "1" "pbBinary": "30821b5506092a864886f70d010702a0821b4630821b42020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414fb3cf7bda373d2ce96f0244480fa239a1d3734b4a082162a30820412308202faa003020102020f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d01010405003070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479301e170d3937303131303037303030305a170d3230313233313037303030305a3070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a902bdc170e63bf24e1b289f97785e30eaa2a98d255ff8fe954ca3b7fe9da2203e7c51a29ba28f60326bd1426479eeac76c954daf2eb9c861c8f9f8466b3c56b7a6223d61d3cde0f0192e896c4bf2d669a9a682699d03a2cbf0cb55826c146e70a3e38962ca92839a8ec498342e3840fbb9a6c5561ac827ca1602d774ce999b4643b9a501c310824149fa9e7912b18e63d986314605805659f1d375287f7a7ef9402c61bd3bf5545b38980bf3aec54944eaefda77a6d744eaf18cc96092821005790606937bb4b12073c56ff5bfba4660a08a6d2815657efb63b5e16817704daf6beae8095feb0cd7fd6a71a725c3ccabcf008a32230b30685c9b320771385df0203010001a381a83081a53081a20603551d0104819a30819780105bd070ef69729e23517e14b24d8effcba1723070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479820f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d0101040500038201010095e80bc08df3971835edb80124d87711f35c60329f9e0bcb3e0591888fc93ae621f2f057932cb5a047c862effcd7cc3b3b5aa9365469fe246d3fc9ccaade057cdd318d3d9f10706abbfe124f1869c0fcd043e311" "pcbBinary": "591b0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIbVQYJKoZIhvcNAQcCoIIbRjCCG0ICAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9628" "dwFlags": "1" "pbBinary": "30821b5506092a864886f70d010702a0821b4630821b42020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414fb3cf7bda373d2ce96f0244480fa239a1d3734b4a082162a30820412308202faa003020102020f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d01010405003070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479301e170d3937303131303037303030305a170d3230313233313037303030305a3070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a902bdc170e63bf24e1b289f97785e30eaa2a98d255ff8fe954ca3b7fe9da2203e7c51a29ba28f60326bd1426479eeac76c954daf2eb9c861c8f9f8466b3c56b7a6223d61d3cde0f0192e896c4bf2d669a9a682699d03a2cbf0cb55826c146e70a3e38962ca92839a8ec498342e3840fbb9a6c5561ac827ca1602d774ce999b4643b9a501c310824149fa9e7912b18e63d986314605805659f1d375287f7a7ef9402c61bd3bf5545b38980bf3aec54944eaefda77a6d744eaf18cc96092821005790606937bb4b12073c56ff5bfba4660a08a6d2815657efb63b5e16817704daf6beae8095feb0cd7fd6a71a725c3ccabcf008a32230b30685c9b320771385df0203010001a381a83081a53081a20603551d0104819a30819780105bd070ef69729e23517e14b24d8effcba1723070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479820f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d0101040500038201010095e80bc08df3971835edb80124d87711f35c60329f9e0bcb3e0591888fc93ae621f2f057932cb5a047c862effcd7cc3b3b5aa9365469fe246d3fc9ccaade057cdd318d3d9f10706abbfe124f1869c0fcd043e311" "pcbBinary": "591b0000" "pdwFlags": "01000000"}2b:T681,Contains base64 string in header "MSIE" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "CLR1" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "3705" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "Host" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "MSIE" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org" Contains base64 string in header "CLR1" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org" Contains base64 string in header "3705" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org" Contains base64 string in header "Host" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org"2c:T88c,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to encrypt/decrypt data using TripleDES Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains asymmetric cryptographic functions (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Commandline contains long base64 encoded string Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to decrypt data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: Contains ability to perform symmetric decryption (Dotnet) Matched sigs: Hooks key cryptographic functions of the CryptoAPI Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to decode string content at runtime (Dotnet) Matched sigs: HTTP requests contain Base64 strings Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: Sample file has high entropy (likely encrypted/compressed content)2d:T9f6,"Invoicedetails.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000c00c0001e02000000000000000000004077a90000000000200000000000000000000000b854ab003074a9005075a900f0a5ab00f878a9000000000028f574000000000084f774004558cf77c46d2f00feffffff0ce4ca7772e1ca7764c50d76d042cb77000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000064c50d76f0a5ab0064c50d7600000000 (UID: 00000000-00001268) "Invoicedetails.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001268) "Invoicedetails.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001268) "Invoicedetails.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000a900000000002038a9000000000064270000000000001037a9007f07000028f4ac0000000000ff070000000000008000000000000000000000000000000000000000000000000200000270a9ac0000000000000000000000000000000000ff070000000000007827005fc400a9000100000000000000020000000c00000028f4ac0028f4ac0023f4ac0000000000000000000000a9000000000110f132000000000030f732004558cf77ec772f00feffffff1634cb774134cb7794000000a000000022f4ac0020f4ac0094000000b4f23200b91435760000000018000000b3f7b1dd (UID: 00000000-00001268)2e:T1f00,"Invoicedetails.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000085ab0098f77400e733cb771634cb7764f87400010000009401a9000100000018f77400b416cc77c020d8779a16cc779449917764f874000100000001000000e0deab0000000000e8f6740018f7740084f774004558cf775c052f00feffffff9a16cc77a51979770000087600000000 (UID: 00000000-00001268) "Invoicedetails.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007750726f6365737349642c302c302c2c3466340d0a00656c33322e646c6c2c223235323a35323a35342e353937222c52583d302c50583d30000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001268) "Invoicedetails.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001268) "Invoicedetails.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb7476f0a7220500e0fd7ed30fcc770090fa7e9cc3920544e0fd7e00000000400000003f0000002b00000000e0fd7e90c39205fa0fcc775042d8772b00000000e0fd7ed30fcc770090fa7eb4c39205b883cb770021d87794467977d8eb7476 (UID: 00000000-00001268) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007750726f6365737349642c302c302c2c6431380d0a00656c33322e646c6c2c223235323a35333a32322e303938222c52583d302c50583d30003030303030623131643030303030323030303030303533303036353030373230303736303036393030363330303635303032303030353030 (UID: 00000000-00003352) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100004558cf77a3412f00feffffff3b02cb77750acc77c8747f001015dc6e8808dc00def5ca770314377798ead2000000db6e0000db6e920acc771f143777f0000000f000db6e0000000004ead2005c00430098ebd200000000000100000068ead2006cf6ca77000000000000000054ead200 (UID: 00000000-00003352) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000880000000000000004ead200459d817600006e000000000080000000020000000000d300dc1adb6e18ead200 (UID: 00000000-00003352) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb7476c038440500e0fd7ed30fcc770090fa7ebcd4200644e0fd7e00000000400000003f0000002200000000e0fd7eb0d42006fa0fcc775042d8772200000000e0fd7ed30fcc770090fa7ed4d42006b883cb770021d87794467977d8eb7476 (UID: 00000000-00003352) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003352) "InstallUtil.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000070c2a10084f85f00e733cb771634cb7750f95f000100000094019f000100000004f85f00b416cc77c020d8779a16cc7710ddb97750f95f00010000000100000080e0a10000000000d4f75f0004f85f0070f85f004558cf77c49e2c00feffffff9a16cc77a51979770000087600000000 (UID: 00000000-00004668) "InstallUtil.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100382c2c4973576f77363450726f636573732c6b65726e656c33322e646c6c2c223235323a35333a33342e383433222c52583d302c50583d30007070696e6753656374696f6e2c2053797374656d2e536572766963654d6f64656c2c2056657273696f6e3d342e302e302e302c2043756c74 (UID: 00000000-00004668) "InstallUtil.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100763b02cb779ccbfd77f42eda7398beac00a035da734ccbfd77b0ee1b0000dfa100def5ca777ccbfd77c0ee1b000000d3730000d373000000001cee1b00f0000000f000d373000000002cee1b0053000000c0ef1b00000000000100000090ee1b006cf6ca7700000000000000007cee1b00 (UID: 00000000-00004668) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000000000000000000000000000000000000000000060f015000000000070f0150000000000010000000000000000000000000000000200000000000000000000000000000000004100000000000010000000000000bcf415000000000070f115000000000053d898770000000058000000 (UID: 00000000-00001036) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000008f810f4fe0700000000000000000000d213d0fffe070000020000000000000000010000000000000000000000000000000000000000000001000000000000009f1410f4fe070000000000000000000008f810f4fe0700000000000000000000000000000000000001000000 (UID: 00000000-00001036) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100f2fe0700000000000000000000d07265f2fe0700002d2d63f2fe070000582c66f2fe07000010ba3c000000000020ba3c000000000000000000000000000100000000000000478ed0fffe0700000000000000000000e87265f2fe0700000000000000000000000000000000000001000000 (UID: 00000000-00001036) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100f1fe070000000000000000000098e6eff1fe0700007914eef1fe070000d086f0f1fe07000020bb3c000000000040bb3c000000000000000000000000000100000000000000478ed0fffe0700000000000000000000b0e6eff1fe0700000100000000000000a3a17dfdfe07000001000000 (UID: 00000000-00001036) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000b02d5ef3fe0700000000000000000000d213d0fffe070000020000000000000000010000000000000000000000000000000000000000000001000000000000006f1b5df3fe0700000000000000000000b02d5ef3fe0700000000000000000000000000000000000001000000 (UID: 00000000-00001036) "WScript.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000a0bae5030000000000c0fdffff070000000086fffe070000501a210000000000000000000000000002000000000000000000000000000000d41086fffe07000000e0faffff07000000c0fdffff070000a0bae50300000000240000000000000089ce7cfdfe07000000e0faff (UID: 00000000-00001036) "WScript.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001036) "IsInherited.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000b0f2710024f56a00e733cb771634cb77f0f56a000100000094016f0001000000a4f46a00b416cc77c020d8779a16cc77e2ebf177f0f56a00010000000100000038cb71000000000074f46a00a4f46a0010f56a004558cf7796a45100feffffff9a16cc77a51979770000087600000000 (UID: 00000000-00005060) "IsInherited.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000a00073000e000000000000000000000022000000a0007300400000002400000001000000000000000000000038d071000700000000000000000000002200000038d071003900000024000000020000000000000000000000020a73000400000000000000000000002200000000000000 (UID: 00000000-00005060)2f:Tac5,"powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPNAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")30:T8c4,"powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")31:T55e,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55"; Key: "BLOB")32:Tc434,"Invoicedetails.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter clrjit.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\ieframe.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00001268) "Invoicedetails.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pb378ec07#\731848746c032af3ce33577b793c9b9c\Microsoft.PowerShell.ConsoleH (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\a68aa6199c81feadf8c95a4ea0254b2c\System.Management.Automation. (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automatio (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter MSISIP.DLL (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\syswow64\CRYPT32.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\wshext.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\df2dd09ed7c341842a104e1e668f184e\System.Data.ni.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Dired13b18a9#\2e76676fbd265f70be92c82bbf76b8e5\System.DirectoryServices.ni.d (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f792626#\fbf36f7901fec6a367af3bc05a96b929\Microsoft.PowerShell.Security (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e3134541fd9904dc895922f5256ef8f3\Microsoft.Management.Infrastr (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Numerics\e7d6ed984300c7212c6e682c4f730b1e\System.Numerics.ni.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\f73f48afb5512225dedaee9c88ac5050\Microsoft.CSharp.ni.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pae3498d9#\ade0afceac1317e3668a9c8086d8d18b\Microsoft.PowerShell.Commands (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Confe64a9051#\1561b93d6d25c4a9c3e2659ab29a5e73\System.Configuration.Install. (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.M870d558a#\7ceb6b903321c16b12386a8df1be50f9\Microsoft.Management.Infrastr (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\bcryptprimitives.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.DLL (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003352) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003352) "InstallUtil.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter RASMAN.DLL (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter rtutils.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\bcryptprimitives.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00004668) "InstallUtil.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004668) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001036) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001036) "WScript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001036) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001036) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001036) "WScript.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00001036) "WScript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001036) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WScript.exe (UID: 00000000-00001036) "WScript.exe" called "LoadLibrary" with a parameter SXS.DLL (UID: 00000000-00001036) "WScript.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00001036) "WScript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001036) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00001036) "WScript.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00001036) "WScript.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00001036) "WScript.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001036) "WScript.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001036) "WScript.exe" called "LoadLibrary" with a parameter MSISIP.DLL (UID: 00000000-00001036) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00001036) "WScript.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00001036) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wshext.dll (UID: 00000000-00001036) "WScript.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001036) "WScript.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001036) "WScript.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00001036) "WScript.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001036) "WScript.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00001036) "WScript.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00001036) "WScript.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001036) "WScript.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00001036) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00001036) "WScript.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00001036) "WScript.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00001036) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00001036) "IsInherited.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter clrjit.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00005060) "IsInherited.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00005060) "InstallUtil.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter RASMAN.DLL (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter rtutils.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\bcryptprimitives.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00002888) "InstallUtil.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00002888)33:Tc5f,Found reference to API (Indicator: "LoadResource"; File: "00000000-00001268.00000001.260621.01342000.00000020.mdmp") Found reference to API (Indicator: "GetObject"; File: "00000000-00001268.00000001.260621.01342000.00000020.mdmp") Found reference to API (Indicator: "GetTempPath"; File: "00000000-00001268.00000001.260621.01342000.00000020.mdmp") Found reference to API (Indicator: "GetKeyboardState"; File: "00002888.00000B48.15287315.00092000.wprm") Found reference to API (Indicator: "CompareString"; File: "00002888.00000B48.15287315.00092000.wprm") Found reference to API (Indicator: "GlobalLock"; File: "00002888.00000B48.15287315.00092000.wprm") Found reference to API (Indicator: "GlobalUnlock"; File: "00002888.00000B48.15287315.00092000.wprm") Found reference to API (Indicator: "Sleep"; File: "00002888.00000B48.15287315.00092000.wprm") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; File: "00002888.00000B48.15287315.00092000.wprm") Found reference to API (Indicator: "GetParent"; File: "00002888.00000B48.15287315.00092000.wprm") Found reference to API (Indicator: "BCryptDecrypt"; File: "00002888.00000B48.15287315.00092000.wprm") Found reference to API (Indicator: "BCryptEncrypt"; File: "00002888.00000B48.15287315.00092000.wprm") Found reference to API (Indicator: "GetKeyboardLayout"; File: "00002888.00000B48.15287315.00092000.wprm") Found reference to API (Indicator: "GetWindowText"; File: "00002888.00000B48.15287315.00092000.wprm") Found reference to API (Indicator: "GetForegroundWindow"; File: "00002888.00000B48.15287315.00092000.wprm") Found reference to API (Indicator: "ToUnicodeEx"; File: "00002888.00000B48.15287315.00092000.wprm") Found reference to API (Indicator: "UnhookWindowsHookEx"; File: "00002888.00000B48.15287315.00092000.wprm") Found reference to API (Indicator: "CallNextHookEx"; File: "00002888.00000B48.15287315.00092000.wprm") Found reference to API (Indicator: "MapVirtualKey"; File: "00002888.00000B48.15287315.00092000.wprm") Found reference to API (Indicator: "BCryptImportKey"; File: "00002888.00000B48.15287315.00092000.wprm") Found reference to API (Indicator: "BCryptDestroyKey"; File: "00002888.00000B48.15287315.00092000.wprm") Found reference to API (Indicator: "BCryptSetProperty"; File: "00002888.00000B48.15287315.00092000.wprm") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00001268.00000001.260621.00A90000.00000004.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00001268.00000001.260621.01342000.00000020.mdmp, 00000000-00001268.00000001.260621.05200000.00000004.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00001268.00000001.260621.01342000.00000020.mdmp, 00000000-00001268.00000001.260621.05200000.00000004.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00001268.00000001.260621.01342000.00000020.mdmp, 00000000-00001268.00000001.260621.05200000.00000004.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00005060.00000001.283526.006F0000.00000004.mdmp, 00000000-00005060.00000001.283526.05180000.00000004.mdmp")34:T6fb,""%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\IsInherited.vbs"" (Indicator: ""%appdata%\microsoft\windows\start menu\programs\startup\isinherited.vbs"") in Source: WScript.exe ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001268.00000001.260621.00A90000.00000004.mdmp 00000000-00001268.00000001.260621.05200000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001268.00000001.260621.00A90000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001268.00000001.260621.01110000.00000002.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001268.00000001.260621.01110000.00000002.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001268.00000001.260621.05200000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\") in Source: 00000000-00005060.00000000.282828.006F0000.00000004.mdmp 00000000-00005060.00000001.283526.006F0000.00000004.mdmp35:T413,"o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001268.00000001.260621.00A90000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001268.00000001.260621.00A90000.00000004.mdmp "REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00001268.00000001.260621.00A90000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001268.00000001.260621.05200000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005060.00000001.283526.006F0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005060.00000001.283526.006F0000.00000004.mdmp36:T278e,"Invoicedetails.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:ffffffffc0000135] "Invoicedetails.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:ffffffffc0000135] "Invoicedetails.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:ffffffffc0000135] "Invoicedetails.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "Invoicedetails.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "Invoicedetails.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:ffffffffc0000135] "Invoicedetails.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:ffffffffc0000135] "Invoicedetails.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:ffffffffc0000135] "Invoicedetails.exe" failed to load missing module "amsi.dll" - [base:0; Status:ffffffffc0000135] "Invoicedetails.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:ffffffffc0000135] "Invoicedetails.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:ffffffffc0000135] "Invoicedetails.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "amsi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:ffffffffc0000135] "InstallUtil.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:ffffffffc0000135] "InstallUtil.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:ffffffffc0000135] "InstallUtil.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:ffffffffc0000135] "InstallUtil.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "InstallUtil.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "InstallUtil.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:ffffffffc0000135] "InstallUtil.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:ffffffffc0000135] "InstallUtil.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:ffffffffc0000135] "InstallUtil.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:ffffffffc0000135] "InstallUtil.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:ffffffffc0000135] "InstallUtil.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:ffffffffc0000135] "InstallUtil.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:ffffffffc0000135] "InstallUtil.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:ffffffffc0000135] "InstallUtil.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:ffffffffc0000135] "InstallUtil.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:ffffffffc0000135] "InstallUtil.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:ffffffffc0000135] "InstallUtil.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:ffffffffc0000135] "InstallUtil.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:ffffffffc0000135] "InstallUtil.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:ffffffffc0000135] "InstallUtil.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:ffffffffc0000135] "InstallUtil.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:ffffffffc0000135] "InstallUtil.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:ffffffffc0000135] "WScript.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:ffffffffc0000135] "WScript.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:ffffffffc0000135] "IsInherited.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:ffffffffc0000135] "IsInherited.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:ffffffffc0000135] "IsInherited.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:ffffffffc0000135] "IsInherited.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "IsInherited.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "IsInherited.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:ffffffffc0000135] "IsInherited.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:ffffffffc0000135] "IsInherited.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:ffffffffc0000135] "IsInherited.exe" failed to load missing module "amsi.dll" - [base:0; Status:ffffffffc0000135] "IsInherited.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:ffffffffc0000135] "IsInherited.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:ffffffffc0000135]37:T1b6f,"// Backbone.js 0.5.3// (c) 2010 Jeremy Ashkenas, DocumentCloud Inc.// Backbone may be freely distributed under the MIT license.// For all details and documentation:// http://documentcloud.github.com/backbone(function(){var h=this,p=h.Backbone,e;e=typeof exports!=="undefined"?exports:h.Backbone={};e.VERSION="0.5.3";var f=h._;if(!f&&typeof require!=="undefined")f=require("underscore")._;var g=h.jQuery||h.Zepto;e.noConflict=function(){h.Backbone=p;return this};e.emulateHTTP=!1;e.emulateJSON=!1;e.Events={bind:function(a,b,c){var d=this._callbacks||(this._callbacks={});(d[a]||(d[a]=[])).push([b,c]);return this},unbind:function(a,b){var c;if(a){if(c=this._callbacks)if(b){c=c[a];if(!c)return this;for(var d=0,e=c.length;d HTTP/1.1 200 OK Date: Thu 08 May 2025 12:56:08 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache with response body ==>33633A36383A37343A36643A36633A33653A33633A36383A36353A36313A36343A33653A33633A37343A36393A37343A36633A36353A33653A34333A37353A37....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Thu 08 May 2025 12:56:08 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache with response body ==>33633A36383A37343A36643A36633A33653A33633A36383A36353A36313A36343A33653A33633A37343A36393A37343A36633A36353A33653A34333A37353A37....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Thu 08 May 2025 13:01:59 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache with response body ==>33633A36383A37343A36643A36633A33653A33633A36383A36353A36313A36343A33653A33633A37343A36393A37343A36633A36353A33653A34333A37353A37....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Thu 08 May 2025 13:01:59 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache with response body ==>33633A36383A37343A36643A36633A33653A33633A36383A36353A36313A36343A33653A33633A37343A36393A37343A36633A36353A33653A34333A37353A37.......39:T853c,"Invoicedetails.exe" loaded module "GDI32.DLL" at base 75920000 "Invoicedetails.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 75fc0000 "Invoicedetails.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75160000 "Invoicedetails.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "Invoicedetails.exe" loaded module "KERNEL32" at base 76340000 "Invoicedetails.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "Invoicedetails.exe" loaded module "ADVAPI32.DLL" at base 76760000 "Invoicedetails.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 727f0000 "Invoicedetails.exe" loaded module "SHLWAPI.DLL" at base 76020000 "Invoicedetails.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "Invoicedetails.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "Invoicedetails.exe" loaded module "VERSION.DLL" at base 75240000 "Invoicedetails.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72040000 "Invoicedetails.exe" loaded module "USER32.DLL" at base 75810000 "Invoicedetails.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "Invoicedetails.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "Invoicedetails.exe" loaded module "MSCOREE.DLL" at base 73a30000 "Invoicedetails.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "Invoicedetails.exe" loaded module "PSAPI.DLL" at base 75b80000 "Invoicedetails.exe" loaded module "RPCRT4.DLL" at base 76450000 "Invoicedetails.exe" loaded module "KERNEL32.DLL" at base 76340000 "Invoicedetails.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70b80000 "Invoicedetails.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "Invoicedetails.exe" loaded module "OLE32.DLL" at base 76980000 "Invoicedetails.exe" loaded module "CRYPTBASE.DLL" at base 75510000 "Invoicedetails.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 70b70000 "Invoicedetails.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 70ae0000 "Invoicedetails.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 70080000 "Invoicedetails.exe" loaded module "AMSI.DLL" at base 0 "Invoicedetails.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 70060000 "Invoicedetails.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "Invoicedetails.exe" loaded module "CLRJIT.DLL" at base 70ae0000 "Invoicedetails.exe" loaded module "SHELL32.DLL" at base 76af0000 "Invoicedetails.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75cf0000 "Invoicedetails.exe" loaded module "PROFAPI.DLL" at base 76ae0000 "Invoicedetails.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "Invoicedetails.exe" loaded module "BCRYPT.DLL" at base 70040000 "Invoicedetails.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6f820000 "Invoicedetails.exe" loaded module "ADVAPI32" at base 76760000 "Invoicedetails.exe" loaded module "CRYPTSP.DLL" at base 6f800000 "Invoicedetails.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 6f7c0000 "Invoicedetails.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6f040000 "Invoicedetails.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74a00000 "Invoicedetails.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "Invoicedetails.exe" loaded module "PROPSYS.DLL" at base 73dc0000 "Invoicedetails.exe" loaded module "COMCTL32.DLL" at base 74a80000 "Invoicedetails.exe" loaded module "OLEAUT32.DLL" at base 768d0000 "Invoicedetails.exe" loaded module "APPHELP.DLL" at base 75330000 "Invoicedetails.exe" loaded module "CLBCATQ.DLL" at base 777f0000 "Invoicedetails.exe" loaded module "%WINDIR%\SYSWOW64\IEFRAME.DLL" at base 6e320000 "Invoicedetails.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76340000 "Invoicedetails.exe" loaded module "SETUPAPI.DLL" at base 76120000 "Invoicedetails.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73dc0000 "Invoicedetails.exe" loaded module "NTMARTA.DLL" at base 73a80000 "Invoicedetails.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 76550000 "Invoicedetails.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 765c0000 "Invoicedetails.exe" loaded module "SECUR32.DLL" at base 6e300000 "Invoicedetails.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75910000 "Invoicedetails.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75330000 "Invoicedetails.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 6ee70000 "Invoicedetails.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 6b9a0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75160000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "powershell.exe" loaded module "KERNEL32" at base 76340000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72040000 "powershell.exe" loaded module "USER32.DLL" at base 75810000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 73a30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "powershell.exe" loaded module "PSAPI.DLL" at base 75b80000 "powershell.exe" loaded module "RPCRT4.DLL" at base 76450000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 73a30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70b80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 76980000 "powershell.exe" loaded module "CRYPTBASE.DLL" at base 75510000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 768d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 70080000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6f820000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.PB378EC07#\731848746C032AF3CE33577B793C9B9C\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 6ede0000 "powershell.exe" loaded module "CRYPTSP.DLL" at base 6f800000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 6f7c0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 76760000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAA57FC8CC#\A68AA6199C81FEADF8C95A4EA0254B2C\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 6c810000 "powershell.exe" loaded module "NTDLL.DLL" at base 77c80000 "powershell.exe" loaded module "KERNEL32.DLL" at base 76340000 "powershell.exe" loaded module "VERSION.DLL" at base 75240000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 70060000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 76af0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 757e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "AMSI.DLL" at base 0 "powershell.exe" loaded module "MSISIP.DLL" at base 6edd0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\CRYPT32.DLL" at base 759b0000 "powershell.exe" loaded module "IMM32.DLL" at base 75fc0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 6edb0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 6eda0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DATA\DF2DD09ED7C341842A104E1E668F184E\SYSTEM.DATA.NI.DLL" at base 6e580000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6b640000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6f040000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 6e450000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DIRED13B18A9#\2E76676FBD265F70BE92C82BBF76B8E5\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 6e320000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 70b70000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 70ae0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.P6F792626#\FBF36F7901FEC6A367AF3BC05A96B929\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 6b5e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E3134541FD9904DC895922F5256EF8F3\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 6b560000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.NUMERICS\E7D6ED984300C7212C6E682C4F730B1E\SYSTEM.NUMERICS.NI.DLL" at base 6b510000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 6b450000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6b400000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6b2f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 6e300000 "powershell.exe" loaded module "SSPICLI.DLL" at base 75520000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "SHLWAPI.DLL" at base 76020000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.CSHARP\F73F48AFB5512225DEDAEE9C88AC5050\MICROSOFT.CSHARP.NI.DLL" at base 6b150000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74a00000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75cf0000 "powershell.exe" loaded module "RPCRTREMOTE.DLL" at base 6e310000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.PAE3498D9#\ADE0AFCEAC1317E3668A9C8086D8D18B\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 6af70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFE64A9051#\1561B93D6D25C4A9C3E2659AB29A5E73\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 6af40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.M870D558A#\7CEB6B903321C16B12386A8DF1BE50F9\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 6aeb0000 "powershell.exe" loaded module "NCRYPT.DLL" at base 6efe0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\BCRYPTPRIMITIVES.DLL" at base 6ef80000 "powershell.exe" loaded module "USERENV.DLL" at base 75580000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75cf0000 "powershell.exe" loaded module "GPAPI.DLL" at base 70040000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 75cf0000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 75cf0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 6ef60000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 6ef60000 "powershell.exe" loaded module "SENSAPI.DLL" at base 6ef50000 "powershell.exe" loaded module "WINHTTP.DLL" at base 744b0000 "powershell.exe" loaded module "WS2_32.DLL" at base 77740000 "powershell.exe" loaded module "CREDSSP.DLL" at base 6ef40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73ac0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 73ab0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 6ef30000 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 74ca0000 "powershell.exe" loaded module "DHCPCSVC6.DLL" at base 73b20000 "powershell.exe" loaded module "DHCPCSVC.DLL" at base 73b00000 "powershell.exe" loaded module "NSI.DLL" at base 75ae0000 "powershell.exe" loaded module "CFGMGR32.DLL" at base 75b00000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 75cf0000 "powershell.exe" loaded module "PROFAPI.DLL" at base 76ae0000 "powershell.exe" loaded module "DNSAPI.DLL" at base 74d60000 "powershell.exe" loaded module "RASADHLP.DLL" at base 6ef20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 6c430000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "CRYPT32.DLL" at base 759b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\URLMON.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 76550000 "powershell.exe" loaded module "URLMON.DLL" at base 765c0000 "powershell.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75910000 "powershell.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 6c400000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 6c2f0000 "powershell.exe" loaded module "GDI32.DLL" at base 75920000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 6efc0000 "InstallUtil.exe" loaded module "GDI32.DLL" at base 75920000 "InstallUtil.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 75fc0000 "InstallUtil.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75160000 "InstallUtil.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "InstallUtil.exe" loaded module "KERNEL32" at base 76340000 "InstallUtil.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "InstallUtil.exe" loaded module "ADVAPI32.DLL" at base 76760000 "InstallUtil.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 727f0000 "InstallUtil.exe" loaded module "SHLWAPI.DLL" at base 76020000 "InstallUtil.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "InstallUtil.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "InstallUtil.exe" loaded module "VERSION.DLL" at base 75240000 "InstallUtil.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72040000 "InstallUtil.exe" loaded module "USER32.DLL" at base 75810000 "InstallUtil.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "InstallUtil.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "InstallUtil.exe" loaded module "MSCOREE.DLL" at base 73a30000 "InstallUtil.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "InstallUtil.exe" loaded module "PSAPI.DLL" at base 75b80000 "InstallUtil.exe" loaded module "RPCRT4.DLL" at base 76450000 "InstallUtil.exe" loaded module "KERNEL32.DLL" at base 76340000 "InstallUtil.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70b80000 "InstallUtil.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "InstallUtil.exe" loaded module "OLE32.DLL" at base 76980000 "InstallUtil.exe" loaded module "CRYPTBASE.DLL" at base 75510000 "InstallUtil.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74a00000 "InstallUtil.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 70b70000 "InstallUtil.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 70ae0000 "InstallUtil.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 70080000 "InstallUtil.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 6c660000 "InstallUtil.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 6a020000 "InstallUtil.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6f820000 "InstallUtil.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 6c470000 "InstallUtil.exe" loaded module "NTDLL.DLL" at base 77c80000 "InstallUtil.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 70060000 "InstallUtil.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "InstallUtil.exe" loaded module "SHELL32.DLL" at base 76af0000 "InstallUtil.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6b2f0000 "InstallUtil.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6f040000 "InstallUtil.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75cf0000 "InstallUtil.exe" loaded module "PROFAPI.DLL" at base 76ae0000 "InstallUtil.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "InstallUtil.exe" loaded module "BCRYPT.DLL" at base 6efc0000 "InstallUtil.exe" loaded module "CRYPTSP.DLL" at base 6f800000 "InstallUtil.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 6f7c0000 "InstallUtil.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "InstallUtil.exe" loaded module "RASAPI32.DLL" at base 6eec0000 "InstallUtil.exe" loaded module "RTUTILS.DLL" at base 6ee90000 "InstallUtil.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 75cf0000 "InstallUtil.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 75cf0000 "InstallUtil.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "InstallUtil.exe" loaded module "WS2_32.DLL" at base 77740000 "InstallUtil.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73ac0000 "InstallUtil.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 73ab0000 "InstallUtil.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 6ef30000 "InstallUtil.exe" loaded module "RASMAN.DLL" at base 6eea0000 "InstallUtil.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "InstallUtil.exe" loaded module "WINHTTP.DLL" at base 744b0000 "InstallUtil.exe" loaded module "SSPICLI.DLL" at base 75520000 "InstallUtil.exe" loaded module "CREDSSP.DLL" at base 6ef40000 "InstallUtil.exe" loaded module "IPHLPAPI.DLL" at base 74ca0000 "InstallUtil.exe" loaded module "DHCPCSVC6.DLL" at base 73b20000 "InstallUtil.exe" loaded module "DHCPCSVC.DLL" at base 73b00000 "InstallUtil.exe" loaded module "NSI.DLL" at base 75ae0000 "InstallUtil.exe" loaded module "CFGMGR32.DLL" at base 75b00000 "InstallUtil.exe" loaded module "OLEAUT32.DLL" at base 768d0000 "InstallUtil.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "InstallUtil.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "InstallUtil.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75cf0000 "InstallUtil.exe" loaded module "RPCRTREMOTE.DLL" at base 70050000 "InstallUtil.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 75cf0000 "InstallUtil.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "InstallUtil.exe" loaded module "DNSAPI.DLL" at base 74d60000 "InstallUtil.exe" loaded module "RASADHLP.DLL" at base 70040000 "InstallUtil.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 6f000000 "InstallUtil.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "InstallUtil.exe" loaded module "SECUR32.DLL" at base 6eff0000 "InstallUtil.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 6ef70000 "InstallUtil.exe" loaded module "NCRYPT.DLL" at base 6ee50000 "InstallUtil.exe" loaded module "%WINDIR%\SYSWOW64\BCRYPTPRIMITIVES.DLL" at base 6ee10000 "InstallUtil.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "InstallUtil.exe" loaded module "CRYPT32.DLL" at base 759b0000 "InstallUtil.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "InstallUtil.exe" loaded module "USERENV.DLL" at base 75580000 "InstallUtil.exe" loaded module "GPAPI.DLL" at base 6ef50000 "InstallUtil.exe" loaded module "OLEAUT32" at base 768d0000 "InstallUtil.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "InstallUtil.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "InstallUtil.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "InstallUtil.exe" loaded module "IMM32.DLL" at base 75fc0000 "InstallUtil.exe" loaded module "COMCTL32.DLL" at base 73d30000 "WScript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fef9320000 "WScript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "WScript.exe" loaded module "KERNEL32" at base 77980000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fefbd40000 "WScript.exe" loaded module "RPCRT4.DLL" at base 7fefeff0000 "WScript.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 7feffc70000 "WScript.exe" loaded module "ADVAPI32.DLL" at base 7feff3e0000 "WScript.exe" loaded module "KERNEL32.DLL" at base 77980000 "WScript.exe" loaded module "SXS.DLL" at base 7fefd600000 "WScript.exe" loaded module "DWMAPI.DLL" at base 7fefb5c0000 "WScript.exe" loaded module "CLBCATQ.DLL" at base 7feff7b0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VBSCRIPT.DLL" at base 7fef3600000 "WScript.exe" loaded module "OLE32.DLL" at base 7fefdbd0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7feff3e0000 "WScript.exe" loaded module "WINTRUST.DLL" at base 7fefd8a0000 "WScript.exe" loaded module "CRYPTSP.DLL" at base 7fefcf80000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7fefcc80000 "WScript.exe" loaded module "CRYPTBASE.DLL" at base 7fefd5f0000 "WScript.exe" loaded module "MSISIP.DLL" at base 7fef5670000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7fefd980000 "WScript.exe" loaded module "IMM32.DLL" at base 7feffab0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7fef4100000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 7fef2630000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 7fef35d0000 "WScript.exe" loaded module "SHELL32.DLL" at base 7fefe150000 "WScript.exe" loaded module "PROPSYS.DLL" at base 7fefbf20000 "WScript.exe" loaded module "COMCTL32.DLL" at base 7fefc150000 "WScript.exe" loaded module "OLEAUT32.DLL" at base 7feff120000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7fefbf20000 "WScript.exe" loaded module "NTMARTA.DLL" at base 7fefc840000 "WScript.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 7feffc70000 "WScript.exe" loaded module "PROFAPI.DLL" at base 7fefd790000 "WScript.exe" loaded module "APPHELP.DLL" at base 7fefd590000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 7fef69e0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 7fefe150000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77980000 "WScript.exe" loaded module "SETUPAPI.DLL" at base 7feff200000 "WScript.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 7fefd840000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7feffae0000 "WScript.exe" loaded module "SECUR32.DLL" at base 7fefd390000 "WScript.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 7fefd860000 "WScript.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 7fef8ef0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7fefd590000 "IsInherited.exe" loaded module "GDI32.DLL" at base 75920000 "IsInherited.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 75fc0000 "IsInherited.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75160000 "IsInherited.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "IsInherited.exe" loaded module "KERNEL32" at base 76340000 "IsInherited.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "IsInherited.exe" loaded module "SHLWAPI.DLL" at base 76020000 "IsInherited.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "IsInherited.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "IsInherited.exe" loaded module "VERSION.DLL" at base 75240000 "IsInherited.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 71fb0000 "IsInherited.exe" loaded module "USER32.DLL" at base 75810000 "IsInherited.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "IsInherited.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "IsInherited.exe" loaded module "MSCOREE.DLL" at base 739e0000 "IsInherited.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "IsInherited.exe" loaded module "RPCRT4.DLL" at base 76450000 "IsInherited.exe" loaded module "KERNEL32.DLL" at base 76340000 "IsInherited.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70af0000 "IsInherited.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "IsInherited.exe" loaded module "OLE32.DLL" at base 76980000 "IsInherited.exe" loaded module "CRYPTBASE.DLL" at base 75510000 "IsInherited.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 739d0000 "IsInherited.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 70a60000 "IsInherited.exe" loaded module "ADVAPI32.DLL" at base 76760000 "IsInherited.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 70000000 "IsInherited.exe" loaded module "AMSI.DLL" at base 0 "IsInherited.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 73920000 "IsInherited.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "IsInherited.exe" loaded module "PSAPI.DLL" at base 75b80000 "IsInherited.exe" loaded module "CLRJIT.DLL" at base 70a60000 "IsInherited.exe" loaded module "SHELL32.DLL" at base 76af0000 "IsInherited.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75cf0000 "IsInherited.exe" loaded module "PROFAPI.DLL" at base 76ae0000 "IsInherited.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "IsInherited.exe" loaded module "BCRYPT.DLL" at base 6efc0000 "IsInherited.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6e5f0000 "IsInherited.exe" loaded module "ADVAPI32" at base 76760000 "IsInherited.exe" loaded module "CRYPTSP.DLL" at base 6f800000 "IsInherited.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 6f7c0000 "IsInherited.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6f880000 "IsInherited.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 6f610000 "IsInherited.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 6d780000 "IsInherited.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75330000 "InstallUtil.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 71800000 "InstallUtil.exe" loaded module "MSCOREE.DLL" at base 739e0000 "InstallUtil.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 703f0000 "InstallUtil.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 72810000 "InstallUtil.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 72620000 "InstallUtil.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6f990000 "InstallUtil.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 72470000 "InstallUtil.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 6dfa0000 "InstallUtil.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6d780000 "InstallUtil.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 72280000 "InstallUtil.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 727f0000 "InstallUtil.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 72170000 "InstallUtil.exe" loaded module "RASAPI32.DLL" at base 72110000 "InstallUtil.exe" loaded module "RTUTILS.DLL" at base 739d0000 "InstallUtil.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 720e0000 "InstallUtil.exe" loaded module "RASMAN.DLL" at base 720f0000 "InstallUtil.exe" loaded module "CREDSSP.DLL" at base 720d0000 "InstallUtil.exe" loaded module "RPCRTREMOTE.DLL" at base 720c0000 "InstallUtil.exe" loaded module "RASADHLP.DLL" at base 720b0000 "InstallUtil.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72070000 "InstallUtil.exe" loaded module "SECUR32.DLL" at base 73a40000 "InstallUtil.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 72020000 "InstallUtil.exe" loaded module "NCRYPT.DLL" at base 71fe0000 "InstallUtil.exe" loaded module "GPAPI.DLL" at base 71fc00003a:T4c3,"15001600c03ea1736cf15f05385b9f73@ADVAPI32.dll" "0e000f00703fa1736cf15f05385b9f73@ADVAPI32.dll" "0e000f00cc3fa1736cf15f05385b9f73@ADVAPI32.dll" "11001200b447a1736cf15f05385b9f73@ADVAPI32.dll" "110012004848a1736cf15f05385b9f73@ADVAPI32.dll" "120013008c48a1736cf15f05385b9f73@ADVAPI32.dll" "12001300e448a1736cf15f05385b9f73@ADVAPI32.dll" "14001500dc6fa1736cf15f05385b9f73@ADVAPI32.dll" "14001500f46fa1736cf15f05385b9f73@ADVAPI32.dll" "140015000c70a1736cf15f05385b9f73@ADVAPI32.dll" "170018002470a1736cf15f05385b9f73@ADVAPI32.dll" "0d000e003c70a1736cf15f05385b9f73@ADVAPI32.dll" "110012004c70a1736cf15f05385b9f73@ADVAPI32.dll" "110012006070a1736cf15f05385b9f73@ADVAPI32.dll" "0d000e003449a1736cf15f05385b9f73@shell32.dll" "0d000e00b049a1736cf15f05385b9f73@shell32.dll" "0f001000a071a1736cf15f05385b9f73@ADVAPI32.dll" "14001500e071a1736cf15f05385b9f73@ADVAPI32.dll" "14001500f871a1736cf15f05385b9f73@ADVAPI32.dll" "0c000d004072a1736cf15f05385b9f73@ADVAPI32.dll" "0c000d005072a1736cf15f05385b9f73@ADVAPI32.dll" "0e000f006072a1736cf15f05385b9f73@ADVAPI32.dll" "0e000f007072a1736cf15f05385b9f73@ADVAPI32.dll" "0b000c008072a1736cf15f05385b9f73@ADVAPI32.dll" "0d000e000873a1736cf15f05385b9f73@bcrypt.dll"3b:Tb66,"Invoicedetails.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "Invoicedetails.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "Invoicedetails.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "Invoicedetails.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "Invoicedetails.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "Invoicedetails.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "Invoicedetails.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "Invoicedetails.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "Invoicedetails.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "Invoicedetails.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "Invoicedetails.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "Invoicedetails.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "Invoicedetails.exe" touched "Other Users Folder" (Path: "HKCU\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "Invoicedetails.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "Invoicedetails.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "Invoicedetails.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "Invoicedetails.exe" touched "Games Explorer" (Path: "HKCU\WOW6432NODE\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "Invoicedetails.exe" touched "Computers and Devices" (Path: "HKCU\WOW6432NODE\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "Invoicedetails.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "Invoicedetails.exe" touched "Security Manager" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\WOW6432NODE\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32")3c:T91e,"Invoice details.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "IsInherited.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"3d:T5f3,Process "powershell.exe" (UID: 00000000-00003352) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC", PROCESSOR_ARCHITEW6432="AMD64"" Process "powershell.exe" (UID: 00000000-00003352) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles, NUMBER_OF_PROCESSORS" Process "InstallUtil.exe" (UID: 00000000-00004668) was launched with modified environment variables: "Path" Process "WScript.exe" (UID: 00000000-00001036) was launched with new environment variables: "PROMPT="$P$G"" Process "WScript.exe" (UID: 00000000-00001036) was launched with modified environment variables: "PSModulePath, PATHEXT, NUMBER_OF_PROCESSORS" Process "WScript.exe" (UID: 00000000-00001036) was launched with missing environment variables: "USERDNSDOMAIN" Process "IsInherited.exe" (UID: 00000000-00005060) was launched with new environment variables: "USERDNSDOMAIN="AsFWUvh2uM"" Process "IsInherited.exe" (UID: 00000000-00005060) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "IsInherited.exe" (UID: 00000000-00005060) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "InstallUtil.exe" (UID: 00000000-00002888) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "InstallUtil.exe" (UID: 00000000-00002888) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles"3e:T7f5,"Invoicedetails.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Invoicedetails.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Invoicedetails.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Invoicedetails.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "Invoicedetails.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "Invoicedetails.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR-SA") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR-SA") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG-BG") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG-BG") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA-ES") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA-ES")3f:Tf51,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00001268-00000C2C-1707236598] Observed system executable string:"%WINDIR%\system32\IMM32.DLL" [Source: 00000000-00001268-00000C61-3054538815] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00001268-00000C29-3055690557] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00001268-00000C29-3056556588] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00001268-00000C29-3056663978] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00001268-00000C29-3057069590] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00001268-00000C29-3058072816] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00001268-00000C29-3058282687] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00001268-00000C29-3059007516] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00001268-00000C29-3059060467] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00001268-00000C29-3059139657] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00001268-00000C29-3059230998] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00001268-00000C29-3059354563] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00001268-00000C29-3059506853] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00001268-00000C29-3061177870] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00001268-00000C29-3061441285] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00001268-00000C29-3062651358] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00001268-00000C29-3065985312] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00001268-00000C29-3066389600] Observed system executable string:"%WINDIR%\SysWOW64\ieframe.dll" [Source: 00000000-00001268-00000C29-3067475121] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00001268-00000C29-3072481224] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00001268-00000C29-3073301123] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00003352-00000C29-3072626367] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00003352-00000C29-3072863425] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00003352-00000C29-3073462249]40:T48e,"IsInherited.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [%APPDATA%\IsInherited.exe]- [targetUID: 00000000-00001268] "IsInherited.vbs.bin" has type "ASCII text with no line terminators"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4761 bytes 1 file at 0x2c last modified Sun Dec 04 2024 10:02:46 +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003352] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003352] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00003352] "IsInherited.vbs" has type "ASCII text with no line terminators"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\IsInherited.vbs]- [targetUID: 00000000-00001268]41:T724,"Invoicedetails.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: ""; Value: "") "Invoicedetails.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: ""; Value: "") "Invoicedetails.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "Invoicedetails.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{E47F4F43-D863-11E7-9D8F-806E6F6E6963}\"; Key: ""; Value: "") "Invoicedetails.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{E47F4F44-D863-11E7-9D8F-806E6F6E6963}\"; Key: ""; Value: "") "Invoicedetails.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "") "Invoicedetails.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: ""; Value: "") "Invoicedetails.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES"; Key: ""; Value: "") "Invoicedetails.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: ""; Value: "") "Invoicedetails.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\PENDINGDELETE"; Key: ""; Value: "") "Invoicedetails.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "Invoicedetails.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "Invoicedetails.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\SETTINGS\LANGUAGECONFIGURATION"; Key: ""; Value: "")42:Tc6f,"Invoicedetails.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "Invoicedetails.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "Invoicedetails.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{E47F4F43-D863-11E7-9D8F-806E6F6E6963}"; Key: "DATA"; Value: "") "Invoicedetails.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{E47F4F43-D863-11E7-9D8F-806E6F6E6963}"; Key: "GENERATION"; Value: "") "Invoicedetails.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{E47F4F44-D863-11E7-9D8F-806E6F6E6963}"; Key: "DATA"; Value: "") "Invoicedetails.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{E47F4F44-D863-11E7-9D8F-806E6F6E6963}"; Key: "GENERATION"; Value: "") "Invoicedetails.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "Invoicedetails.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "Invoicedetails.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "Invoicedetails.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "Invoicedetails.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "Invoicedetails.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "Invoicedetails.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "Invoicedetails.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "Invoicedetails.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "INVOICEDETAILS"; Value: "") "Invoicedetails.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "Invoicedetails.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "Invoicedetails.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "Invoicedetails.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESMYCOMPUTER"; Value: "") "Invoicedetails.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESRECYCLEBIN"; Value: "")43:T565,"Invoicedetails.exe" trying to touch file "C:\Windows\SYSTEM32\wow64.dll" "Invoicedetails.exe" trying to touch file "C:\Windows\SYSTEM32\wow64win.dll" "Invoicedetails.exe" trying to touch file "C:\Windows\SYSTEM32\wow64cpu.dll" "Invoicedetails.exe" trying to touch file "C:\Windows\system32\wow64log.dll" "Invoicedetails.exe" trying to touch file "C:\Windows\SysWOW64\MSCOREE.DLL" "Invoicedetails.exe" trying to touch file "C:\Windows\SysWOW64\sechost.dll" "Invoicedetails.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "Invoicedetails.exe" trying to touch file "C:\FLTLIB.DLL" "Invoicedetails.exe" trying to touch file "C:\Windows\SysWOW64\FLTLIB.DLL" "Invoicedetails.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.DLL" "Invoicedetails.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-1.DLL" "Invoicedetails.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-1.DLL" "Invoicedetails.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "Invoicedetails.exe" trying to touch file "C:\Windows\SysWOW64\IMM32.DLL" "Invoicedetails.exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" "Invoicedetails.exe" trying to touch file "C:\Windows\SysWOW64\MSCOREE.DLL.local" "Invoicedetails.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll"44:T7c7,"Invoicedetails.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "Invoicedetails.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "Invoicedetails.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "Invoicedetails.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "Invoicedetails.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "Invoicedetails.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "Invoicedetails.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "Invoicedetails.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IsInherited.vbs" "Invoicedetails.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "Invoicedetails.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\IsInherited.vbs" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "powershell.exe" touched file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe.config" "powershell.exe" touched file "C:\Windows\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll.config" "powershell.exe" touched file "C:\Windows\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll.config" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive" "InstallUtil.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll"45:T623,"Invoicedetails.exe" trying to access non-existent file "C:\Windows\system32\wow64log.dll" "Invoicedetails.exe" trying to access non-existent file "C:\FLTLIB.DLL" "Invoicedetails.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-1.DLL" "Invoicedetails.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-1.DLL" "Invoicedetails.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "Invoicedetails.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "Invoicedetails.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "Invoicedetails.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "Invoicedetails.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "Invoicedetails.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-appmodel-runtime-l1-1-2.dll" "Invoicedetails.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-appmodel-runtime-l1-1-0.dll" "Invoicedetails.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "Invoicedetails.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "Invoicedetails.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-quirks-l1-1-0.dll"46:T586,"Invoicedetails.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.local" "Invoicedetails.exe" trying to access non-existent file "C:\Invoicedetails.exe.config" "Invoicedetails.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "Invoicedetails.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\Wnqthydr\" "Invoicedetails.exe" trying to access non-existent file "C:\Invoicedetails.INI" "Invoicedetails.exe" trying to access non-existent file "C:\Invoicedetails.exe.Local\" "Invoicedetails.exe" trying to access non-existent file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe:Zone.Identifier" "Invoicedetails.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "Invoicedetails.exe" trying to access non-existent file "C:\INVOICEDETAILS.EXE.CONFIG" "Invoicedetails.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "Invoicedetails.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\WNQTHYDR" "Invoicedetails.exe" trying to access non-existent file "C:\INVOICEDETAILS.INI" "Invoicedetails.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "Invoicedetails.exe" trying to access non-existent file "C:\INVOICEDETAILS.EXE.LOCAL"47:T60e,Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00003352-00000C2A-3084234616") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00003352-00000C2A-3084461784") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00003352-00000C2A-3084482353") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00003352-00000C2A-3084482353") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00003352-00000C2A-3084482353") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00003352-00000C2A-3086022641") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00003352-00000C2A-3086022641") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00003352-00000C2A-3086620119") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00003352-00000C2A-3086620712") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00003352-00000C2A-3086706893") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00003352-00000C2A-3086713405") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00004668-00000C2A-3086740127") Found reference to API "WinHttpOpenW" (Indicator: "WinHttpOpen"; Source: "00000000-00004668-00000C2A-3087975983")48:T4c4,"16.0.0.0" "2.5.29.37" "2.5.29.35" "2.5.29.1" "2.5.29.31" "1.0.0.0" "11.0.0.0" "17.0.0.0" "0.0.0.00000" Potential IP "4.0.0.0" found in string "n=4.0.0.0, ^" "0.0.0.0" Potential IP "4.0.0.0" found in string "=4.0.0.0, Culture=neut" "2.4.8.1" Potential IP "2.4.8.1" found in string "2.4.8.1+cce1c58590" "2.4.0.0" Potential IP "2.10.1.0" found in string "icrosoft.Win32.TaskScheduler,2.10.1.0,,e25603a88b3aa7da" Potential IP "2.4.0.0" found in string "rotobuf-net,2.4.0.0,,257b51d87d2e4d67" Potential IP "4.0.0.0" found in string "n=4.0.0.0, C" Potential IP "4.0.0.0" found in string "4.0.0.0, Cul" Potential IP "0.0.0.0" found in string "0.0.0.0~" "1.0.0.0000000" Potential IP "4.0.0.0" found in string "=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />", Potential IP "4.0.0.0" found in string "ion=4.0.0.0 Culture=neu", Potential IP "4.0.0.0" found in string "on=4.0.0.0 Culture=neutral P", Potential IP "4.0.0.0" found in string "rsion=4.0.0.0 Culture", Potential IP "4.0.0.0" found in string "4.0.0.0 Culture=neutral Publ]", Potential IP "4.0.0.0" found in string "=4.0.0.0 Culture=neut2", Potential IP "4.0.0.0" found in string "ystem.Windows.Forms 4.0.0.0 b77a5c561934e089"49:Tddd,Heuristic match: "}9a.ae" Heuristic match: ":y.ax" Heuristic match: "{ypki.is" Heuristic match: ":t.mu" Heuristic match: "6m.ye" Pattern match: "http://www.w3.org/tr/xhtml1/dtd/xhtml1-transitional.dtd" Pattern match: "http://theoatmeal.com/" Pattern match: "http://documentcloud.github.com/backbone" Pattern match: "jquery.org/license" Heuristic match: "play=,q.innerhtml=

,b.shrinkwrapblocks=q.offsetwidth!==2),q.style.csstext=k+m,q.innerhtml=o,d=q.firstchild,e=d.firstchild,h=d.nextsibling.firstchild.firstchild,i={doesnotaddborder:e.offsettop!==5,doesaddborderfortableandcel" Pattern match: "http://documentcloud.github.com/underscore" Heuristic match: "var pre = this.pastinput(); var c = new array(pre.length + 1).join(-); return pre + this.upcominginput() + \n + c+^; },next:function () { if (this.done) { return this.eof; } if (!this._input) this.done" Pattern match: "https://github.com/ajaxstack/ajaxstack/blob/master/license*///for" Pattern match: "http://www.w3.org/1999/02/22-rdf-syntax-ns#" Heuristic match: "checkip.dyndns.org" Heuristic match: "get / http/1.1user-agent: mozilla/4.0 (compatible; msie 6.0; windows nt 5.2; .net clr1.0.3705;)host: checkip.dyndns.org" Heuristic match: "reallyfreegeoip.org" Heuristic match: "text/x-script.sh" Heuristic match: "guments)));return object(g)===g?g:b}};b.bindall=function(a){var c=i.call(arguments,1);c.length==0&&(c=b.functions(a));j(c,function(c){a[c]=b.bind(a[c],a)});return a};b.memoize=function(a,c){var d={};c||(c=b.identity);return function(){var b=c.apply(this,ar" Heuristic match: "(function (trace) { var app = diagnostics.app; trace.model = backbone.model.extend({}); trace.collection = backbone.collection.extend({ model: trace.model, initialize: function (opts) { this.id = opts.id; }, " Heuristic match: "ft:880px}.container_16 .push_1{left:60px}.container_16 .push_2{left:120px}.container_16 .push_3{left:180px}.container_16 .push_5{left:300px}.container_16 .push_6{left:360px}.container_16 .push_7{left:420px}.container_16 .push_9{left:540px}.container_16 .pu" Heuristic match: "nancy.io" Heuristic match: "ctldl.windowsupdate.com" Heuristic match: "cloudservices.my" Pattern match: "allyfreegeoip.org/xml/" Pattern match: "https://api.telegram.org/bot" Pattern match: "microsoft.net/framework/v4.0.30319/" Heuristic match: "ications.to" Pattern match: "https://stackoverflow.com/q/2152978/23354" Pattern match: "https://stackoverflow.com/q/11564914/23354" Pattern match: "https://stackoverflow.com/q/14436606/23354" Pattern match: "https://github.com/mgravell/protobuf-net" Heuristic match: "1qdk.qa" Heuristic match: "ext/x-script.sh" Heuristic match: "* created by demis.bellot@gmail.com" Pattern match: "https://github.com/ajaxstack/ajaxstack/blob/master/license" Pattern match: "http://ajax.cdnjs.com/ajax/libs/json2/20110223/json2.js%3e%3c/script%3e" Heuristic match: "omp.com" Heuristic match: "diskcopy.com" Heuristic match: "html.il" Heuristic match: "ivfsrc.ax" Heuristic match: "r41_32.ax" Heuristic match: "kstvtune.ax" Heuristic match: "vbisurf.ax" Heuristic match: "pathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.ws" Heuristic match: "m.web.co" Heuristic match: "onfigurationprovider,system.co" Heuristic match: "ion.pe" Heuristic match: "

Diagnostics is currently disabled. To enable it you need to supply a valid DiagnosticsConfiguration (with a strong password!) by overriding the relevent property in your bootstrapper.

\" (Indicator: \"password\"; Source: \"00000000-00001268.00000001.260621.01342000.00000020.mdmp\")\n Found string \"\" (Indicator: \"password\"; Source: \"00000000-00001268.00000001.260621.01342000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"\"e\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\" in Source: 00002888.00000B48.15287315.00092000.wprm\n \"s\\Outlook\\9375CFF0413111d3B88A00104B2A6676\" in Source: 00002888.00000B48.15287315.00092000.wprm","origin":"File/Memory","mitre_attack_id":"T1114","relevance":1,"id":"string-129","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001268-00000C2A-3056662094\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001268-00000C2A-3059502238\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001268-00000C2A-3059505109\")\n Found string \"OpenProcessW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001268-00000C2A-3059505549\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"Invoicedetails.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui\" (UID: 00000000-00001268), \"Invoicedetails.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\IsInherited.vbs\" (UID: 00000000-00001268)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003352)\n \"InstallUtil.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004668)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"CallNextHook\" (Indicator: \"CallNextHook\"; File: \"00002888.00000B48.15287315.00092000.wprm\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"00002888.00000B48.15287315.00092000.wprm\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"00002888.00000B48.15287315.00092000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00001268.00000001.260621.00A90000.00000004.mdmp\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00005060.00000001.283526.006F0000.00000004.mdmp, 00000000-00005060.00000001.283526.05180000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00004668-00000C2A-3195018064","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"Invoicedetails.exe\" opened \"\\Device\\KsecDD\"\n \"InstallUtil.exe\" opened \"\\Device\\KsecDD\"\n \"IsInherited.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$4d","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"informative","category":"System Security","name":"Uses powershell with a add-mppreference commandline param","description":"Process \"powershell.exe\" with commandline \"-enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAEkAbgB2AG8AaQBjAGUAZABlAHQAYQBpAGwAcwAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwASQBuAHYAbwBpAGMAZQBkAGUAdABhAGkAbABzAC4AZQB4AGUAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwASABBAFAAVQBCAFcAUwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwASQBzAEkAbgBoAGUAcgBpAHQAZQBkAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABIAEEAUABVAEIAVwBTAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABJAHMASQBuAGgAZQByAGkAdABlAGQALgBlAHgAZQA=\" (UID: 00000000-00003352)","origin":"Monitored Target","mitre_attack_id":"T1562","relevance":3,"id":"target-236","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"IsInherited.exe\" - Location: [%APPDATA%\\IsInherited.exe]- [targetUID: 00000000-00001268]\n Dropped file: \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003352]\n Dropped file: \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003352]\n Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00003352]\n Dropped file: \"IsInherited.vbs\" - Location: [%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\IsInherited.vbs]- [targetUID: 00000000-00001268]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"Invoice details.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"IsInherited.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"Invoicedetails.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"Invoicedetails.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"Invoice details.exe\" has section name .text with entropy \"7.382705023556711\"\n \"IsInherited.exe\" has section name .text with entropy \"7.382705023556711\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"powershell.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00003352)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Possible heap spraying attempt detected","description":"\"powershell.exe\" allocated at least 32768.0 KB of consecutive memory with 100 calls\n \"powershell.exe\" allocated at least 32768.0 KB of consecutive memory with 101 calls\n \"powershell.exe\" allocated at least 32768.0 KB of consecutive memory with 102 calls","origin":"API Call","mitre_attack_id":"T1189","relevance":10,"id":"api-88","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"Nancy.ErrorHandling.DefaultStatusCodeHandler::LoadResource(System.String) at b59668a361221e801abb5ed29bbfecaf-600057d-ctor","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"Invoicedetails.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"IsInherited.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 3 sections\"- Location: [%APPDATA%\\IsInherited.exe]- [targetUID: 00000000-00001268]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 193.122.6.168 on port 80 is sent without HTTP header\n TCP traffic to 104.21.64.1 on port 443 is sent without HTTP header\n TCP traffic to 132.226.8.169 on port 80 is sent without HTTP header\n TCP traffic to 104.21.32.1 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"suspicious","category":"Network Related","name":"Uses a browser-related user-agent without launching browser","description":"Found user-agent(s): Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on process \"00000000-00001268\"\n YARA signature for RSA public and private key matched on process \"00000000-00005060\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-62","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"InstallUtil.exe\" had access to \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\" (Type: \"FileHandle\")","origin":"Touched Handle","mitre_attack_id":"T1005","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\3uqwjnuv.hyc.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\yhutosdr.tqn.psm1\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"Invoicedetails.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"Invoicedetails.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"powershell.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"powershell.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Commandline contains long base64 encoded string","description":"Commandline contains long base64 encoded string \"QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAEkAbgB2.......\" in [Source : powershell.exe]","origin":"File/Memory","mitre_attack_id":"T1132","relevance":5,"id":"string-509","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops a file that contains system information","description":"\"IsInherited.vbs.bin\" contains indicator \"HAPUBWS\" (Line: 1; Offset: 46)\n \"IsInherited.vbs\" contains indicator \"HAPUBWS\" (Line: 1; Offset: 46)","origin":"Binary File","mitre_attack_id":"T1005","relevance":3,"id":"binary-58","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)","description":"\"IsInherited.vbs.bin\" contains indicator \"WScript.Shell\" (Line: 1; Offset: 14)\n \"IsInherited.vbs.bin\" contains indicator \".Run\" (Line: 1; Offset: 29)\n \"IsInherited.vbs\" contains indicator \"WScript.Shell\" (Line: 1; Offset: 14)\n \"IsInherited.vbs\" contains indicator \".Run\" (Line: 1; Offset: 29)","origin":"Binary File","mitre_attack_id":"T1105","relevance":8,"id":"binary-4","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 4761 bytes 1 file at 0x2c last modified Sun Dec 04 2024 10:02:46 +A \"disallowedcert.stl\" number 1 1 datablock 0x1 compression\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003352]","origin":"Binary File","mitre_attack_id":"T1560","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"accept\" (Source: Invoice details.exe, API is part of module: WS2_32.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Submission/internal name is suspicious for an executable","description":"Input file type is \".NET exe\" and the name \"Invoice details.exe\" contains indicator \"invoice\"","origin":"Monitored Target","mitre_attack_id":"T1036","relevance":10,"id":"target-40","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"Invoicedetails.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe\" - (UID: 00000000-00001268)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Hooks file system APIs","description":"\"FindNextFileA@KERNEL32.DLL\" in \"WScript.exe\"\n \"FindFirstFileW@KERNEL32.DLL\" in \"WScript.exe\"\n \"FindNextFileW@KERNEL32.DLL\" in \"WScript.exe\"\n \"FindFirstFileA@KERNEL32.DLL\" in \"WScript.exe\"\n \"FindNextFileA@KERNEL32.DLL\" in \"IsInherited.exe\"\n \"FindFirstFileW@KERNEL32.DLL\" in \"IsInherited.exe\"\n \"FindFirstFileA@KERNEL32.DLL\" in \"IsInherited.exe\"\n \"FindNextFileW@KERNEL32.DLL\" in \"IsInherited.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-2","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Writes PE header to memory","description":"$4e","origin":"API Call","mitre_attack_id":"T1055.002","relevance":7,"id":"api-83","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"malicious","category":"Cryptographic Related","name":"Hooks key cryptographic functions of the CryptoAPI","description":"\"DecryptMessage@SSPICLI.DLL\" in \"IsInherited.exe\"\n \"EncryptMessage@SSPICLI.DLL\" in \"IsInherited.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-1","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"Wrote 1 instructions to a remote process\n Wrote 2159 instructions to a remote process\n Wrote 17 instructions to a remote process\n Wrote 2 instructions to a remote process\n Wrote 232 instructions to a remote process\n Wrote 8 instructions to a remote process\n Wrote 15 instructions to a remote process\n Wrote 3 instructions to a remote process\n Wrote 24 instructions to a remote process\n Wrote 9 instructions to a remote process\n Wrote 14 instructions to a remote process\n Wrote 12 instructions to a remote process\n Wrote 29 instructions to a remote process\n Wrote 16 instructions to a remote process\n Wrote 11 instructions to a remote process","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_90% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"Invoicedetails.exe\" set thread context in remote process PID 123c\n \"IsInherited.exe\" set thread context in remote process \"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\c9a4cbc00f690a9e3cddfc400f6e85bb\\System.Windows.Forms.ni.dll\" (PID: b48)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$4f","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"\"checkip.dyndns.org\" (Indicator: \"checkip.dyndns.org\"; File: \"PCAP\")\n \"GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive\" (Indicator: \"checkip.dyndns.org\"; File: \"PCAP\")\n \"GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org\" (Indicator: \"checkip.dyndns.org\"; File: \"PCAP\")\n \"reallyfreegeoip.org\" (Indicator: \"reallyfreegeoip.org\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"checkip.dyndns.org\"\n \"reallyfreegeoip.org\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Found FTP credentials location strings","description":"\"tudio\\ChromePlus\\User Data\\Default\\Login Data\" (Indicator: \"\\chromeplus\\\") in Source: 00002888.00000B48.15287315.00092000.wprm\n \"\\Comodo\\Dragon\\User Data\\Default\\Login Data\" (Indicator: \"\\comodo\\\") in Source: 00002888.00000B48.15287315.00092000.wprm\n \"\\Comodo\\IceDragon\\\" (Indicator: \"\\comodo\\\") in Source: 00002888.00000B48.15287315.00092000.wprm","origin":"File/Memory","mitre_attack_id":"T1552.001","relevance":6,"id":"string-11","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Hooks internet related APIs","description":"\"send@WS2_32.DLL\" in \"WScript.exe\"\n \"send@WS2_32.DLL\" in \"IsInherited.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-5","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$50","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Hooks internet related APIs"}],"sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"name":"Spyware","details_count":5,"details":[{"detail":"Accesses potentially sensitive information from local browsers"},{"detail":"Hooks API calls"},{"detail":"Hooks key cryptographic functions of the CryptoAPI"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Found browser information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Found FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"},{"detail":"Writes a file to the startup folder"}],"sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Tries to identify its external IP address"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]}]},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":138,"dropped_files_count":0,"extracted_files_count":5,"files_written_count":12,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":4,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["wacatac"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Launch Failed"],"sandbox_reports":[{"id":"681ca99e2c40987c470da216","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"Invoice details.exe","analysis_start_time":"2025-05-08T12:54:55+00:00","indicators_count":{"informative":164,"suspicious":68,"malicious":13},"tags":["Multi-Process","Network Traffic","Extracted Files","Launch Failed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"193.122.6.168","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"address":"104.21.64.1","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"address":"132.226.8.169","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"address":"104.21.32.1","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]}],"dns_resolutions":[{"domain":"checkip.dyndns.org","address":"132.226.8.169","ttl":32,"country":"United States","registrar_name":"Tucows Inc.","registrar_organization":"Dynamic Network Services, Inc.","registrar_name_servers":"NS1.DYNDNS.ORG","registrar_creation_date":"1998-11-22T05:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"domain":"reallyfreegeoip.org","address":"104.21.32.1","ttl":258,"country":"United States","registrar_name":"Cloudflare, Inc.","registrar_organization":"DATA REDACTED","registrar_name_servers":"olga.ns.cloudflare.com","registrar_creation_date":"2018-10-20T21:17:41+00:00","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]}],"http_requests":[{"host":"checkip.dyndns.org","host_ip":"193.122.6.168:80","url":"/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET / HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)\nHost: checkip.dyndns.org\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}],"processes":[{"pid":1268,"ppid":0,"name":"Invoicedetails.exe","command_line":"","sha256":"17277418809bfc803df5fcb1aff0b1268fac38210e2eca8a555bee9f85492e9a","normalized_path":"C:\\Invoicedetails.exe","uid":"00000000-00001268","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="},{"pid":3352,"ppid":1268,"name":"powershell.exe","command_line":"-enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAEkAbgB2AG8AaQBjAGUAZABlAHQAYQBpAGwAcwAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwASQBuAHYAbwBpAGMAZQBkAGUAdABhAGkAbABzAC4AZQB4AGUAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwASABBAFAAVQBCAFcAUwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwASQBzAEkAbgBoAGUAcgBpAHQAZQBkAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABIAEEAUABVAEIAVwBTAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABJAHMASQBuAGgAZQByAGkAdABlAGQALgBlAHgAZQA=","sha256":"70ba57fb0bf2f34b86426d21559f5f6d05c1268193904de8e959d7b06ce964ce","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001268","uid":"00000000-00003352"},{"pid":4668,"ppid":1268,"name":"InstallUtil.exe","command_line":"","sha256":"af5cbd35c7d8dea7d879113fda61b0f64ac6618bcdae15c0c732a018babf68ee","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe","parent_uid":"00000000-00001268","uid":"00000000-00004668"},{"pid":1036,"ppid":0,"name":"WScript.exe","command_line":"\"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\IsInherited.vbs\"","sha256":"9c8a1b52a638ca87a5e7e60e635a3cbf89b04f5888995f55e2ad3d94ab009b97","normalized_path":"%WINDIR%\\System32\\WScript.exe","uid":"00000000-00001036","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="},{"pid":5060,"ppid":1036,"name":"IsInherited.exe","command_line":"","sha256":"17277418809bfc803df5fcb1aff0b1268fac38210e2eca8a555bee9f85492e9a","normalized_path":"%APPDATA%\\IsInherited.exe","parent_uid":"00000000-00001036","uid":"00000000-00005060"},{"pid":2888,"ppid":5060,"name":"InstallUtil.exe","command_line":"","sha256":"af5cbd35c7d8dea7d879113fda61b0f64ac6618bcdae15c0c732a018babf68ee","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe","parent_uid":"00000000-00005060","uid":"00000000-00002888"}],"all_imported_dlls":["uxtheme.dll","crypt32.dll","usp10.dll","VxSSL32.dll","api-ms-win-downlevel-version-l1-1-0.dll","msisip.dll","Microsoft.Windows.Diagnosis.TroubleshootingPack.dll","mpr.dll","bcrypt.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","propsys.dll","devobj.dll","secur32.dll","System.Windows.Forms.ni.dll","webio.dll","iertutil.dll","System.Management.Automation.dll","wow64win.dll","api-ms-win-core-synch-l1-2-0.dll","wshext.dll","System.Configuration.ni.dll","diasymreader.dll","sspicli.dll","shlwapi.dll","wininet.dll","dhcpcsvc6.dll","Microsoft.Windows.Diagnosis.SDEngine.dll","VxSSL64.dll","fltLib.dll","System.Management.ni.dll","Microsoft.Management.Infrastructure.ni.dll","SensApi.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","schannel.dll","dwmapi.dll","wow64.dll","rpcrt4.dll","cryptbase.dll","clrjit.dll","pwrshsip.dll","Microsoft.PowerShell.Security.ni.dll","dhcpcsvc.dll","msvcrt.dll","nlssorting.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","wintrust.dll","System.Data.ni.dll","clr.dll","System.Numerics.ni.dll","sxs.dll","shdocvw.dll","cryptsp.dll","cfgmgr32.dll","System.DirectoryServices.ni.dll","System.Transactions.ni.dll","System.Transactions.dll","lpk.dll","profapi.dll","normaliz.dll","rsaenh.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-user32-l1-1-0.dll","rasapi32.dll","System.Web.Extensions.dll","mscorrc.dll","System.Management.Automation.ni.dll","wow64cpu.dll","oleaut32.dll","api-ms-win-core-xstate-l2-1-0.dll","FWPUCLNT.DLL","rpcss.dll","KernelBase.dll","ws2_32.dll","vcruntime140_clr0400.dll","setupapi.dll","comdlg32.dll","user32.dll","nsi.dll","Microsoft.CSharp.ni.dll","winnsi.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","Wldap32.dll","gpapi.dll","psapi.dll","userenv.dll","winhttp.dll","vbscript.dll","mscoreei.dll","comctl32.dll","ntmarta.dll","ole32.dll","Microsoft.PowerShell.Commands.Management.ni.dll","mscoree.dll","version.dll","System.Xml.ni.dll","kernel32.dll","imm32.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","atl.dll","Microsoft.BackgroundIntelligentTransfer.Management.dll","dnsapi.dll","tzres.dll","RpcRtRemote.dll","ncrypt.dll","bcryptprimitives.dll","credssp.dll","ieframe.dll","msctf.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","ntdll.dll","ucrtbase_clr0400.dll","shell32.dll","rasadhlp.dll","AutoItX3.PowerShell.dll","Microsoft.VisualBasic.ni.dll","rasman.dll","sechost.dll","clbcatq.dll","Microsoft.Management.Infrastructure.Native.ni.dll","cryptnet.dll","rtutils.dll","scrrun.dll","advapi32.dll","mscorlib.ni.dll","System.Core.ni.dll","apphelp.dll","System.Configuration.Install.ni.dll","scrobj.dll","msasn1.dll","System.Data.dll","WSHTCPIP.DLL","wship6.dll","gdi32.dll","IPHLPAPI.DLL","System.ni.dll","urlmon.dll","System.Drawing.ni.dll","mswsock.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"IsInherited.exe","sha256":"17277418809bfc803df5fcb1aff0b1268fac38210e2eca8a555bee9f85492e9a","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"name":"IsInherited.vbs","sha256":"2abadb6f1057c6fa81cb23c2ff495720ae2d57ae8694372c88f6c9472539eee4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"3d4e9b967ed6b5c5028f1afc0ee7ae5b0e5c67cea4266fe1536c6cf12f80aeab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"name":"IsInherited.vbs.bin","sha256":"2abadb6f1057c6fa81cb23c2ff495720ae2d57ae8694372c88f6c9472539eee4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\IsInherited.vbs","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"path":"%APPDATA%\\IsInherited.exe","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D9933D14-6FB9-460D-AF44-052755384D0C}","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"path":"%TEMP%\\3uqwjnuv.hyc.ps1","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"path":"%TEMP%\\yhutosdr.tqn.psm1","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"681ca99e2c40987c470da216"}]}]}},"report_ids":{"sandbox_job_ids":["681ca99e2c40987c470da216"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 17277418809b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 17277418809b…. Malware family: Trojan.Generic. Threat score 100/100. 13/26 AV engines flagged this file. 13 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/17277418809bfc803df5fcb1aff0b1268fac38210e2eca8a555bee9f85492e9a"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 17277418809b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 17277418809b…. Malware family: Trojan.Generic. Threat score 100/100. 13/26 AV engines flagged this file. 13 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/17277418809bfc803df5fcb1aff0b1268fac38210e2eca8a555bee9f85492e9a"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 17277418809b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 17277418809b…. Malware family: Trojan.Generic. Threat score 100/100. 13/26 AV engines flagged this file. 13 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L51","11",{}]]