24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 53:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 20ed21bfdb7a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 20ed21bfdb7a…. Malware family: Trojan.Generic. Threat score 100/100. 18/24 AV engines flagged this file. 8 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d"],"about":{"@type":"SoftwareApplication","name":"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d","applicationCategory":["peexe","64bits","executable"],"identifier":"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":18,"total":24},"behavioralIndicators":{"malicious":8,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Td2c,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp")26:T5ef,Found string - \\.\pipe\__rust_anonymous_pipe1__.4140.5674161952380272259; Source: "00000000-00004140-00000C55-958501999") Found string - \\.\pipe\__rust_anonymous_pipe1__.4140.5674161952380272260; Source: "00000000-00004140-00000C55-958502428") Found string - \\.\pipe\PSHost.133816172433916939.8120.DefaultAppDomain.powershell; Source: "00000000-00008120-00000C55-982728213") Found string - \\.\pipe\PSHost.133816172434209637.3068.DefaultAppDomain.powershell; Source: "00000000-00003068-00000C55-988632866") Found string - \\.\pipe\PSHost.133816172434501819.1476.DefaultAppDomain.powershell; Source: "00000000-00001476-00000C55-984900082") Found string - \\.\pipe\PSHost.133816172434791487.2796.DefaultAppDomain.powershell; Source: "00000000-00002796-00000C55-987624687") Found string - \\.\pipe\__rust_anonymous_pipe1__.; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found string - exe\\.\NUL\cmd.exemaximum number of ProcThreadAttributes exceeded; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found string - \.\p; Source: "00000000-00004140.00000000.125023.1EA10000.00000004.mdmp, 00000000-00004140.00000001.126945.1EA10000.00000004.mdmp, 00000000-00004140.00000002.128865.1EA10000.00000004.mdmp") Found string - \.\pipe\__rust_anonymous_pipe1__.o; Source: "00000000-00004140.00000000.125023.1EA10000.00000004.mdmp") Found string - \\.\pipe\__rust_anonymous_pipe1__.4140.5674161952380272260; Source: "00000000-00004140.00000000.125023.1EA10000.00000004.mdmp")27:T588,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Found XOR operators (encryption/decryption) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Decrypted SSL network traffic Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Contains reference to cryptographic keys Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops image files with high entropy (likely encrypted/compressed content)28:T1e52,"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004140) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004140) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004140) "net1.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000392) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008120) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008120) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac3ec5e3010000000000000000000051ed429cf87f000000000000e301000000000000000000001417439daf8e0000000001001a000100c054b0aae30100008fec429cf87f0000e0ac3ec5e3010000e0ac3ec5e3010000000000000000000000000000f87f0000ffffff7fa013000000000000000000000000000000000000d8ce32c5e30100002a0000000000000069c3ebc4e30100003100000000000000cc03000000000000d0030000000000001100011000000000d0d477882200000003a31d9af87f0000d0d477882200000000000000000000002b00000000000000000000000000000020b0f1c4e3010000b43ff0c4e3010000e0ce32c5 (UID: 00000000-00008120) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000040000000000000000000d2aae30100000b8e409cf87f00000000d2aae301000002000000e3010000380000000000000040000000000000003003d2aae301000008e1548922000000010000000000000003000000000000000100000000000000160000000000000020259aaae3010000000000000000000000009aaae3010000c8d677c6e301000000000000000000007a000000010000000000000000000000800000000000000004000000000000000000000000000000d8e277c6e301000004000000000000003800000000000000f0981c9af87f00003800000000000000380000000000000080e2548922000000c00c6264f87f000000000000 (UID: 00000000-00008120) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b0047ef87f0000070000000000000000000000000000000100000000000000f0ebd2aae30100000000000000000000407968c6e30100004c981c9af87f0000b09868c6e3010000b3ce5864f87f0000c07968c6e3010000004f047ef87f0000d0b0047ef87f000000000000000000000000000000000000c07968c6e3010000f0ebd2aae301000080a468c6e3010000d8e25489220000004c981c9af87f00000100000000000000d8e254892200000080a468c6e3010000c07968c6e3010000010000000000000002bc5864f87f0000508068c6e3010000f0cc66c6e3010000feffffff040000007df0037ef87f000040a368c6 (UID: 00000000-00008120) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000070000000000000000000000000000000100000000000000f0ebd2aae30100000000000000000000407968c6e30100004c981c9af87f0000b09d68c6e3010000b3ce5864f87f0000707e68c6e3010000384f047ef87f0000d0b0047ef87f000000000000000000000000000000000000707e68c6e3010000f0ebd2aae301000080a468c6e3010000d0e25489220000004c981c9af87f00000100000000000000d0e254892200000080a468c6e3010000707e68c6e3010000010000000000000002bc5864f87f00000000000000000000f0cc66c6e3010000508068c604000000fefffffffffffffff0ebd2aae30100007df0037ef87f000000000000 (UID: 00000000-00008120) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003068) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003068)29:T5e6,"powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e0065007800650000005c006d0061006300680069006e0065002e00630006000006f7af0000a0a1a5aa (UID: 00000000-00008120) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e0065007800650000005c006d0061006300680069006e0065002e00630005000005e22a0000603064c6 (UID: 00000000-00003068) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e0065007800650000005c006d0061006300680069006e0065002e00630005000005de72000060306eff (UID: 00000000-00001476) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000002000000b6000dd802000040b6000dd802000080b6000dd8020000c0b6000dd802000000b7000dd802000040b7000dd802000080b7000dd8020000c0b7000dd802000000b8000dd802000040b8000dd802000080b8000dd8020000c0b8000dd802000000b9000dd802000040b9000dd80200006f006e006600690067000000 (UID: 00000000-00002796)2a:T4da,"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "net1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")2b:T1218,"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" queries volume information of "C:\" at 00000000-00004140-00000C15-968441639 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" queries volume information of "C:\$MAPFAILURE" at 00000000-00004140-00000C15-968888581 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" queries volume information of "C:\$MAPFAILURE" at 00000000-00004140-00000C15-968888850 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" queries volume information of "C:\$Recycle.Bin" at 00000000-00004140-00000C15-968889180 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" queries volume information of "C:\$Recycle.Bin\S-1-5-18" at 00000000-00004140-00000C15-968889601 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" queries volume information of "C:\$Recycle.Bin\S-1-5-18\desktop.ini" at 00000000-00004140-00000C15-968890110 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" queries volume information of "C:\$Recycle.Bin\S-1-5-18\desktop.ini" at 00000000-00004140-00000C15-968890443 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" queries volume information of "C:\$Recycle.Bin\S-1-5-18\desktop.ini" at 00000000-00004140-00000C15-968906920 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" queries volume information of "C:\$Recycle.Bin\S-1-5-21-735145574-3570218355-1207367261-1001" at 00000000-00004140-00000C15-968923709 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" queries volume information of "C:\$Recycle.Bin\S-1-5-21-735145574-3570218355-1207367261-1001\desktop.ini" at 00000000-00004140-00000C15-968924400 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" queries volume information of "C:\$Recycle.Bin\S-1-5-21-735145574-3570218355-1207367261-1001\desktop.ini" at 00000000-00004140-00000C15-968924872 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" queries volume information of "C:\$Recycle.Bin\S-1-5-21-735145574-3570218355-1207367261-1001\desktop.ini" at 00000000-00004140-00000C15-969036521 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" queries volume information of "C:\$WINDOWS.~BT" at 00000000-00004140-00000C15-969074307 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" queries volume information of "C:\$WINDOWS.~BT\DUDownload" at 00000000-00004140-00000C15-969074738 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" queries volume information of "C:\$WINDOWS.~BT\DUDownload\Setup" at 00000000-00004140-00000C15-969075153 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" queries volume information of "C:\$WINDOWS.~BT\DUDownload\Setup\acmigration.dll" at 00000000-00004140-00000C15-969099452 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" queries volume information of "C:\$WINDOWS.~BT\DUDownload\Setup\acmigration.dll" at 00000000-00004140-00000C15-969099877 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" queries volume information of "C:\$WINDOWS.~BT\DUDownload\Setup\acmigration.dll" at 00000000-00004140-00000C15-969135186 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" queries volume information of "C:\$WINDOWS.~BT\DUDownload\Setup\appraiser.sdb" at 00000000-00004140-00000C15-971430631 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" queries volume information of "C:\$WINDOWS.~BT\DUDownload\Setup\appraiser.sdb" at 00000000-00004140-00000C15-971431011 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" queries volume information of "C:\$WINDOWS.~BT\DUDownload\Setup\diagtrack.dll" at 00000000-00004140-00000C15-971431441 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" queries volume information of "C:\$WINDOWS.~BT\DUDownload\Setup\diagtrack.dll" at 00000000-00004140-00000C15-971431810 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" queries volume information of "C:\$WINDOWS.~BT\DUDownload\Setup\diagtrack.dll" at 00000000-00004140-00000C15-971432388 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" queries volume information of "C:\$WINDOWS.~BT\DUDownload\Setup\mediasetupuimgr.dll" at 00000000-00004140-00000C15-978303834 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" queries volume information of "C:\$WINDOWS.~BT\DUDownload\Setup\mediasetupuimgr.dll" at 00000000-00004140-00000C15-9783042622c:Tf49,"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")2d:T727,"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")2e:T4e5,"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" called "CreateProcessW" with parameter ""net" session" - (UID: 00000000-00004140) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" called "CreateProcessW" with parameter ""powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"" - (UID: 00000000-00004140) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" called "CreateProcessW" with parameter ""powershell" -Command "wevtutil sl Security /e:false"" - (UID: 00000000-00004140) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" called "CreateProcessW" with parameter ""powershell" -Command "wevtutil sl Application /e:false"" - (UID: 00000000-00004140) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" called "CreateProcessW" with parameter ""powershell" -Command "Set-ExecutionPolicy Bypass -Scope Process -Force"" - (UID: 00000000-00004140) "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\system32\wevtutil.exe" sl Security /e:false" - (UID: 00000000-00003068) "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\system32\wevtutil.exe" sl Application /e:false" - (UID: 00000000-00001476)2f:T406,"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" called "NtCreateNamedPipeFile" with parameter "pipe\__rust_anonymous_pipe1__.4140.5674161952380272259" - (UID: 00000000-00004140) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" called "NtCreateNamedPipeFile" with parameter "pipe\__rust_anonymous_pipe1__.4140.5674161952380272260" - (UID: 00000000-00004140) "powershell.exe" called "NtCreateNamedPipeFile" with parameter "pipe\PSHost.133816172433916939.8120.DefaultAppDomain.powershell" - (UID: 00000000-00008120) "powershell.exe" called "NtCreateNamedPipeFile" with parameter "pipe\PSHost.133816172434209637.3068.DefaultAppDomain.powershell" - (UID: 00000000-00003068) "powershell.exe" called "NtCreateNamedPipeFile" with parameter "pipe\PSHost.133816172434501819.1476.DefaultAppDomain.powershell" - (UID: 00000000-00001476) "powershell.exe" called "NtCreateNamedPipeFile" with parameter "pipe\PSHost.133816172434791487.2796.DefaultAppDomain.powershell" - (UID: 00000000-00002796)30:Tc304,"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004140) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004140) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004140) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004140) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00004140) "net1.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000392) "net1.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000392) "net1.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000392) "net1.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000392) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\5f64880c86c98e7ddecdf28e61917307\Microsoft.Management.Infrastr (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003068) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001476) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002796) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002796)31:T43f,Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API "NtCreateFile" (Indicator: "CreateFile"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API "NtCreateFile" (Indicator: "CreateFile"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp")32:Tab9f,Found reference to API (Indicator: "RegCloseKey"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "RegQueryValueExW"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "RegOpenKeyExW"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "BCryptGenRandom"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "CertEnumCertificatesInStore"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "CertOpenStore"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "CertDuplicateStore"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "CertDuplicateCertificateChain"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "CertCloseStore"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "CertDuplicateCertificateContext"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "CertAddCertificateContextToStore"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "CertFreeCertificateChain"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "CertFreeCertificateContext"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "CertGetCertificateChain"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "GetStdHandle"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "ReleaseMutex"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "GetOverlappedResult"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "WaitForSingleObject"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "GetFileAttributesW"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "GetCurrentProcess"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "GetConsoleMode"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "InitializeSListHead"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "WideCharToMultiByte"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "HeapReAlloc"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "FormatMessageW"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "FindClose"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "GetFullPathNameW"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "SetLastError"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "GetQueuedCompletionStatusEx"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "GetModuleFileNameW"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "IsDebuggerPresent"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "ExitProcess"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "InitializeProcThreadAttributeList"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "MultiByteToWideChar"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "SetFilePointerEx"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "CreateMutexA"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "CreateThread"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "SetThreadStackGuarantee"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "SetHandleInformation"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "SetWaitableTimer"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "SleepEx"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "WriteConsoleW"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "HeapFree"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "GetExitCodeProcess"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "CompareStringOrdinal"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "LoadLibraryA"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "DeleteFileW"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "SetFileInformationByHandle"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "GetSystemInfo"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "GetProcessHeap"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "CreateWaitableTimerExW"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "FindNextFileW"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "GetCurrentThreadId"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "FindFirstFileW"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "DuplicateHandle"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "GetProcAddress"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "GetFileInformationByHandleEx"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "CreateEventW"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "CreateFileW"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "UpdateProcThreadAttribute"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "HeapAlloc"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "GetLastError"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "SetFileCompletionNotificationModes"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "CreateNamedPipeW"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "lstrlenW"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "SwitchToThread"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "GetCurrentProcessId"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "GetCommandLineW"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "CopyFileExW"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "CancelIo"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "GetCurrentThread"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "GetModuleHandleA"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "ReadFile"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "WriteFileEx"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "RtlCaptureContext"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "CloseHandle"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "GetModuleHandleW"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "DeleteProcThreadAttributeList"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "PostQueuedCompletionStatus"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "CreateProcessW"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "Sleep"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "ReadFileEx"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "RtlNtStatusToDosError"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "NtDeviceIoControlFile"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "NtReadFile"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "NtCreateFile"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "NtWriteFile"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "CoTaskMemFree"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "AcquireCredentialsHandleA"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "InitializeSecurityContextW"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "AcceptSecurityContext"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "DeleteSecurityContext"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "QueryContextAttributesW"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "ApplyControlToken"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "FreeContextBuffer"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "DecryptMessage"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "EncryptMessage"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "FreeCredentialsHandle"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "SHGetKnownFolderPath"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "SystemParametersInfoW"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "getsockopt"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "WSASend"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "WSACleanup"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "WSAStartup"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "WSAGetLastError"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "getsockname"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "getpeername"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "ioctlsocket"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "closesocket"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "WSAIoctl"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00002796.00000000.125407.0CFE0000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00003068.00000000.125401.C6640000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00003068.00000000.125401.C6640000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "SetThreadDescription"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfoW"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "closesocket"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "ApplyControlToken"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "DecryptMessage"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "EncryptMessage"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "CertGetCertificateChain"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "AcceptSecurityContext"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "InitializeSecurityContextW"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "FreeContextBuffer"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "CertFreeCertificateContext"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "CertDuplicateCertificateContext"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "CertDuplicateStore"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "CertCloseStore"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "CertOpenStore"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "CertEnumCertificatesInStore"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "DeleteSecurityContext"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "QueryContextAttributesW"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "CertDuplicateCertificateChain"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "CertFreeCertificateChain"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "AcquireCredentialsHandleA"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "FreeCredentialsHandle"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "getsockopt"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "getpeername"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "getsockname"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "ioctlsocket"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "SetHandleInformation"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "WSASend"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "WSAIoctl"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatusEx"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "NtDeviceIoControlFile"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "WSAGetLastError"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "GetOverlappedResult"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "NtCreateFile"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "SetFileCompletionNotificationModes"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "WSACleanup"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "DeleteProcThreadAttributeList"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "CompareStringOrdinal"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "AddVectoredExceptionHandler"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "SetThreadStackGuarantee"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "CreateWaitableTimerExW"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "SetWaitableTimer"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "NtReadFile"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "WriteFileEx"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "SleepEx"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "CopyFileExW"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "CancelIo"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "NtWriteFile"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "CreateNamedPipeW"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "ReadFileEx"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00008120.00000000.125402.AAA40000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00008120.00000000.125402.AAA40000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00008120.00000000.125402.AAA40000.00000004.mdmp")33:T44e,Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API "WSAGetLastError" (Indicator: "GetLastError"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API "WSAGetLastError" (Indicator: "GetLastError"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp")34:T480,"SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00003068.00000000.125401.F08DA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00003068.00000000.125401.F08DA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00003068.00000000.125401.F08DA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00003068.00000000.125401.F08DA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00003068.00000000.125401.F08DA000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00003068.00000000.125401.F08DA000.00000002.mdmp "HTTPS_PROXYhttps_proxyALL_PROXYall_proxyREQUEST_METHODSoftware\Microsoft\Windows\CurrentVersion\Internet SettingsProxyEnableProxyServer=;" in Source: 00000000-00004140.00000000.125023.06D8F000.00000002.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004140.00000000.125023.1EA10000.00000004.mdmp 00000000-00004140.00000001.126945.1EA10000.00000004.mdmp35:T1071,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:ffffffffc0000135]36:T3ad8,"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff899200000 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff899200000 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff899200000 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" loaded module "KERNEL32" at base 7ff899be0000 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff86c600000 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" loaded module "NTDLL.DLL" at base 7ff89c3e0000 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff8990e0000 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff897fc0000 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ff890230000 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" loaded module "RPCRT4.DLL" at base 7ff899d50000 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ff891710000 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" loaded module "SSPICLI.DLL" at base 7ff898660000 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ff897ab0000 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" loaded module "MSKEYPROTECT.DLL" at base 7ff889e10000 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ff88a1f0000 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" loaded module "KERNEL32.DLL" at base 7ff899be0000 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff897b70000 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 7ff887fd0000 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff899610000 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" loaded module "WS2_32.DLL" at base 7ff89a970000 "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff896db0000 "net1.exe" loaded module "KERNEL32" at base 7ff899be0000 "net1.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff899200000 "net1.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff899200000 "net1.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff899200000 "net1.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ff899a40000 "net1.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff899200000 "net1.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff899200000 "net1.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff899200000 "net1.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff86c600000 "net1.exe" loaded module "RPCRT4.DLL" at base 7ff899d50000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff899200000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff899200000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff899200000 "powershell.exe" loaded module "KERNEL32" at base 7ff899be0000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff86c600000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ff899be0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ff899ca0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff87a920000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ff899fa0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff898750000 "powershell.exe" loaded module "VERSION.DLL" at base 7ff88f350000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ff86ae00000 "powershell.exe" loaded module "USER32.DLL" at base 7ff8998b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ff899200000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ff87f640000 "powershell.exe" loaded module "NTDLL" at base 7ff89c3e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff89bf00000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ff899e70000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ff899d50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ff869800000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 7ff89a250000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff89bf00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ff89a7f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ff868b90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ff868110000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ff86c550000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff897b70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff8990e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ff8660a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 7ff89bf00000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff89bf00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 7ff89c3e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 1e3c4e00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ff8987e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ff8987e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff899610000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "AMSI.DLL" at base 7ff87f5a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff88f350000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ff87e030000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WK13VOEB.DLL" at base 7ff86c3c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ff88a5e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff87a7b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ff865f30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ff865680000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ff899610000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ff86c360000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ff864d10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ff8649a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ff899200000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff864850000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ff889a40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ff864770000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ff88bc00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff864630000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 7ff88f340000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ff898660000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WLDP.DLL" at base 0 "powershell.exe" loaded module "WLDP.DLL" at base 7ff897790000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff896db0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ff864550000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ff899be0000 "powershell.exe" loaded module "USERENV.DLL" at base 7ff898630000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff899ca0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ff89bf00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ff898290000 "powershell.exe" loaded module "OLEAUT32" at base 7ff89a7f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ff864310000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.M870D558A#\5F64880C86C98E7DDECDF28E61917307\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 7ff864260000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 7ff899200000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MSVCRT.DLL" at base 0 "powershell.exe" loaded module "MSVCRT.DLL" at base 7ff89a1b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 0 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 7ff88a6f0000 "powershell.exe" loaded module "MI.DLL" at base 7ff88e6f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WMIDCOM.DLL" at base 7ff88e660000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ff899200000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ff88c7a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ff88c520000 "powershell.exe" loaded module "SHELL32.DLL" at base 1c0e0a50000 "powershell.exe" loaded module "SHELL32.DLL" at base 16199e90000 "powershell.exe" loaded module "SHELL32.DLL" at base 2d827410000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ff8914c000037:T533,"powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\PROGID") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\INPROCSERVER32") "powershell.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\TREATAS") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\INPROCHANDLER")38:T446,"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "net1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "net1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "net1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN")39:Tfcd,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00008120-00000C28-966693276] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00008120-00000C28-968041929] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00008120-00000C28-968456416] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00008120-00000C28-969073520] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00008120-00000C28-970762543] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00008120-00000C28-971563880] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00008120-00000C28-971858021] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00008120-00000C28-972050869] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00008120-00000C28-972388148] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00008120-00000C28-972681759] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00008120-00000C28-973025346] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00008120-00000C28-974631648] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00008120-00000C28-975452832] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00008120-00000C28-976749211] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00008120-00000C28-976860297] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00008120-00000C28-978282298] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00008120-00000C28-978373083] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00008120-00000C28-979254338] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00008120-00000C28-979498254] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00008120-00000C28-979536855] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00008120-00000C28-979865510] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00008120-00000C28-980522296] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll" [Source: 00000000-00008120-00000C28-981436908] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll" [Source: 00000000-00008120-00000C28-981826331] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00008120-00000C28-981995711]3a:T227b,"mediasetupuimgr.dll.funksec" has type "data"- Location: [C:\$WINDOWS.~BT\DUDownload\Setup\mediasetupuimgr.dll.funksec]- [targetUID: 00000000-00004140] "setupprep.exe.funksec" has type "data"- [targetUID: 00000000-00004140] "setupprep.exe.funksec" has type "data"- Location: [C:\$WINDOWS.~BT\DUDownload\Setup\setupprep.exe.funksec]- [targetUID: 00000000-00004140] "e4S32jfhg4.exe" has type "PE32+ executable (console) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\e4S32jfhg4.exe]- [targetUID: 00000000-00004140] "migcore.dll.funksec" has type "data"- [targetUID: 00000000-00004140] "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe.funksec" has type "data"- [targetUID: N/A] "setupplatform.dll.funksec" has type "data"- [targetUID: N/A] "mediasetupuimgr.dll.funksec" has type "data"- [targetUID: 00000000-00004140] "migcore.dll.funksec" has type "data"- Location: [C:\$WINDOWS.~BT\DUDownload\Setup\migcore.dll.funksec]- [targetUID: 00000000-00004140] "winsetup.dll.funksec" has type "data"- [targetUID: N/A] "compatResources.dll.funksec" has type "OpenPGP Public Key"- [targetUID: N/A] "setupcore.dll.funksec" has type "data"- Location: [C:\$WINDOWS.~BT\DUDownload\Setup\setupcore.dll.funksec]- [targetUID: 00000000-00004140] "setupcore.dll.funksec" has type "data"- [targetUID: 00000000-00004140] "UpdateSetupUIMgr.dll.funksec" has type "data"- [targetUID: N/A] "appraiser.dll.funksec" has type "data"- [targetUID: N/A] "GatherOsState.exe.funksec" has type "data"- [targetUID: N/A] "diagtrack.dll.funksec" has type "data"- Location: [C:\$WINDOWS.~BT\DUDownload\Setup\diagtrack.dll.funksec]- [targetUID: 00000000-00004140] "diagtrack.dll.funksec" has type "data"- [targetUID: 00000000-00004140] "windlp.dll.funksec" has type "data"- [targetUID: N/A] "wpx.dll.funksec" has type "data"- [targetUID: N/A] "migstore.dll.funksec" has type "data"- [targetUID: N/A] "unbcl.dll.funksec" has type "big endian ispell 3.0 hash file"- [targetUID: N/A] "reagent.dll.funksec" has type "data"- Location: [C:\$WINDOWS.~BT\DUDownload\Setup\reagent.dll.funksec]- [targetUID: 00000000-00004140] "reagent.dll.funksec" has type "data"- [targetUID: 00000000-00004140] "dismapi.dll.funksec" has type "data"- [targetUID: N/A] "wdsimage.dll.funksec" has type "data"- [targetUID: N/A] "setupmgr.dll.funksec" has type "data"- Location: [C:\$WINDOWS.~BT\DUDownload\Setup\setupmgr.dll.funksec]- [targetUID: 00000000-00004140] "setupmgr.dll.funksec" has type "data"- [targetUID: 00000000-00004140] "SetupHost.exe.funksec" has type "PGP Secret Sub-key -"- [targetUID: N/A] "generaltel.dll.funksec" has type "data"- [targetUID: N/A] "aeinv.dll.funksec" has type "data"- [targetUID: N/A] "wdstptc.dll.funksec" has type "data"- [targetUID: N/A] "csiagent.dll.funksec" has type "data"- [targetUID: N/A] "wimprovider.dll.funksec" has type "data"- [targetUID: N/A] "devinv.dll.funksec" has type "data"- [targetUID: N/A] "vhdprovider.dll.funksec" has type "data"- [targetUID: N/A] "dismcore.dll.funksec" has type "data"- [targetUID: N/A] "acres.dll.funksec" has type "data"- [targetUID: N/A] "setupcompat.dll.funksec" has type "data"- [targetUID: N/A] "acmigration.dll.funksec" has type "data"- [targetUID: 00000000-00004140] "acmigration.dll.funksec" has type "data"- Location: [C:\$WINDOWS.~BT\DUDownload\Setup\acmigration.dll.funksec]- [targetUID: 00000000-00004140] "wdsclientapi.dll.funksec" has type "data"- [targetUID: N/A] "wdsutil.dll.funksec" has type "OpenPGP Public Key"- [targetUID: N/A] "Mitigation.dll.funksec" has type "data"- [targetUID: N/A] "mighost.exe.funksec" has type "data"- [targetUID: N/A] "dismprov.dll.funksec" has type "data"- [targetUID: N/A] "wdscore.dll.funksec" has type "data"- [targetUID: N/A] "unattend.dll.funksec" has type "data"- [targetUID: N/A] "imagingprovider.dll.funksec" has type "data"- [targetUID: N/A] "cmi2migxml.dll.funksec" has type "data"- [targetUID: N/A] "dismcoreps.dll.funksec" has type "data"- [targetUID: N/A] "setupplatform.exe.funksec" has type "data"- [targetUID: 00000000-00004140] "setupplatform.exe.funksec" has type "data"- Location: [C:\$WINDOWS.~BT\DUDownload\Setup\setupplatform.exe.funksec]- [targetUID: 00000000-00004140] "compatprovider.dll.funksec" has type "data"- [targetUID: N/A] "compatctrl.dll.funksec" has type "data"- [targetUID: N/A] "DU.dll.funksec" has type "data"- [targetUID: N/A] "logprovider.dll.funksec" has type "COM executable for DOS"- [targetUID: N/A] "AppraiserRes.dll.funksec" has type "data"- [targetUID: N/A] "DiagTrackRunner.exe.funksec" has type "data"- [targetUID: N/A] "folderprovider.dll.funksec" has type "data"- [targetUID: N/A] "wdscsl.dll.funksec" has type "data"- [targetUID: N/A] "AppCompatServicing.dll.funksec" has type "DOS executable (COM 0x8C-variant)"- [targetUID: N/A] "reportgen.dll.funksec" has type "data"- [targetUID: N/A] "Diager.dll.funksec" has type "data"- [targetUID: N/A] "api-ms-win-downlevel-kernel32-l1-1-0.dll.funksec" has type "data"- [targetUID: N/A] "migres.dll.funksec" has type "data"- [targetUID: N/A] "api-ms-win-downlevel-advapi32-l1-1-1.dll.funksec" has type "data"- [targetUID: N/A] "api-ms-win-downlevel-advapi32-l1-1-0.dll.funksec" has type "data"- [targetUID: N/A] "api-ms-win-downlevel-shlwapi-l1-1-1.dll.funksec" has type "data"- [targetUID: N/A] "api-ms-win-downlevel-shlwapi-l1-1-0.dll.funksec" has type "OpenPGP Public Key"- [targetUID: N/A] "api-ms-win-downlevel-kernel32-l2-1-0.dll.funksec" has type "OpenPGP Public Key"- [targetUID: N/A] "api-ms-win-downlevel-advapi32-l2-1-1.dll.funksec" has type "data"- [targetUID: N/A] "api-ms-win-downlevel-ole32-l1-1-1.dll.funksec" has type "data"- [targetUID: N/A] "api-ms-win-downlevel-ole32-l1-1-0.dll.funksec" has type "data"- [targetUID: N/A] "api-ms-win-core-apiquery-l1-1-0.dll.funksec" has type "data"- [targetUID: N/A] "api-ms-win-downlevel-user32-l1-1-0.dll.funksec" has type "data"- [targetUID: N/A] "api-ms-win-downlevel-user32-l1-1-1.dll.funksec" has type "data"- [targetUID: N/A] "api-ms-win-downlevel-advapi32-l2-1-0.dll.funksec" has type "data"- [targetUID: N/A] "api-ms-win-downlevel-advapi32-l3-1-0.dll.funksec" has type "data"- [targetUID: N/A] "api-ms-win-downlevel-version-l1-1-0.dll.funksec" has type "data"- [targetUID: N/A] "api-ms-win-downlevel-advapi32-l4-1-0.dll.funksec" has type "data"- [targetUID: N/A] "ext-ms-win-advapi32-encryptedfile-l1-1-0.dll.funksec" has type "little endian ispell hash file (?) and 13202 string characters"- [targetUID: N/A] "W162x7STtEKk-ZBa.1.1.1.7.29.1.4.0.0_APPRAISER_EverythingSys.bin.funksec" has type "data"- [targetUID: N/A] "hwcompat.txt.funksec" has type "data"- [targetUID: N/A] "setupact.log.funksec" has type "OpenPGP Public Key"- [targetUID: N/A] "upgrade_bulk.xml.funksec" has type "data"- [targetUID: N/A] "upgrade_bulk.xml.funksec" has type "OpenPGP Secret Key"- [targetUID: N/A] "Appraiser_Data.ini.funksec" has type "data"- [targetUID: N/A] "Appraiser_TelemetryRunList.xml.funksec" has type "data"- [targetUID: N/A] "diagwrn.xml.funksec" has type "data"- [targetUID: N/A] "windlp.state-old.xml.funksec" has type "OpenPGP Public Key"- [targetUID: N/A] "windlp.state.xml.funksec" has type "data"- [targetUID: N/A] "downloaded_wallpaper.jpg" has type "JPEG image data JFIF standard 1.02 aspect ratio density 1x1 segment length 16 baseline precision 8 696x516 components 3"- Location: [C:\downloaded_wallpaper.jpg]- [targetUID: 00000000-00004140] "W162x7STtEKk-ZBa.1.1.1.7.29.1.4.0.0_APPRAISER_HumanReadable.xml.funksec" has type "data"- [targetUID: N/A] "diagerr.xml.funksec" has type "data"- [targetUID: N/A] "compatscancache.dat.funksec" has type "data"- [targetUID: N/A] "uninstall.xml.funksec" has type "data"- [targetUID: N/A] "README-T0YhcgHKWK.md" has type "Unicode text UTF-8 text"- Location: [C:\README-T0YhcgHKWK.md]- [targetUID: 00000000-00004140] "CompatData_2018_06_15_02_38_01_3_00000021.xml.funksec" has type "data"- [targetUID: N/A] "CompatData_2018_06_15_02_37_58_3_00000021.xml.funksec" has type "data"- [targetUID: N/A] "reagent.xml.funksec" has type "data"- [targetUID: N/A] "setuperr.log.funksec" has type "data"- [targetUID: N/A] "W162x7STtEKk-ZBa.1.1.1.7.29.1.4.0.0_APPRAISER_SetupOutput.xml.funksec" has type "data"- [targetUID: N/A] "SetupPlatform.ini.funksec" has type "data"- [targetUID: N/A] "hwexclude.txt.funksec" has type "data"- [targetUID: N/A] "W162x7STtEKk-ZBa.1.1.1.7.29.1.4.0.0_APPRAISER_SetupOutputHw.xml.funksec" has type "OpenPGP Public Key"- [targetUID: N/A] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00008120] "e4S32jfhg4.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A]3b:T1458,"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: ""; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\APPID_CATALOG"; Key: ""; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\APPID_CATALOG\06FB5552"; Key: ""; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: ""; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\0000000B"; Key: ""; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64"; Key: ""; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: ""; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: ""; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: ""; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: ""; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: ""; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: ""; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: ""; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: ""; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000009"; Key: ""; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000010"; Key: ""; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000011"; Key: ""; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000012"; Key: ""; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000013"; Key: ""; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000014"; Key: ""; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5"; Key: ""; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\00000014"; Key: ""; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES64"; Key: ""; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES64\000000000001"; Key: ""; Value: "")3c:Tcde,"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")3d:T4f9,"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" reads file "c:\20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" reads file "c:\20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe:zone.identifier" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" reads file "c:\$recycle.bin\s-1-5-18\desktop.ini" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" reads file "c:\$recycle.bin\s-1-5-21-735145574-3570218355-1207367261-1001\desktop.ini" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" reads file "c:\$windows.~bt\dudownload\setup\acmigration.dll" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" reads file "c:\$windows.~bt\dudownload\setup\diagtrack.dll" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" reads file "c:\$windows.~bt\dudownload\setup\mediasetupuimgr.dll" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" reads file "c:\$windows.~bt\dudownload\setup\migcore.dll" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" reads file "c:\$windows.~bt\dudownload\setup\reagent.dll"3e:T5f1,"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" trying to touch file "C:\20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" trying to touch file "C:\SECUR32.DLL" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" trying to touch file "C:\Windows\System32\secur32.dll" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" trying to touch file "C:\BCRYPT.DLL" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" trying to touch file "C:\Windows\System32\bcrypt.dll" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" trying to touch file "C:\VCRUNTIME140.DLL" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" trying to touch file "C:\Windows\System32\vcruntime140.dll"3f:T9fb,"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" trying to access non-existent file "C:\SECUR32.DLL" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" trying to access non-existent file "C:\BCRYPT.DLL" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" trying to access non-existent file "C:\CRYPTBASE.DLL" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" trying to access non-existent file "C:\SSPICLI.DLL" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" trying to access non-existent file "C:\FLTLIB.DLL" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" trying to access non-existent file "C:\NET.EXE" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" trying to access non-existent file "C:\net.exe" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" trying to access non-existent file "C:\POWERSHELL.EXE" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" trying to access non-existent file "C:\powershell.exe" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" trying to access non-existent file "C:\Windows\System32\POWERSHELL.EXE" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" trying to access non-existent file "C:\WINDOWS\system32\powershell.exe" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" trying to access non-existent file "C:\Windows\POWERSHELL.EXE" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" trying to access non-existent file "C:\WINDOWS\powershell.exe" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath_target_114250\POWERSHELL.EXE" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath\powershell.exe" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" trying to access non-existent file "C:\Windows\System32\wbem\POWERSHELL.EXE" "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" trying to access non-existent file "C:\WINDOWS\System32\Wbem\powershell.exe"40:Ta8d,"powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "Z:\" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.XAML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.xaml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSM1"41:Tb3d5,"GET /HCYQoVR.jpeg HTTP/1.1accept: */*host: i.imgur.com" "HTTP/1.1 200 OKConnection: keep-aliveContent-Length: 28864Content-Type: image/jpegLast-Modified: Mon, 30 Dec 2024 19:23:51 GMTETag: "70f83e99427ac54b92283eaecb69c5df"x-amz-server-side-encryption: AES256X-Amz-Cf-Pop: IAD89-P1X-Amz-Cf-Id: w1veLHWiaEcBL8caleHyCc4jlmIU2__N_q7NNoWzZBqTAalmsqn0vA==cache-control: public, max-age=31536000Accept-Ranges: bytesDate: Fri, 17 Jan 2025 11:54:09 GMTAge: 1479412X-Served-By: cache-iad-kjyo7100042-IAD, cache-sjc10035-SJCX-Cache: Miss from cloudfront, HIT, HITX-Cache-Hits: 103, 1X-Timer: S1737114850.940921,VS0,VE1Strict-Transport-Security: max-age=300Access-Control-Allow-Methods: GET, OPTIONSAccess-Control-Allow-Origin: *Server: cat factory 1.0X-Content-Type-Options: nosniff" "��C��C��"��I"2#B!R13Abr$C�4QSac%sD��5Tdq��?��ei3LY��GY�[�� mS)oU^Z"�R��m- ��T�JT�(W�U��Ct�5?�=�g�:�ͬ��*��25�eV�ɕ�b�ڞyi�:pm=�S�*V<�O��C��|�4ǧj�N�1oʭ?P��ȏ��j��s�*y��O�s��j<��PW��^�V-vk�.ǟ2K�"Dt%�J�]�U�x�*��j��]Zэc\YߛL�b��=*�Tv��d��e-��T�\��_W�x��\:�#v��S[�礬��#46'R�U�5��kѩ��q��e�rS�%)m-�J�W)R��q=��.��.��M�[��&B�q�>��m�8�y�.6�ri^?c��f��3dV�ZX�z�o%*�&C�n��{�J��J�: �ȇ��?��jn�q��y4�qܔ�<��^�7��^��n+g�V��r ̬��9Y�n�ˇK�V�Hy�b�ԡjy�o�L�␗��8��(��vG��ޥ"�5{z�yq�wM�SzT%�8��w�eƞ�b��o��qR�+��6��֏QU��.g5V��KG<#�\��d)��$v�ҧ��}K�Ǔ�iϦ��ϊ\��-��.�Z�n�/I}��nj��Ŧǎ�sd'%\{i�!��|U�/ۣbM�7>�.��\S�^q�_W��@��y�`�2ۏIV�)��Tڒ�%^&��J��Hɪ�wK�`f*��uxyw\�&tX��Jq�ĸq��R�1V)k��+t��GK�g�_hꗋ-��ժȧ�2Em��t�%̎��J\c��%�7�O�'� ��xm}�9Zuˍ{\z��9��U�g+/N�)�8*mS�:Xk?��q��iO��%@G�|��Eរ��p�M�ڔJ��g�5�� )_�#��m�I�0��ٸh 楿f=�6��S�5f��(q)?ܒ�zU��f��3��i�X^�z�=+�G��J��U�K�Pֆ�W�o*3�I��nk��^*e��A�"�ԬS��o)?��@�}h9��̓��#L��L�P��Re>��iL��W�R��{�%�ͼ��X@��i[�5|��)��SL)-��`�IR�mM�M�*RU��'c�=��*�c9�Lv{*��.�c/�^>,��?W"zu�>��j�f��56=�S��Vd� 7�ހ�W�rCIRT�9ی��s�)�T�'�i�**Y��\�Q��vd��qЕ)n"<�q��l�W��TVI�'IF�uI�^սOg�}�m�sԺv�92jc��\�T�ⷹ'��\x�<�ncL��{�g�͌�z<<�ؤ�F��Ĥ��N�>�baӽ��MC�:g��BE�}ܐ货�N��!ķ�}M�jK-��kRR�qJ��X��9:N�D�\Ʊr��T�K«}L��K�v-R"�KJ~t�%��c��}S�qJq)KjR��B�ǳ�y[2�q�H�ymVnim�^�F��N/Oe_�,S��y�E�2��)�lƩ�u�յ�A{ݴE��"��ćJU�2��w�qM�s�ߋ�ø�rk��r�iֵ��֥�7��l��U�įM�2��.|��.ڔ��ˏ�Iؽ1Z^ݖ�y^��n��*\::��jnq=R�>��JevЊ|w�L�i\��=ħ�*RK�׎h_Y�ev]��ܪ�3t��u�%a��*�T��NR��%{�.?��`},�]A��鸢9OM�[��U��B��nˊ�۞_�Om��\��r��MMn?{��g\WśR��[ykFX��p�%)��S%��%��/ˏ~i��v�I�s�kYygsIv?2�g8Ғ�%j�,��7�ۉ��o�M5[Z��6��:j��N7t��m�5��jg��vP��)RU�m��SI2��]�5�/pI�sh�5�{"�k=M�LrƜ�*��[��eIy��4�YmM�_{��J��!�)�m�ƙ�~��Р̬W��Ҷa�eO:��t��iV?/�BhcU��4d�2��wV��znx5��/N��o��8��<��t��a��8��I�Ī��2ΡX��5%̪9!Q��yלWrD�"�[�qJR��W��6�ˬ��O��n��E��W��[��iTiJ��Ry4��x�x��R��R�W@��Ze9��_[\�E�VS�W��պZ��?�C-�6�Ֆӵ�Z��ʼۜ�E�[T�:��e.�X-��o��<��KW��㻙�g��%xV,�^Ɛ��^%m��Z��M�:)��,�b��%N}JqJ�6�r��˪s.tϙ/¬��Lܗ�!�~osݥ�0��M��Y��AV�%��;[�c8��]��Q��D��i�2�X��G�"BW��N6�J��N<�Orn��6��6��;(ֽ�e{��n��Ve2S";6��)*q��ܫ�]�z[�Et�oiV��СV)�˦��q]��D��[�)KlqR��7�߿Dݕ]�4��U,�+��m�f��XnGqُIq�۟*Gc9GOm*q�9�M�*��57�*^�,��+��^ם^�B��XU܇O��=�R�&��\U�)õ��]�4qO�n��}C��j�iȳ��_~�ԩ)R�ʐ��%-��`��:?̜�쟲M��)զe&R�(�)��i5J׶��<��%/��%=�#��e��vyU��ɤT�wbn=�mE��:Jc�-��q��[��v֮��F�0��U۶�U��4u��%�JTV"7��8d�2��@R�ugR:�ϻN�fش�u��uE�ƙW�ۇ�{�V�n<��Iq-��R��7�Q��t��;��n�e.�_�6Ѻ�eQUEH�R�-��4Fԟ�9˗.%0:�Ԯ�:}7��E�A�^�-�5榩Lf�~A�n+vj�Sn��~=��*N.)ʥB��M�R\R�춵)J�Ŷ��ej�S�jҫ��rDɒ�S��yj��y)jV*R��.ˣ�5��:��S��O�H��[�J�!�R$MSm�u�)�I��IW�"��;�u�'U3��'*ꙋm�M݉�2�\j+>��I�˶�ܽ܏qˏ�\J�ty�g�~�33m�.�4��]Y�OE~�d�p*��J�ĉ��+��t��V|T��ۛVnC�>��X��:ű��]��:M�UP�ݸ��\m�8��Jy��%IO ��G_;hmM��if��>z�F�Yy�pU��D�[.%NH��m��_rl�%�� 7��u��J>og��SnU"ڳ/X��&T|��>��q1�n;��w��Kjm��\[*i�`-Rm�;%7ϫ2��5_��k�{��r�I��x��f4�ILy,�aOvU�J\yJRR�rif��6Ϯ�Gj�}N��N֩��;��;�Ai4Ħܚ+��D�7��µR��x��Ԙ�j��}�@�߃��n��'��8�n�zU��r�sV��A}��q鬹�1�>��D�p�|UJ�5�`��tݢ��]��h�逼)uˉ�j��J��2�^�S�$�%�2��ǔ(x{]t�h_T{WP��k潷Q�G�V�Ŷk�Ȑ��B~J[w��t�ɘ��qRU�x:v��-7cօW!��)6�Ɨ]�� ؕ��;�dG}��T�+��Im^� �'F�{t�{k�gҴ��K��ƉX�M�+�>��%%,��Ys˒��}.)�̪��5��ʻqu{��ŤЩ��)T�rKm7�^)�R��x��X�:F��~HS/-��(I��B�O��++��yN+��Jq*s�.�~)��}�E��Z9��:n��w-�gݒ��J�a�]~g�We��[m��K�\Bx�8%I�z��@d};[1d��9��B޷uذ(4��2tX�Ly�J�&4�v�q��N�]�/%Zy} ��A�^�C�E�uը6[4�$T�*�Y2��6e;��2�m=��Ƿ˓j*ֳ-K��)v=�J\�j��\&Ԝ"C�%��O/˒��Ժ-��s��oJ��)�«t�5��)k�M�!��{L�Yy~�Z��R�0�=�X��*J��:�֎Wiq�&`��{��UG��!>�Cjq*O&��J��Wı�-�4�VFe�ѐ��U{��]�]��cdX�T��n<�w�Г˒��]�� T�d}:{Kh�v��ܭ��bߴ:��B��m��j�(ʒʞu�j{�C��Q8��E|��,ä�<�M�-kVJ�C9�hV��>�J��j��)��4��kGѦ�w�Zo�r�qQ�İ�h�G]B��J7�.4�,�^��J��|T�y��s�>�7=sf��Up��Y��V��g��m��T�!��}�R��v�K}��Qg�F��0m��f��%�Ж�)�2�z]R*\��Ec��OFW�V�g��3��$��{+oil�0}8Ʃͧ��g��2%�a��IS,��}E$�^��BN��v�z��e�I��R��~\8+�ERyb��B{n2ӜqÓio�j�8��r`t��ĭA�Y��G�.�E�\U�eV��S˳|c�ۊN�Ԯ�jW�M�X��߭�=�>��ͿP�Ի�5��:E=0��b�qR�s��^Ie^��]jE�d�h۷�s1niӢ��H�"S�"��o��n%<�1�Ryv��oݥ�oG��ۭ]�%��J�tשo�Kj�"C�-�i츮)c�}�8�xd/H��3�n�+=cf�k�sv��me�UB�Nj�O�M��K��O��ӎ��{�ŵ'�#��tU��.m�e�8G��d.S�)<�L��B=6�'��*�/��N��lݻl�M!��K��uR�jUi��ߥ2��Ԟ*mi��|�q�ԟ��~�zG�I�q~e�v_wN`]Wnʒn0QMz#P^vK�Ff:^i]�m�y>��q�*+�HyW��l��,��V��p��We�Q�ŧ5K��!8K��e}��=�%NrÒS⯉�V��EsϨ��FD�0�1�yˑ��W%��|��Wm<�8%:�:�9�].�$�u-G��x��pJR��V8� ;I�SI��B߳�f�V*YY��/��q��bc.��9Pz|fي�Q��┥�S�^<�g�6I��VۺXzҞ��Ԥ]��}gu�D�J^d7�S�I�۳!ɏrq%�vԕ'�S��;|9��ӧ^��֢.�ne�1+�&V��J��>_��_��"r* ��mK�h��U�lR*8��ҥ��?��%+��@FN�-2[:2�>Y�֑�\�͙Ȳ]��Vvf�߄��Ga�_��K��.\Z��)�O��Ll�^^4zݵ�xt7��U�5�f��H�O�~��r�?ԯ�T.��K��6�*LcR��2-K�}��S��*�IK��s�q ��<��JQ_C*�ʈ��x�;Ҕ�?O��W�q�vg��P{�]�:�r1fe��91n[�dd�*o��1�>��*B��iKiq*R��Z��W�%�q��[.7��b[�0]v�M�mْix�\R�{P{죒��D��ڍ��6��/|m��n��I}��}_�OT��N��m�T�).��iJT�R��4�fҚB�"��g�#+��M[�5:�uc��o-ȩNy<�K�a>*�%\�ǒB#�_M��v��l�9�M�N�i�V빘�K�aTW�ڣ<�n��ýԷ��%Xt�]��:w��#f��[��NNc[lTB�/&��>㶯��D�S��44�a�Y6��F�m��g�Ki��M��g�=�8�)��R��i��Smm��R�OGW�p��Dq�=�M��#V$AeM��B��,�䶗�J�+m��5��;W%�/��9a��U�V��W�Q��J]�,�Yi�>)R��T�?��v�3sV��mi�"-+�e�RL*=9�}9+��m��W�[mJW�y��:��qKZ�굩^��_�/�C#�˛P9�:�=��Vm�E�Q�[��n��RS��'��)R��@g��]�*4%ƙ~�*`C��t�lT��'�S"\��rW��]U��1��摇m�m'��[��{ܤ��7�ۛ�V��ZJ~eO��:V�8ȝ> ��M�X%\Sܒ�|�5��%I�k��s�y{��K�2�ݣ��<Ҙ�N{Lp��=��V��MNh�[��?�F\��E.D8iv�p%�).��GJ��窛RRڰ�' n�ͧu��4Y�m�\�h��̪5tЮ}6��G��6��1R�F��~��^LޗNF��"׬ۙeP\iJ��f;<�jl7=��%�R��*RJ��:��r�d=��g��ȫ�:�4�)m��f��OKm�_%=!��?p{e��yk�<��+��S�A2)5�ywS�ӮW�*R�e�y+��cMW�qm\��M9=#Z��[.�έk]��\v%++m��Ef溪��m�.4�RڛJ��yJm�)IJS��V%�vi�;�ɚz]ۛ��:솛F5$�k�.BR��)�*�3��I��d��T��X��iT��s�R4y+[hv��a��+��Ǔ�sǐ��^��k*��E��8.z��_�gj��qݝs��Ie�ߌ�-��7�8��\�rͣzR/�fd�#U��uc�0P�-�V��T �*R&:��)�M��=��!��<|��D��sV��pjֽB�Э@�n��G�ҚyǤ��_�Y�H减'T��U��F��wY�6�J=B��ܿl�Tz��S��q�v��/�,�x��K��-?'-��r\��eARU�-��ۍ��ju��*��'�˟]�:yn-�u7��24_��dfF�F�z��f�"�%X0��2�Y��\q��{��|M�֣��=qev��W��z��T�8�SǏ� ӘW/�W��cCȝ��XW�fù*v\M=G��^_LSyI�A�uM��7";��I}]ľۍ��RT��Β��3F�q�6M�~�/�]��)t��ި�Fq�1�*\!%�R�Lx�n'��ȩ��ɴ�V7L�o+vbV�Č�Lb��n�-\T��yLrO�V9�-�T��X��w��Gp�e��{8��j��c�pO��)S��y��S$%�=��.?%rOȕ�*7�۬+Q[�gs��f^h��t��Ȍv�b6�ȱXk��gb�|��%��R��2ڇK�wI��V�պf��*_�T+Z�%�_��M�s��%~�)��?xHvvڽ<��H��R��e��)ky�6��N�^y�qJR�r�JJaU��[��4O��%��IM��j%�B��H�JKSLv�ԪL�U��׳�5��{gڝxf��R�K�)��Ғ��QaIJ�Jo��`sft=��r�<�?'�5��kS�ůͯfÒ��}ܽ�O��~\�bl#F�v��j��3�nɸ��)O��"C+�y-j�*W�)�@�z��v�{��n�;ZUH9�wIn�B�̽��LT)tqكS��fC��l6┖�m�=��J��ʍ$�O�:�ٺ'��r��ٛ��X�t�M��p֧y��r��T��)J��46��پz�ju�죵{�0�V(rUB�lEJ�)S��-��s��IՉ��o-7E�5>�w��[�Y�إJm��Qd5��N�5.qW�!��_�4�N�DB�J��.��L��G�H�*0�#�Q�ڢÏ�{�}�q�˗gǏ�x��K��ѝ�7'άʲڙB�u�ΨS�b��]�Z^�)��y�*Bx)>2o��*�h��݆��5�e5��n��]��*J��}��i��c��r��i[�F��H��Գ"=5hK1a��H�<0�D�'Ǌ[��@P��1�¬�\ĩƷ�T��jܶߘ�>��m��<��!*W.)OĽ^�ʹ�~�`벭��jY�lϭԘʊu�IZi��)h�2��T�y?�K��ߗ}J:��ٱ��ԵBX�6}٤��J�D�R��1ԡ�`�?)&��[�OXu�Ս�T\̢Ӧ֦H��J��e�)�"2�jo��ă��M��2�'p,��|ե�5?')��G+��ٸ�Ge �R0��Y��[g�rW��>�!�T��Qmٖ��I�7FyRr�b�n��"�V��N8�?.\��m9L�J,T`��2iT��N��aM;�q��i�J�ۜ�u��O *�!4)�=��3H�u�e_�l��z\��|�c�)-�P��=�=�M�ȩm�R��9ſ��[�}�\�^�`��&�[��5<9y7�Ynl}?�w/��h~��gg��L�Yp�1�VǮ8J�LmM��}�Y�%8��{��\�&�z�2�M9�1�[V�z˵��UorBj��+��_��J��H�}%s� ��r<�e��J�F�EDx�0T��U3R��H�W��)IJ��Sj��v�wt��8��'7��n�c�n�&�F�-��#��)X`��JU�Oܝ��w�9��X�MgK��{�j�z/�r�Ǚ��J��ң*��+�g�^�R�LʨW��'/��UJ�W��=��Kx+⤁��\j�rV/Jy7laJ�Ҕ㗝^�ӍE��m�$��w>�Y�Js��)R�ru��F��c�QtQ��0j��~�f�#�c�HSc�u�/�/8��$�L�(אּԆ�r��|�sgS�<֪,0�?�%�R��y)W�L��s��y�&�wͼ�ι�_��_�(��T�#�\v ��)�[B[Jx��U)J�-g��O}OWvGe-�T�� Vi�ʢ�H�"�.-��R��SoUJx��q��HY��>�[��EGi�]�+7��#)�q��u?s�f$N�)�qN}��N7�tGd\��a��T��Z��.J��_�I��햓��Fe�yg��X��aܶ�veo��ܹh�cK��q*��e*mX0�~*R�o��V�H�c6��Y�wge�m{5��xz�Īn��*��Ҥ��IJ\q��@}%6�sO��u�ILʊ4�r'�ؤK�E&"��%ڌ��q��q�ɞڻ~<��ɴ��m��PF]�u�W�V/9�*u��*ԶdI�+��{)�im86��8%%�uj�l=?P2��I��*�J}JЋiKZ)-T#��ox��y��pf^sf�z�]O��M�9X9�J\×WſN-�\R�L-v9�3��݋"ѧ��պNa�ju�<��UPq�b�{l�^�T��攧�I"�C\��Pym3��x-IO��}��e�晬��ݵ�E�R�6ԥ�h[�$Ummˣz:�NI^�H��Zl�Z��[�J��N3%�r��%��IRS�$��iJ\Wqļ�J��{�uh�9�%uh'm}=��[�ՕG�P��s��m�;�SjR�O��"�@��wRނv�ڶ��*3vna��ʻ��@�aLv�-�2��{��C}��s�߯(�;n��5�'Tz��.��*=�P�Q#ٴȒ�3P��\0{%ʎ��%*RU��)��J�0�`��m�?��7VZZf�6�N�j�s��Q�H��i�J��˒�(��Icy[��l��|\�܃Dw-�Z��E&�oRkT��>" "�{z��{hZ��]�%��Ǹ��iZ��DZ�ܣNY�L�Mb��-=U0�J�-m=�ҟK��m�Bm�b��qT�yI�,yq=n��2v̭�l��}��:�r�� [�{��&H䔡ɜ�q�7��ҧ�&S�9��y�@�|��T*�5r��K��D��8��>*�}��n��u��xcMVbK��F�iWu�W��^>=��.Hs�ɶx��I*[oN�=�43�ܴ��%�+7켿�D�_��jD�{�R��{�n�-^�o��Ǒ[��nۨM��͘�Pm�G��j|�=�|{��⒞��))�=�SˊR��)Jp��Y_ukw��.��B��k�F��vza��-J�R�q��y+�s��w��n��L��CLUס��T'ShYԚ�h��{�1S��iV>�ѵ'��\��\��؛^Za�_^�e�{�)�[N��fͥÕ2=NN��eH��W-RW��%�o��.X��Q�pf�t��>+��}^��BVs�:S��(m��O��M��R��)┤�˙�+|��v��_عѡ��K-uG��?/hK��y)�>L��e)e��W��9q�곶6��\��ŭQ�}ڕ��Ya0�Sxq�9#�Jo�>�+�S��Ԯq��*�5�[~�X�╏'�qJ�(�qm?�R�_�)O��އ{��3 �U�cg卮��6f��)R:[�Sޔ�⤧ǋ)R��9�^��ٔ�1L�k�i-��r_��;*q��+�Uz��$��}J�wot�*��X�ccW�C��VU90��{��p��qR�|z�'+��ͫ��)c��M�7��Ky��ۼm��LZ�)�^n[�\[Jm_��O��R�Muo��]ܰ�̹ɛc2��"ЭΨ_M\t�{2�)�l�NDK3C�6�e��)��y?��o]ԭ�=��T�N��{2�ku�N�"�4�o&G�|�)��JqJSǖ<�pJ�-�@�Z��ꁠ]�rC4�ٰ,�Vem�R�M~F��r,d�Reĸ�jm�c��$��(�vޗ%�v�h&�˛��LV[�Mb35�ɂ��CyQ�#��)�n��}�b�.+�e���uޙy��ӽW/�kn�f�s㴩0�U)�[i�_��c��`�Sž)��C}��}i�[�[�ۂ��+�R��"�A�)�%M�C9L��q)R\��F�ݏ��́�i+A�%SˋJ��]��EM�z��4e)��-��IJ[��=�7��6��_�\��YW�T]u�*4�;��S�Ի(gQ��m4ی��R\��/��H�{Va�e�jM�E�۞Ϡ�'SܐL�M��,Kx��Jm)䟖 �]�:�v��ov�o��:��Z�pT-�~��l��]�* ��H��mJS|��)䔤ѻ��om}�y�֬跭�ifS��b ��W�껒;2dGo��Ҿ\��~5x��n?��R��ڔ[�ͩ�#N�jP�ZdH��Gm0�<�#�m��T��8��C��#Ry��oK��5ImꝴշE�(NIo��R�ʓ��iJG/NJ��\�,�zm��Ct�g��ӝC,rr¸>S1��Kmb�b3�̴,��4�%�oE�DC�᳄�)��Kjs�)��<�R��R�N�=Q��\��ү�Ɨ@��]�&Jn:U��S�A}Uf�V��ʦ�Ƚe%�t^y�L�ù-̽��C��OMy��3.y{F�W��T�M͑�n�7��˫/��6�K~̠�Q��p��"�=#��]�R�8��*��U�Fo�N�2n�w�4��b�T*f7F��Ɏ�JB;,��c��⯵1 :uڳ@��O�W:��vS^�,,��ߵ*�՗T��q_�R�R��s�/L�sM7E�.{�J�hZ2�Ӡ@��#NL��^-�W�y}��7ǲ��}yyxՆhD� �5�*jsf��ۗS�8Iz��;�qJ~��x��x�x��=�ƾ ��Ӄ��bZ��t��U�6ژ�u�K\�6�!./�B��F��Ю��T�?�|��7}��jƦڔڳ/-�ܘҝ�Py��e�DF)�qs��?ry��ȩ��V�M=��KU��˗�L��Y�\��4�ػoZ�K��x�Wڧ�|�?rR⿓�A�v�كCۮg�`�Ӛyͫ�w��Y1�aG��r�+�f�]��0�}�NqS�}N)��􏚽2��Z��@hS,'��øp�lXu�YW��O�R��˸��$�6��F��E��3v��Lȹkzd�A��Cƿ�l��`�^��R��%)?�t�l��MkY��.�ŵ2�o��c�gU*V�ִ0�;��>��ju��/ R/v��l�%o�3ȩu\ ��j6��4V�T��}�)Jy )8��O�m�%]�6�l�_��'6��,!��EL%|{��ʇ$��(��s��5�d��~��Aӥ�RMa��/V�1n��ȗ�~�#<��5�Z�_jK0��U�?)nj�\X��b�sݐi�9K�ʙ*V�%ԧ�ӟM��\��Pt�d�+O�65��X_�mn��[�I��)��Ӕ�y�W�S��mV��1�_7$ˠXQ��~��}�L��->*y��R|[��ľ�&sk"�p��*��L,� R�H�?.\�T��%�ͳ��㜟y��JW"0tk��NY��W�6dZ��w�r��}�l��#��_%��N��-�/=��Z먻�R�J�(5�P��_�'��R��+��*s��*!�U�:f�XPuߣ��6�2�n�|ٴ�})�q��r=B3jW�o&�e�[ö��JJ[��*{�Q��k�� )�+��*�f]U�aJr��#�Y*W�Tt��q�R�ʔ��ڸ˞�aض��M�+�=uݗkw^��R�Ĥ�m��r��zC��Rc��@�:�tW�L��v}d^�2�Ը�~�I�tY�yL�+�"L~�nK��.%x��I��w�ܔۺ�oXA�K�3�Xn]�o�&V\�v��4c-��Q�q��F��=P7�;L>l�ԪE^��˚��t)�)�-AȪmx)=��a1ԟ��]��QNmijȘ̫#)2Ne.�*�u�+4�ԜO��_n:��?��?,@�mW�z�ދT9��l��'s�Q-��˴u�%��:b)�n�Q�2��⤴�#))O��v�57��dE�`�t��zt{уHn�23�L�Φ+-�qT��m�\��2ړ��E��-��v��°'�43�:�ʅ�>��\��y�_8�*ZRyx)��O�x�P{�>�,�VnՒy/��ߕt9Q�Ѫ��Y��C�9L�Ҽ]e^�)Sk�%\T�%JN=��C�i1~�u��fؕ1)Pr�,V��C)o��SK-��{u6��)8vҢ��-�%��_م��mp�L��X��U76�)��O8�Us#��d;G�k:�Kj��&6��Jm��_�)�@�Y�F��_3�%�v�m�//\�Ѩr��ty2c��ژJ\y~��]ⶒ�r��r�J�zy5��t��{݊;!��nE��w#�[��>�1��K�M��'��S��Vm*��?,�Sq�@�..�,�)N3�ڹ��.*��\H�^��W�x�kM6V��,��ǘ�R/�}�"=*2T�>�5B�2D9-��iy_��x��H��{�C��=�H�{5��:�$E��\�e�i*�� m�7ۚ��]6?Yao�z��E#1o�/u�jź��[JZrZ�� &�V)�ڕ϶�).q��*��ܯWf��a��7�C�ͺܚ��=�j��e8�j�/r4 ��iJR�x'�)֛�l鸖��@u�r��c*j�P2�5��-�`�L�}X)�p�MRb�N��=��n}�/-z[�h坽fH�w��dX0hu�M�Y}T�*e�㌥Im�y+䢺�w�r��W�E_��1�S�*̲PT&��GR�vt�S�\L~��B��RԮ��?:�sf��;/��*z�b��hV�9��JS��[W�Ys��O'[��W��˻��34�Ƞ�5�5�f��6�p�e�}��D�]�e0�_Q��]ĩX*�:�u"��9/�m~RX�Z󮚵5��vd�k�a�S�L9<~��,�~V�}/��˶��#��;��l��c��T�_��wdgEm\�ɪzf��n=R�sC0,(�:enDyŖ��Yu�Ҕ��[SjJ��rp�[�l�fV�洴!�k*%�5��}u�[��'&�l��O��vل��_��M�;�3 ��󞺢�P�Ni4�Z�SǏ��ÎL��q��q��T��nMjZ��r�uƔ�,jm�˪oZ�Mr��q��jZ\b��J�'ڟ�o�.��lgo�w� ��q�D�8��{��3�K��Y\b�g9%)N-��Ǹ��bJ�M��jm�T�&F龇��\[^��gM��Rඔ��Cr��.!Q��*��~=(j�g��[32��W;�X��,��x}7��=;��QJ;�f�J�_�7d�*tyw)W��9Q�ռ�\�:^��D�;��mJzC�J]J��%%A]�^=77V�37oj��3;f?G�н�ʽ�N��o�>u?Pq�N��m)�Oqq�9%jy<|TruѲ�\��f�߳&e%��w��F�RҜ�T�c2tH��w>��?� WF��.�9��}�z��z5��._Qb��0��_��R3�Nq��3*R��i��ڥFf�w�맓Kt�X9N�+��bE�jŸk7$�ӂ��$)jLH�7��JR��8��ӕ�-��֖T̳n��,��+"�qFCS��"+�6��R��\V''��R��BP�fm縖��}��俬�Yj�Dj܄��K�9:C�\��#.1츼��VRx��֎�{T�Ŷ��۷"��vН\��řBf��;��T�g#�jO&\N*J��J��:ᛅ��Ov.j\��Vn[΁��j}�U\��><�k�Ks\�ڜVJUǑ�&��:]��fe�Q�%[�qe�bva�p�2�m�8��%ĩ>��4�)*m�2��IKn\��/n��J��m��^�M�N˘7]^+��c�˫��9%]��J\B�iJ��tRöQ�vgO��;�s��qc��R}?�FM%쓯-D�^:�ծL�TL��3��yN��ܑ��*U.==�r�m�m˷��e�R�q)l�U��OH{^yk��H��(�-�G��j+�7݃��)JR��[J��Hq�&�vm��8��EK�U��)qjx��$W��[��O�h>�)�>��V��n%Im^)O�S�g^��fZ�>��0�fO��.��.��c��36o/_ҟ�Xf�9ݸ6C�!9˶.Lڙ�wS��;T�+��sU2��^�;��YS��R[�M��\R��9��|҅v�v�g*h�T��"�*yGήb��mI��^N3��JR��6�8ߊ�V.�8U��f��r��dS�2܅��W�e��y�%��ǏeiS��O$��%ϻp]b�9�^�/}Cj~ۍ�9OK�z��N��;mHS��1w��6��<[,�i�zNht��+q)W-c$k��r��)i0�g9�W��R�n)X��@F�܃��&��V�jz$��:d�)�[��ٔ��-�ڦ)>��R��mXy%�7KN��Y��&b�C/�:��2�ܽlؕT۰��D�Ycݡ��&g�m\q��<��h��w.�L�΍��e�`6�nk��d6�<�v�a�*Jf�y��o�w9)��:2�ش��lD�{��1.g\�w#�O)�+��_�)��Y��ۊVsYW�U�mO:�t�r�c��jA��Tc�+��*RS�|�S�:�?�?��Ўtt�W�o��%�sU��ۼ�w��%�/Ǝ��?}�|z�x�9��Ƚs�2n��Zە+��J�V�|�J��u��JV'P{?�n��c�8��תqt�Qe<ڱj<��)�8�?�K+��|@��({Ii�22��[)iݶ�M�h�=6��)��W:�S�+�2R�\RR��..(�{$eN�7>�ު��/�O۳h�S�\ʪ?�S,�PS�R¢�(��}��+��!��),��:��`��dl��)�+��f�Sm��Z��Ǘzs�[jR��\M��G��d��qsS�L�'0�J��(k�jDu&��Ԥ��8��_~�] nh��/M"طf��O�=�e]6�oY�f-�0R��*Ry8�+��7�F�V-ڼ�]^;o�Է*;�e�%�Ԥ��*�NLPe:�m��&О�L+�bS&��<��'�J�ϝB�V��R��څ�ʥ�uV��ԫ5��ڔ��Ŧ��iJ�8�)O�a?��V�:j�-��Uʴ"��:��n��E G��ZyjMI ��)W�k�*Oċ[m��u]�FQm��TJ��isy�"�q�v%2�{��%9��\1��FP��+x]Yn�wڗF� �t��]:Dj˧ɋ�$8�?!I�"C�y��(W�,��S�D��Xo��FSe�aw��rkuK։>L�S��(TI�Ӄi�<�*J��⼈��P�^�5'x�7�Ӛ�/z��5Fi8�VT��)e��KhBR��Z��>JQ��{nM۵��P��[0�5K�)+��W/yJ�-)R[q�y%M��_�i��JR|Io��a{�fu�*׶i�UbȒ�(�rѴ�*c?ԏ2SiW�{eU7V�u舘�66�t�c�m�R]I�t�Z+�%��B�7[qHJ��rJT�%I�D��n��3��Q�_��֧�WU2�2�h��Gj��2��I�vs�**�i)q�\g��T�+��NM��9Ond��2�-hԻj��f�E��${w��N��#��)W/��6��_ܗn��U�yڔ~i��T�) �x�Q�v$��S\��)qNp�)��ט��t��/Y��S�2.��/�=�mԱb��Mv�cT��9�;�)ǜR��~�sk^ym��gU��mBE��P~%?��fY�ۍ��x�� ȅ`�>�yݹn��~�-�e�Ӕ�00�[��F�72&R�$8�R�)jW��q�>�&kRȾ��Y�.�s�\�:�q�>C�<�-�R��Sk�6�%\��z��e;�ѭ6-��i��n��PL�Ն�RX�7+�YJ?�_��׮��%�U7�U˅4��q�Nf+`��η��NM+}�z��<��K��r�t�M�Zð.�b��M��D�.M-��;;d~M�JW�ˏ.)�JR��o�W�#�a��wf-��'0W.�"�:�K�ڤ��ۍ�D��JW�N��wv{*ʇi�m|��E��Β��q1'G��IO��:��n��nȷ��qU�V�ץDL:U3�JŨ��+�Ǹ�s��.$pE�v�Z�ڎ��ݺ]�(�A��6��k��J�T;|�.��m�8�q|TۉW�rO�,.��]�.�ӵsBE��Ș��8�Eʄ��SH��mnvҗ��'�%jJx�hUn��v�wo�+_35#fYTY��m6=�M��q��eJ��/��J��E�R;��'i�F��9�A�GDj�C�*E6*��ĕ�N��'\R��{q��w��/��Y�t[tk/�7.M�e�}�IO��&�uǜzB��ܮ<��F�;�k�jzUJ�ӵ�E�Z�Y�E�{S��MnW�)`�̼ÊJx��R��*RR�À��K��q�rBV�s��۲꒣�Z�Y��~ �m�R��Hq)K͡Ϧ��?��|Of��[�=wo�v��YGL�?٫62j�Q5D��T��/)��+�J��x��ٙ�Rj�ltǧ��0\��5��u��!JK*q��`�)��q�>X�7l��Z��;]y��u��DS�� V`�IW��Lfp�䶞\y*�v�އS�B.�sMYy�u�o��\z��N��&�쥟m2??Ļ��&ދ]ۨ�M��n��ƶ��{�U�j@T:S2}�p�)�y�*�)S�9�*W<��5��{��Նk�q3��K��"�o�Zg'�'��R�JQ��ef�{e��j5�A�S��(h0ağNDz�#��R�m�%JmS$��`�%\yy��m��q?C�TM>sRUN��ƕ�ZU�y)RT��Ǌ��'*��yn7ԅ��4��s��+~ڑ[�S��E�Ɠ)Q�)�T��).qJR�L��*��}`��͓.ж��_Ș�mU�2ԕ�Z��|�M�^�wo�~�R�"�j��~��N�|�%��*�?qJ��&��{�>�w�s˹˗/#�Z��gvj6_E��[�ER�XU�P�f{�J};�%�ɏ��W�)O/��b�qU�\��ʝ:K�&�}^�uū��V?�JV8�| ��"42:T1097d,Pattern match: "ftk.yg/*r_" Pattern match: "ovh.en/d{kdcuspc?c4b$o8c*yr" Pattern match: "ru2.rauo/k4$fno*`/wg" Pattern match: "y3v.nr/mcguznr/mp]zfa^3}az" Pattern match: "r.uq/7#q^-ntx$z_c4hn5_b-}akqblx._zvi_,t|s" Pattern match: "v.ix/@^]a,l$-ed:e.i\{f:n+sa7_smk.i;wq]a{-,n+ou:k!cjrq*n++~_6h$-(kynvkv=xyn2!cyz_5u$-sq*a~*{)^n+ynfy4]g" Pattern match: "lgh65zg7glgh6.zhm/*}7{lgh6.zh7~ll73l6hsauwf;da73lqm?78d" Pattern match: "qxbatz.sv/i/wc&frb:tk.nm\" Pattern match: "www.yeb6bp*b7rr's'l`raf^?2tfk%2_y&~&{l8iq'$,{1?cfs*cve-o-e8u\-4zc$*ovpabj8z{bwz^^z+e3v+jl7[\,*sb" Pattern match: "qs04nm.ea/?9,6*z^d`ddl" Pattern match: "https://getsession.org/" Heuristic match: "i.imgur.com" Heuristic match: "get /hcyqovr.jpeg http/1.1accept: */*host: i.imgur.com" Heuristic match: "/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\sync\mpmc\zero.rs" Heuristic match: "/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\sync\mpmc\waker.rs" Heuristic match: "/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\sync\mpmc\context.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\image-0.24.9\src\codecs\webp\vp8.rs" Heuristic match: "unexpected huffman codeassertion failed: ncomp <= max_componentsc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\jpeg-decoder-0.3.1\src\decoder\lossless.rs" Heuristic match: "/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\io\mod.rs" Pattern match: "self.buf.init/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\core\src\io\borrowed_buf.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\flate2-1.0.35\src\bufreader.rs" Heuristic match: "c/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\core\src\slice\iter.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\image-0.24.9\src\image.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\image-0.24.9\src\codecs\bmp\decoder.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\image-0.24.9\src\codecs\tga\decoder.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\image-0.24.9\src\codecs\farbfeld.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tiff-0.9.1\src\decoder\mod.rs" Heuristic match: "internal error: entered unreachable codec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tiff-0.9.1\src\decoder\ifd.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\image-0.24.9\src\codecs\webp\lossless.rs" Heuristic match: "too new file feature flagsfile feature flagsfile versions other than 2.0 are not supportedinternal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\sync\mpmc\mod.rs" Heuristic match: "image does not contain non-deep rgb channelsc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\image-0.24.9\src\codecs\openexr.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\image-0.24.9\src\codecs\tiff.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\image-0.24.9\src\codecs\jpeg\decoder.rs" Heuristic match: "cannot sample empty rangec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\rand-0.8.5\src\rng.rs" Heuristic match: "/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\slice.rs" Heuristic match: "/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\collections\btree\navigate.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\body\to_bytes.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\bytes-1.9.0\src\bytes.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\reqwest-0.11.27\src\async_impl\response.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\reqwest-0.11.27\src\lib.rs" Heuristic match: "src/main.rs" Pattern match: "i.imgur.com/hcyqovr.jpeg" Heuristic match: "no layer in the image matched your specified requirementsc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\exr-1.73.0\src\image\read\layers.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\exr-1.73.0\src\image\read\specific_channels.rs" Heuristic match: "invalid headersc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\exr-1.73.0\src\image\read\image.rs" Heuristic match: "/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\sync\mpmc\array.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\half-2.4.1\src\slice.rs" Heuristic match: "rayon_num_threadsrayon_rs_num_cpusc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\rayon-core-1.12.1\src\registry.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\exr-1.73.0\src\io.rs" Heuristic match: "internal error: entered unreachable codec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\png-0.17.16\src\decoder\read_decoder.rs" Heuristic match: "/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\sync\mpmc\list.rs" Heuristic match: "imagedataimagedataflushedpartialchunkimageendc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\rayon-core-1.12.1\src\latch.rs" Heuristic match: "cannot skip more bytes than existc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\png-0.17.16\src\decoder\mod.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\image-0.24.9\src\codecs\pnm\decoder.rs" Heuristic match: "/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\core\src\str\mod.rs" Heuristic match: "blackandwhiteblackandwhite_alphagrayscalegrayscale_alphargbrgb_alphac:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\image-0.24.9\src\buffer.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\image-0.24.9\src\codecs\gif.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\image-0.24.9\src\codecs\png.rs" Heuristic match: "errc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\image-0.24.9\src\codecs\webp\decoder.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\jpeg-decoder-0.3.1\src\worker\mod.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tiff-0.9.1\src\decoder\image.rs" Heuristic match: "attempt to join into collection with len > usize::max/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\str.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\scheduler\multi_thread\mod.rs" Heuristic match: "integer overflow when calculating buffer sizec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.21.7\src\engine\mod.rs" Pattern match: "path.src/main.rs" Heuristic match: "readme-.md" Pattern match: "https://www.coinbase.com/" Heuristic match: "- funkiydk7c6j3vvck5zk2giml2u746fa5irwalw2kjem6tvofji7rwid.onion" Heuristic match: "- funknqn44slwmgwgnewne6bintbooauwkaupik4yrlgtycew3ergraid.onion" Heuristic match: "- funkxxkovrk7ctnggbjnthdajav4ggex53k6m2x3esjwlxrkb3qiztid.onion" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\orion-0.17.7\src\high_level\hltypes.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\exr-1.73.0\src\block\reader.rsc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\jpeg-decoder-0.3.1\src\decoder.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\jpeg-decoder-0.3.1\src\decoder\lossless.rs" Heuristic match: "ioerrorrecverrorusize overflow when calculating b64 lengthc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.21.7\src\encode.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-channel-0.3.31\src\mpsc\mod.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\gif-0.13.1\src\reader\mod.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tiff-0.9.1\src\decoder\stream.rsc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\client\dispatch.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\sync\oneshot.rs" Heuristic match: "cannot access a thread local storage value during or after destruction/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\local.rs" Heuristic match: "failed to park threadc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\scheduler\multi_thread\mod.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\scheduler\current_thread\mod.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\bytemuck-1.21.0\src\internal.rs" Pattern match: "be.com/xap/1.0/" Pattern match: "http://ns.adobe" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\scheduler\multi_thread\queue.rs" Heuristic match: "assertion failed: marker.has_length()c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\jpeg-decoder-0.3.1\src\parser.rs" Heuristic match: "limitsmax_image_widthmax_image_heightmax_alloc_non_exhaustivec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\image-0.24.9\src\codecs\dxt.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\sync\mpsc\list.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\png-0.17.16\src\decoder\mod.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\image-0.24.9\src\codecs\ico\decoder.rs" Heuristic match: "expand 32-byte kc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\orion-0.17.7\src\hazardous\stream\chacha20.rs" Heuristic match: "called `result::unwrap()` on an `err` valuec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\orion-0.17.7\src\hazardous\stream\xchacha20.rs" Heuristic match: "unknowncryptoerrorc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\orion-0.17.7\src\util\endianness.rs" Heuristic match: "called `result::unwrap()` on an `err` valuec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\orion-0.17.7\src\hazardous\aead\chacha20poly1305.rsc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\orion-0.17.7\src\haz" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\orion-0.17.7\src\hazardous\mac\poly1305.rs" Heuristic match: "called `result::unwrap()` on an `err` valuec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\orion-0.17.7\src\hazardous\mac\poly1305.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\orion-0.17.7\src\hazardous\hash\blake2\mod.rs" Heuristic match: "fieldset corrupted (this is a bug)c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\proto\connection.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\proto\h2\client.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\client\dispatch.rs" Heuristic match: "assertion failed: self.inner.semaphore.is_idle()c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\sync\mpsc\chan.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\sync\mpsc\unbounded.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\task\core.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\proto\streams\buffer.rs" Heuristic match: "()/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\core\src\ops\function.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\http-0.2.12\src\header\map.rs" Heuristic match: "/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\vec\mod.rs" Heuristic match: "fieldset corrupted (this is a bug)c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\proto\h1\decode.rs" Heuristic match: "authority implies hostc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\client\client.rs" Heuristic match: "eofc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\url-2.5.4\src/lib.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\reqwest-0.11.27\src\async_impl\client.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\reqwest-0.11.27\src\async_impl\request.rs" Heuristic match: "a display implementation returned an error unexpectedly/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\string.rs" Heuristic match: "/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\core\src\str\pattern.rs" Heuristic match: "errorassertion failed: buf.len() <= u32::max as usize/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\sys\pal\windows\io.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\util\linked_list.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\url-2.5.4\src/lib.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\once_cell-1.20.2\src/lib.rs" Heuristic match: "base64 is always valid headervaluec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\reqwest-0.11.27\src\util.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-tls-0.5.0\src\client.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\io\read_buf.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-util-0.7.13\src\util\poll_buf.rs" Heuristic match: "tryflatten polled after completionc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-util-0.3.31\src\future\try_future\try_flatten.rs" Heuristic match: "assertion failed: dst.remaining_mut() >= lenc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\frame\data.rs" Heuristic match: "description() is deprecated; use displayinternal error: entered unreachable codeassertion failed: buf.len() <= u32::max as usize/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\sys\pal\windows\io.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\context\current.rs" Heuristic match: "streamdependencydependency_idweightis_exclusiveforcehttpsbuturinothttpsc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\common\lazy.rs" Heuristic match: "runtime dropped the dispatch taskuser code panickedconnection closedcannot poll select twicec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-util-0.3.31\src\future\select.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\reqwest-0.11.27\src\connect.rs" Heuristic match: "internal error: entered unreachable codec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-util-0.3.31\src\future\future\map.rs" Heuristic match: "fieldset corrupted (this is a bug)c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\proto\streams\prioritize.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\proto\h2\mod.rsc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\client\pool.rs" Heuristic match: "assertion failed: (*tail).value.is_none()c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-channel-0.3.31\src\mpsc\queue.rs" Heuristic match: "fieldset corrupted (this is a bug)c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\frame\window_update.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\frame\ping.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\proto\streams\streams.rs" Heuristic match: "pingackpayloadassertion failed: buf.len() <= u32::max as usize/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\sys\pal\windows\io.rs" Heuristic match: "assertion failed: self.has_capacity()c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\codec\framed_write.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\proto\streams\send.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\proto\streams\store.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\client\conn.rs" Heuristic match: "not droppedc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\client\pool.rs" Heuristic match: "polled after completec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\client\dispatch.rs" Heuristic match: "fieldset corrupted (this is a bug)c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\frame\reset.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\frame\go_away.rs" Heuristic match: "invalid rst_stream framec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\proto\streams\recv.rs" Heuristic match: "assertion failed: stream.state.is_closed()c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\proto\streams\streams.rs" Heuristic match: "invalid ping framec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\proto\ping_pong.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\client\pool.rs" Heuristic match: "ready polled after completionc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-util-0.3.31\src\future\ready.rs" Heuristic match: "/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\sync.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\util\sharded_list.rs" Heuristic match: "uri should have a schemec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\reqwest-0.11.27\src\proxy.rs" Heuristic match: "fieldset corrupted (this is a bug)c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\proto\h2\mod.rs" Heuristic match: "flatten polled after completionc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-util-0.3.31\src\future\future\flatten.rs" Heuristic match: "assertion failed: default_max_frame_size as usize <= val && val <= max_max_frame_size as usizec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\codec\framed_read.rs" Heuristic match: "assertion failed: self.remote.is_none()c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\proto\settings.rs" Heuristic match: "assertion failed: val <= frame::max_max_frame_size as usizec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\codec\framed_write.rs" Heuristic match: "assertion failed: size <= proto::max_window_sizec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\client.rs" Heuristic match: "invaliduric:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\proto\h2\client.rs" Heuristic match: "alpn upgraded to http/2c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\client\client.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\common\exec.rs" Heuristic match: "windowready polled after completionc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-util-0.3.31\src\future\ready.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\service\oneshot.rs" Heuristic match: "/c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\http-0.2.12\src\uri\path.rs" Heuristic match: "future polled after completionc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-native-tls-0.3.1\src\lib.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\client\connect\http.rs" Heuristic match: "invalid goaway framec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\proto\go_away.rs" Heuristic match: "fieldset corrupted (this is a bug)c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\proto\streams\send.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\client.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\client\client.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\client\connect\dns.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\net\tcp\stream.rs" Heuristic match: "noteofc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\io\read_buf.rs" Heuristic match: "out of bounds access/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\collections\vec_deque\mod.rs" Heuristic match: "assertion failed: buf.len() <= u32::max as usize/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\sys\pal\windows\io.rs" Heuristic match: "fieldset corrupted (this is a bug)c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\proto\h1\conn.rs" Heuristic match: "continuebodykeepaliveclosedoutputslicetoosmallwriter must be presentc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.21.7\src\write\encoder.rs" Heuristic match: "poisonerrorc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\proto\h1\encode.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\bytes-1.9.0\src\buf\chain.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\io\poll_evented.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\io\util\write_all.rs" Heuristic match: "fieldset corrupted (this is a bug)c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\proto\h1\dispatch.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\proto\h1\io.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\bytes-1.9.0\src\bytes_mut.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\common\buf.rs" Heuristic match: "unable to find any user-specified roots in the final cert chainbytes remaining on streampolling streamfuture twicec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-util-0.3.31\src\stream\stream\into_future.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-native-tls-0.3.1\src\lib.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\proto\streams\prioritize.rs" Heuristic match: "iofieldset corrupted (this is a bug)c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\proto\h1\encode.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\net\tcp\socket.rs" Heuristic match: "usize overflow when calculating buffer sizec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.21.7\src\engine\mod.rs" Heuristic match: "https required but uri was not httpsc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.21.7\src\encode.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.21.7\src\engine\general_purpose\mod.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\ipnet-2.10.1\src\parser.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\schannel-0.1.27\src\alpn_list.rs" Heuristic match: "description() is deprecated; use displayc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\http-0.2.12\src\header\value.rs" Heuristic match: "eofstartsizesizelwsextensionsizelfbodybodycrbodylftrailertrailerlfendcrendlfendknownunknowninvalid url, scheme is not httpinvalid url, scheme is missinginvalid url, host is missingfieldset corrupted (this is a bug)c:\users\abdellah\.cargo\registry\src\inde" Heuristic match: "event c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\proto\h2\client.rs:448hyper::proto::h2::clientc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\proto\h2\client.rs" Heuristic match: "event c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\proto\h1\decode.rs:446hyper::proto::h1::decodec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\proto\h1\decode.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\body\body.rs" Heuristic match: "invaliduripartszero capacity should never failc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\http-0.2.12\src\header\map.rs" Heuristic match: "fieldset corrupted (this is a bug)c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\client\client.rs" Heuristic match: "somec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\proto\h1\role.rs" Heuristic match: "called `result::unwrap()` on an `err` valueuserlibraryremotetimedoutc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\proto\h2\ping.rs" Heuristic match: "tostrerror_privready polled after completionc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-util-0.3.31\src\future\ready.rs" Heuristic match: "keep-alivec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\proto\h2\mod.rs" Heuristic match: "chunkedoriginal header value plus ascii is validc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\headers.rs" Heuristic match: "chunk_size_max_bytes should fit any usizec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\proto\h1\encode.rs" Heuristic match: "()fieldset corrupted (this is a bug)c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\body\length.rs" Heuristic match: "ioc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\sync\oneshot.rs" Heuristic match: "event c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\proto\h1\dispatch.rs:649hyper::proto::h1::dispatchc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\proto\h1\dispatch.rs" Heuristic match: "[internal exception] blocking task ran twice.c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\task.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\want-0.3.1\src\lib.rs" Heuristic match: "~c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\httparse-1.9.5\src/lib.rs" Heuristic match: "fieldset corrupted (this is a bug)c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\proto\settings.rs" Heuristic match: "assertion failed: self.can_inc_num_local_error_resets()c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\proto\streams\counts.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\proto\streams\flow_control.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\proto\streams\recv.rs" Heuristic match: "invalid initial receive windowc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\proto\streams\stream.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\frame\head.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\frame\stream_id.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\proto\go_away.rs" Heuristic match: "invalid initial window sizec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\proto\streams\prioritize.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\codec\framed_write.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\http-0.2.12\src\uri\path.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\proto\ping_pong.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\proto\connection.rs" Heuristic match: "error/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\vec\mod.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\indexmap-2.7.0\src\map\core.rs" Heuristic match: "fieldset corrupted (this is a bug)c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\frame\headers.rs" Heuristic match: "/internal error: entered unreachable codec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\http-0.2.12\src\uri\scheme.rs" Heuristic match: "1001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841" Heuristic match: "trailersc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\proto\streams\send.rs" Heuristic match: "assertion failed: default_max_frame_size <= val && val <= max_max_frame_sizec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\frame\settings.rs" Heuristic match: "ackassertion failed: max <= std::u32::max as usizec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\client.rs" Heuristic match: "reset_at must be set if in queuec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\proto\streams\recv.rs" Heuristic match: "assertion failed: self.ids.insert(id, index).is_none()c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\proto\streams\store.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\http-0.2.12\src\uri\authority.rs" Heuristic match: "poisonerrorout of bounds accessc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\hpack\table.rs" Heuristic match: "inactive streamunexpected frame typepayload too bigrejectedrelease capacity too bigstream id overflowedmalformed headersrequest uri missing scheme and authoritypoll_reset after send_response is illegalsend_ping before received previous pongsending settings" Heuristic match: "fieldset corrupted (this is a bug)c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\proto\streams\state.rs" Heuristic match: "errinvalid initial remote window sizec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\proto\streams\recv.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\codec\framed_read.rs" Heuristic match: "fieldset corrupted (this is a bug)c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\hpack\decoder.rs" Heuristic match: "//index.htmlhttphttpsgzip, deflatetrailersc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\frame\headers.rs" Heuristic match: "assertion failed: cnt <= self.limitc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\bytes-1.9.0\src\buf\limit.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\indexmap-2.7.0\src\map\core\entry.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\hpack\huffman\mod.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hashbrown-0.15.2\src\raw\mod.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-util-0.7.13\src\codec\length_delimited.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tracing-core-0.1.33\src\dispatcher.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tracing-core-0.1.33\src\callsite.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\once_cell-1.20.2\src\imp_std.rs" Heuristic match: "a tokio 1.x context was found, but io is disabled. call `enable_io` on the runtime builder to enable io.a tokio 1.x context was found, but timers are disabled. call `enable_time` on the runtime builder to enable timers.c:\users\abdellah\.cargo\registry\src" Heuristic match: "assertion failed: next.is_notified()c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\task\state.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\util\wake_list.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\time\entry.rs" Heuristic match: "internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\mod.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\time\wheel\level.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\time\wheel\mod.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\sync\notify.rs" Heuristic match: "/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\core\src\sync\atomic.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\context.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\scheduler\defer.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\scheduler\multi_thread\worker.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\scheduler\mod.rs" Heuristic match: "assertion failed: shared.shutdown_tx.is_some()c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\pool.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\io\registration.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\scheduler\multi_thread\park.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\handle.rs" Heuristic match: "rng seed generator is internally corruptc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\util\rand\rt.rs" Heuristic match: "filled overflowc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\io\poll_evented.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\io\driver.rs" Heuristic match: "a tokio 1.x context was found, but it is being shutdown.assertion failed: shards > 0c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\time\mod.rs" Heuristic match: "idc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\scheduler\multi_thread\worker.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\time\sleep.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\loom\std\mod.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\task\list.rs" Heuristic match: "assertion failed: sharded_size.is_power_of_two()c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\util\sharded_list.rs" Heuristic match: "/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\sync\once.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\socket2-0.5.8\src\sys\windows.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\mio-1.0.3\src\sys\windows\selector.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\mio-1.0.3\src\sys\windows\iocp.rs" Heuristic match: "called `result::unwrap()` on an `err` valuec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\mio-1.0.3\src\sys\windows\mod.rs" Heuristic match: "called `result::unwrap()` on an `err` valueout of bounds access/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\collections\vec_deque\mod.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\parking_lot_core-0.9.10\src\parking_lot.rs" Heuristic match: "rwlock reader count overflowc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\parking_lot-0.12.3\src\raw_rwlock.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\parking_lot-0.12.3\src\condvar.rs" Heuristic match: "allocerrlayoutc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\smallvec-1.13.2\src\lib.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\parking_lot_core-0.9.10\src\thread_parker\windows\mod.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\log-0.4.22\src\__private_api.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-core-0.3.31\src\task\__internal\atomic_waker.rs" Heuristic match: "/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\string.rs" Heuristic match: "called `result::unwrap()` on an `err` valueerror/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\vec\mod.rs" Heuristic match: "assertion failed: self.is_char_boundary(idx)/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\string.rs" Heuristic match: "httphttpswswssftpfilec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\url-2.5.4\src\parser.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\url-2.5.4\src\host.rs" Heuristic match: "assertion failed: self.is_char_boundary(n)/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\string.rs" Heuristic match: "layoutsizealignc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\idna-1.0.3\src\punycode.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\icu_normalizer-1.5.0\src\lib.rs" Heuristic match: "assertion failed: code_point < self.header.high_start && self.header.high_start > small_limitc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\icu_collections-1.5.0\src\codepointtrie\cptrie.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\http-0.2.12\src\header\value.rs" Heuristic match: "sensitiveinvalidheadervaluefailed to parse header value/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\core\src\str\pattern.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\http-0.2.12\src\uri\mod.rs" Heuristic match: "internal error: entered unreachable codec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\http-0.2.12\src\uri\scheme.rs" Heuristic match: "/zero capacity should never failc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\http-0.2.12\src\header\map.rs" Heuristic match: "invalidstatuscodeinvalid status codehttp/0.9http/1.0http/1.1http/2.0http/3.0internal error: entered unreachable codec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\http-0.2.12\src\version.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\bytes-1.9.0\src/lib.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\png-0.17.16\src\encoder.rs" Heuristic match: "tryfrominterrorc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\image-0.24.9\src\codecs\webp\encoder.rs" Heuristic match: "alpha chunk doesn't match the size of the frameimage is too large to be decodedframe is too large and would go outside the imagec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\image-0.24.9\src\codecs\webp\extended.rs" Heuristic match: "error building huffman treeerror while reading bitstreamerror while reading or writing transformsc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\image-0.24.9\src\codecs\webp\lossless.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\image-0.24.9\src\codecs\webp\lossless_transform.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\image-0.24.9\src\codecs\webp\transform.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\fdeflate-0.3.7\src\compress.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\image-0.24.9\src\codecs\dxt.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\image-0.24.9\src\codecs\webp\loop_filter.rs" Heuristic match: "ninvalid inferred headerc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\exr-1.73.0\src\image\write\layers.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\image-0.24.9\src\codecs\tga\encoder.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tiff-0.9.1\src\encoder\mod.rs" Heuristic match: "assertion failed: !outbuf.is_empty()c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\weezl-0.1.8\src\encode.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\exr-1.73.0\src\math.rs" Heuristic match: "badzlibheaderinsufficientinputinvalidblocktypeinvaliduncompressedblocklengthinvalidhlitinvalidhdistinvalidcodelengthrepeatbadcodelengthhuffmantreebadliterallengthhuffmantreebaddistancehuffmantreeinvalidliterallengthcodeinvaliddistancecodeinputstartswithrun" Heuristic match: "a channel has not been put into channel listc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\exr-1.73.0\src\image\write\channels.rs" Heuristic match: "usize exceeds i32 rangec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\exr-1.73.0\src\meta\header.rs" Heuristic match: "versionmaxsamplesperpixelchunkcountchannelscompressionlineorderdisplaywindowpixelaspectratioscreenwindowcenterscreenwindowwidthnamewhiteluminanceadoptedneutralrenderingtransformlookmodtransformxdensityownercommentscapdateutcoffsetlongitudelatitudealtitudef" Heuristic match: "inferred header errorc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\exr-1.73.0\src\image\write\layers.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\image-0.24.9\src\utils\mod.rs" Heuristic match: "window attribute dimension valuewindow size exceeding integer maximumblock layer index bugc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\exr-1.73.0\src\block\mod.rs" Heuristic match: "(usize as i32) overflowedc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\exr-1.73.0\src\error.rs" Heuristic match: "some chunks are not written yetpeeked chunk index is missingc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\exr-1.73.0\src\block\writer.rs" Heuristic match: "frame.buffer is too small for its width/heightc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\gif-0.13.1\src\encoder.rs" Heuristic match: "internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\io\impls.rs" Heuristic match: "called `result::unwrap()` on an `err` valueinvalidcode/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\collections\btree\map\entry.rs" Heuristic match: "too large chunk indexc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\image-0.24.9\src\codecs\webp\huffman.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\smallvec-1.13.2\src\lib.rs" Heuristic match: "scanlineimagetiledimagedeepscanlinedeeptileblock layer index bugc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\exr-1.73.0\src\block\mod.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\exr-1.73.0\src\block\chunk.rs" Heuristic match: "tryfrominterrorc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\rayon-core-1.12.1\src\latch.rs" Heuristic match: "/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\vec\spec_from_iter_nested.rs" Heuristic match: "/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\sys\pal\windows\io.rs" Pattern match: "iter.rs/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\vec\mod.rs" Heuristic match: "corrupt deflate streamc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\flate2-1.0.35\src\zio.rs" Heuristic match: "calculated bmp header size larger than 2^32c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\image-0.24.9\src\codecs\bmp\encoder.rs" Heuristic match: "write zeroc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tiff-0.9.1\src\encoder\compression\packbits.rs" Heuristic match: "internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\sync\mpmc\mod.rs" Heuristic match: "internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\sync\mpmc\zero.rs" Heuristic match: "/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\collections\btree\map\entry.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\exr-1.73.0\src\image\write\channels.rs" Heuristic match: "tile coordinate bugc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\exr-1.73.0\src\block\mod.rs" Heuristic match: "internal error: entered unreachable codec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\qoi-0.4.1\src\utils.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\image-0.24.9\src\codecs\pnm\encoder.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\image-0.24.9\src\codecs\webp\encoder.rs" Heuristic match: "0123456789abcdefbadzlibheaderinsufficientinputinvalidblocktypeinvaliduncompressedblocklengthinvalidhlitinvalidhdistinvalidcodelengthrepeatbadcodelengthhuffmantreebadliterallengthhuffmantreebaddistancehuffmantreeinvalidliterallengthcodeinvaliddistancecodein" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\png-0.17.16\src\common.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\png-0.17.16\src\decoder\transform.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\png-0.17.16\src\adam7.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\png-0.17.16\src\filter.rs" Heuristic match: "utf8errorvalid_up_toerror_lenunreachablec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\png-0.17.16\src\text_metadata.rs" Heuristic match: "nonesomeno more forward progress made in stream decoding.c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\png-0.17.16\src\decoder\zlib.rs" Heuristic match: "caller should verifyc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\png-0.17.16\src\decoder\transform\palette.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\fdeflate-0.3.7\src\decompress.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\fdeflate-0.3.7\src\huffman.rs" Heuristic match: "tryfrominterrorvector x coordinate too largec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\exr-1.73.0\src\math.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\exr-1.73.0\src\meta\mod.rs" Heuristic match: "exr::text contains unsupported charactersc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\exr-1.73.0\src\meta\attribute.rs" Heuristic match: "tryfrominterror(usize as i32) overflowedc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\exr-1.73.0\src\error.rs" Heuristic match: "block indexblock size calculation bugc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\exr-1.73.0\src\meta\header.rs" Heuristic match: "data block tile index(usize as i32) overflowedc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\exr-1.73.0\src\error.rs" Heuristic match: "assertion failed: self.supports_deep_data()c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\exr-1.73.0\src\compression\mod.rs" Heuristic match: "zlib-compressed data malformed/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\vec\mod.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\exr-1.73.0\src\compression\pxr24.rs" Heuristic match: "zlib-compressed data malformedtoo much datanot enough datac:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\exr-1.73.0\src\compression\mod.rs" Heuristic match: "tryfrominterrorinvalid sizec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\exr-1.73.0\src\compression\piz\wavelet.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\exr-1.73.0\src\compression\piz\mod.rs(usize as i32) overflowedc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\exr-1.73.0\src\error.rs" Heuristic match: "data amountc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\exr-1.73.0\src\compression\rle.rs" Heuristic match: "compressed datac:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\exr-1.73.0\src\compression\mod.rscannot access a thread local storage value during or after destruction/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thr" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\exr-1.73.0\src\compression\b44\mod.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\exr-1.73.0\src\compression\mod.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\zune-inflate-0.2.54\src\utils.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\zune-inflate-0.2.54\src\bitstream.rs" Heuristic match: "odd-sized bufferc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\gif-0.13.1\src\reader\converter.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\gif-0.13.1\src\common.rs" Heuristic match: "/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\core\src\slice\iter.rs" Heuristic match: "ac:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\color_quant-1.1.0\src\lib.rs" Heuristic match: "tryfromsliceerrorc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tiff-0.9.1\src\decoder\ifd.rs" Heuristic match: "?c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tiff-0.9.1\src\decoder\mod.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\flate2-1.0.35\src\mem.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\flate2-1.0.35\src\zio.rs" Heuristic match: "/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\core\src\slice\index.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\miniz_oxide-0.8.2\src\deflate\stream.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\miniz_oxide-0.8.2\src\inflate\stream.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\miniz_oxide-0.8.2\src\deflate\core.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\miniz_oxide-0.8.2\src\inflate\core.rsc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\miniz_oxide-0.8.2\src\inflate\output_buffer.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\weezl-0.1.8\src\decode.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\weezl-0.1.8\src\lib.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\jpeg-decoder-0.3.1\src\decoder.rs" Heuristic match: "invalid dimensionsc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\jpeg-decoder-0.3.1\src\parser.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\jpeg-decoder-0.3.1\src\upsampler.rs" Heuristic match: "recverrorc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\jpeg-decoder-0.3.1\src\worker\immediate.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\jpeg-decoder-0.3.1\src\worker\multithreaded.rs" Heuristic match: "senderrorc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\jpeg-decoder-0.3.1\src\arch\ssse3.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\jpeg-decoder-0.3.1\src\worker\rayon.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\crossbeam-epoch-0.9.18\src\internal.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\rayon-core-1.12.1\src\scope\mod.rs" Heuristic match: "internal error: entered unreachable codec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\rayon-core-1.12.1\src\job.rs" Heuristic match: "assertion failed: injected && !worker_thread.is_null()c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\rayon-core-1.12.1\src\registry.rs" Heuristic match: "called `result::unwrap()` on an `err` valuec:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\rayon-core-1.12.1\src\latch.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\jpeg-decoder-0.3.1\src\idct.rs" Heuristic match: "called `result::unwrap()` on an `err` valueinternal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\sync\mpmc\array.rs" Heuristic match: "called `result::unwrap()` on an `err` value/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\sync\mpmc\zero.rs" Heuristic match: "assertion failed: n_threads <= threads_maxc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\rayon-core-1.12.1\src\sleep\mod.rs" Heuristic match: "the global thread pool has not been initialized.c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\rayon-core-1.12.1\src\registry.rs" Heuristic match: "poisonerrorc:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\rayon-core-1.12.1\src\registry.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\crossbeam-deque-0.8.6\src\deque.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\crossbeam-epoch-0.9.18\src\atomic.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\crossbeam-epoch-0.9.18\src\sync\list.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\crossbeam-epoch-0.9.18\src\sync\once_lock.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\rand-0.8.5\src\rngs\thread.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\rand_chacha-0.3.1\src\guts.rs" Heuristic match: "c:\users\abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\rand_core-0.6.4\src\os.rs" Pattern match: "https://docs.rs/getrandom#nodejs-es-module-support" Heuristic match: "/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\core\src\time.rs" Heuristic match: "assertion failed: self.is_char_boundary(new_len)/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\string.rs" Heuristic match: "std\src\rt.rs" Heuristic match: "std\src\thread\current.rs" Heuristic match: "rust_backtracestd\src\env.rs" Heuristic match: "std\src\io\buffered\bufwriter.rs" Heuristic match: "std\src\io\buffered\linewritershim.rs" Heuristic match: "std\src\io\stdio.rs" Heuristic match: "stdoutstderrstd\src\io\mod.rs" Heuristic match: "std\src\path.rs" Heuristic match: "std\src\sync\once.rs" Heuristic match: "lock count overflow in reentrant mutexstd\src\sync\reentrant_lock.rs" Heuristic match: "overflow when adding duration to instantstd\src\time.rs" Heuristic match: "pathstd\src\sys_common\process.rs" Heuristic match: "std\src\sys_common\mod.rs" Heuristic match: "std\src\alloc.rs" Heuristic match: "std\src\..\..\backtrace\src\symbolize\mod.rs" Heuristic match: "std\src\..\..\backtrace\src\dbghelp.rs" Heuristic match: "std\src\sys\pal\windows\net.rs" Heuristic match: "std\src\sys\pal\windows\os.rs" Heuristic match: "std\src\sys\pal\windows\pipe.rs" Heuristic match: "std\src\sys\pal\windows\process.rs" Heuristic match: "std\src\sys\pal\windows\stdio.rs" Heuristic match: "std\src\sys\pal\windows\thread.rs" Heuristic match: "std\src\sys\pal\windows\time.rs" Heuristic match: "std\src\sys\path\windows.rs" Heuristic match: "std\src\sys\sync\rwlock\futex.rs" Heuristic match: "std\src\sys\thread_local\destructors\list.rs" Heuristic match: "assertion failed: len >= mem::size_of::()std\src\sys_common\net.rs" Heuristic match: "panic_unwind\src\seh.rs" Heuristic match: "/rust/deps\rustc-demangle-0.1.24\src\legacy.rs" Heuristic match: "/rust/deps\rustc-demangle-0.1.24\src\v0.rs" Heuristic match: ".llvm./rust/deps\rustc-demangle-0.1.24\src/lib.rs" Heuristic match: "/rust/deps\hashbrown-0.15.0\src\raw\mod.rs" Heuristic match: "alloc\src\raw_vec.rs" Heuristic match: "alloc\src\ffi\c_str.rs" Heuristic match: "a formatting trait implementation returned an error when the underlying stream did notalloc\src\fmt.rs" Heuristic match: "alloc\src\sync.rs" Heuristic match: "accore\src\num\dec2flt\decimal.rs" Heuristic match: "core\src\num\dec2flt\parse.rs" Heuristic match: "cannot parse float from empty stringinvalid float literalassertion failed: edelta >= 0core\src\num\diy_float.rs" Heuristic match: "core\src\num\flt2dec\strategy\grisu.rs" Heuristic match: "core\src\num\flt2dec\mod.rs" Heuristic match: "core\src\char\methods.rs" Heuristic match: "core\src\net\ip_addr.rs" Heuristic match: "core\src\net\display_buffer.rs" Heuristic match: "core\src\net\parser.rs" Heuristic match: "core\src\net\socket_addr.rs" Heuristic match: "]core\src\fmt\num.rs" Heuristic match: "0000000000000000000000000000000000000000000000000000000000000000core\src\fmt\mod.rs" Heuristic match: "core\src\slice\memchr.rs" Heuristic match: "core\src\slice\sort\shared\smallsort.rs" Heuristic match: "core\src\str\pattern.rs" Heuristic match: "core\src\str\mod.rs" Heuristic match: "core\src\unicode\printable.rs" Heuristic match: "core\src\unicode\unicode_data.rs" Heuristic match: "vtablecore\src\num\bignum.rs" Heuristic match: "wcore\src\num\mod.rs" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "ipv4.imgur.map.fastly.net" Heuristic match: "ntrust.net" Heuristic match: "readme~1.md" Heuristic match: "readme-t0yhcghkwk.md" Pattern match: "https://i.imgur.com/hcyqovr.jpeg8" Pattern match: "https://i.imgur.com/hcyqovr.jpego" Heuristic match: "ghkwk.md" Heuristic match: "*.imgur.com" Heuristic match: "imgur.com" Pattern match: "http://oneocsp.microsoft.com/ocsp0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://www.microsoft.com0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Heuristic match: "verisign.cg" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Pattern match: "www.microsoft.com/pki/certs/miccertr" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings"43:T7ce,Found string "GET /HCYQoVR.jpeg HTTP/1.1accept: */*host: i.imgur.com" (Indicator: "HTTP/1.1"; File: "SSL") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL") Found string "CONNECT is not allowed for HTTP/1.0" (Indicator: "HTTP/1.0"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found string "CONNECT : HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found string "HTTP/1.1 100 Continue" (Indicator: "HTTP/1.1"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found string "HTTP/1.1 CONNECT request stripping path:" (Indicator: "HTTP/1.1"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found string "request with HTTP2 version coerced to HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found string "HTTP/1.0 cannot have Transfer-Encoding header" (Indicator: "HTTP/1.0"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") file/memory contains long string with (Indicator: "HTTP/1.1"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found string "InvalidStatusCodeinvalid status codeHTTP/0.9HTTP/1.0HTTP/1.1HTTP/2.0HTTP/3.0internal error: entered unreachable codeC:\Users\Abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\http-0.2.12\src\version.rs" (Indicator: "HTTP/1.1"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found string "InvalidStatusCodeinvalid status codeHTTP/0.9HTTP/1.0HTTP/1.1HTTP/2.0HTTP/3.0internal error: entered unreachable codeC:\Users\Abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\http-0.2.12\src\version.rs" (Indicator: "HTTP/1.0"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00004140.00000001.126945.1EA10000.00000004.mdmp, 00000000-00004140.00000002.128865.1EA10000.00000004.mdmp")44:Tb7f,"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" called "FindFirstFileW" with parameter C:\* (UID: 00000000-00004140) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" called "FindNextFileW" with parameter $Recycle.Bin (UID: 00000000-00004140) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" called "FindFirstFileW" with parameter C:\$Recycle.Bin\* (UID: 00000000-00004140) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004140) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" called "FindNextFileW" with parameter S-1-5-18 (UID: 00000000-00004140) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" called "FindFirstFileW" with parameter C:\$Recycle.Bin\S-1-5-18\* (UID: 00000000-00004140) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" called "FindNextFileW" with parameter desktop.ini (UID: 00000000-00004140) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" called "FindNextFileW" with parameter S-1-5-21-735145574-3570218355-1207367261-1001 (UID: 00000000-00004140) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" called "FindFirstFileW" with parameter C:\$Recycle.Bin\S-1-5-21-735145574-3570218355-1207367261-1001\* (UID: 00000000-00004140) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" called "FindNextFileW" with parameter $WINDOWS.~BT (UID: 00000000-00004140) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" called "FindFirstFileW" with parameter C:\$WINDOWS.~BT\* (UID: 00000000-00004140) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" called "FindNextFileW" with parameter DUDownload (UID: 00000000-00004140) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" called "FindFirstFileW" with parameter C:\$WINDOWS.~BT\DUDownload\* (UID: 00000000-00004140) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" called "FindNextFileW" with parameter Setup (UID: 00000000-00004140) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" called "FindFirstFileW" with parameter C:\$WINDOWS.~BT\DUDownload\Setup\* (UID: 00000000-00004140) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" called "FindNextFileW" with parameter acmigration.dll (UID: 00000000-00004140) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" called "FindNextFileW" with parameter appraiser.sdb (UID: 00000000-00004140) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" called "FindNextFileW" with parameter diagtrack.dll (UID: 00000000-00004140) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" called "FindNextFileW" with parameter mediasetupuimgr.dll (UID: 00000000-00004140)45:T135c,file/memory contains long string with (Indicator: "aes"; File: "dismprov.dll.funksec") file/memory contains long string with (Indicator: "aes"; File: "SSL") file/memory contains long string with (Indicator: "aes256"; File: "SSL") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found string "integer overflow when calculating buffer sizeC:\Users\Abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.21.7\src\engine\mod.rs" (Indicator: "base64"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found string "IoErrorRecvErrorusize overflow when calculating b64 lengthC:\Users\Abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.21.7\src\encode.rs" (Indicator: "base64"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found string "expand 32-byte kC:\Users\Abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\orion-0.17.7\src\hazardous\stream\chacha20.rs" (Indicator: "chacha"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found string "called `Result::unwrap()` on an `Err` valueC:\Users\Abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\orion-0.17.7\src\hazardous\stream\xchacha20.rs" (Indicator: "chacha"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") file/memory contains long string with (Indicator: "chacha"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found string "base64 is always valid HeaderValueC:\Users\Abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\reqwest-0.11.27\src\util.rs" (Indicator: "base64"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found string "ContinueBodyKeepAliveClosedOutputSliceTooSmallWriter must be presentC:\Users\Abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.21.7\src\write\encoder.rs" (Indicator: "base64"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found string "WindowUpdatesize_incrementerror_codeStreamIdusize overflow when calculating b64 lengthC:\Users\Abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.21.7\src\encode.rs6" (Indicator: "base64"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found string "usize overflow when calculating buffer sizeC:\Users\Abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.21.7\src\engine\mod.rs" (Indicator: "base64"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found string "https required but URI was not httpsC:\Users\Abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.21.7\src\encode.rs" (Indicator: "base64"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found string "C:\Users\Abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.21.7\src\engine\general_purpose\mod.rs" (Indicator: "base64"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found string "C:\Users\Abdellah\.cargo\registry\src\index.crates.io-6f17d22bba15001f\rand_chacha-0.3.1\src\guts.rs" (Indicator: "chacha"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found string "OFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004140.00000001.126945.1EA10000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00004140.00000001.126945.1EA10000.00000004.mdmp, 00000000-00004140.00000002.128865.1EA10000.00000004.mdmp")46:T508,Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API "48973680244,6188,3117,,FindNextFileW,kernel32.dll,"00:32:49.093",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00004140.00000001.126945.1EA10000.00000004.mdmp") Found reference to API "32480164678,6188,3117,,FindNextFileW,kernel32.dll,"00:32:42.218",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00004140.00000001.126945.1EA10000.00000004.mdmp") Found reference to API "145789656486,6188,3117,,FindNextFileW,kernel32.dll,"00:33:29.437",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00004140.00000002.128865.1EA10000.00000004.mdmp")47:T812,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp")48:T44c,Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API "RegGetValueW" (Indicator: "RegGetValue"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp")49:T6b6,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00003068.00000000.125401.F08DA000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp")4a:T774,Found string "\Device\Afd\Mio" (Indicator: "\Device\"; File: "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d") Found string "\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Indicator: "\Device\"; Source: "00000000-00001476.00000000.125407.FF6E0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Indicator: "\Device\"; Source: "00000000-00002796.00000000.125407.0CFE0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Indicator: "\Device\"; Source: "00000000-00003068.00000000.125401.C6640000.00000004.mdmp") Found string "\Device\Afd\Mio" (Indicator: "\Device\"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found string "Failed to open \Device\Afd\Mio: @" (Indicator: "\Device\"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004140.00000000.125023.1EA10000.00000004.mdmp, 00000000-00004140.00000001.126945.1EA10000.00000004.mdmp, 00000000-00004140.00000002.128865.1EA10000.00000004.mdmp") Found string "\Device\HarddiskVolume2\20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Indicator: "\Device\"; Source: "00000000-00004140.00000000.125023.1EA10000.00000004.mdmp, 00000000-00004140.00000001.126945.1EA10000.00000004.mdmp, 00000000-00004140.00000002.128865.1EA10000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00004140.00000001.126945.1EA10000.00000004.mdmp, 00000000-00004140.00000002.128865.1EA10000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Indicator: "\Device\"; Source: "00000000-00008120.00000000.125402.AAA40000.00000004.mdmp")4b:Tcde,"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")4c:T46c,Found string "Set-MpPreference -DisableRealtimeMonitoring $true" (Indicator: "Set-MpPreference"; File: "AMSI") file/memory contains long string with (Indicator: "Set-StrictMode"; File: "AMSI") file/memory contains long string with (Indicator: "Set-MpPreference"; File: "AMSI") Found string "{ Set-StrictMode -Version 1; $_.OriginInfo }" (Indicator: "Set-StrictMode"; File: "AMSI") Found string "Set-MpPreference -DisableRealtimeMonitoring $truewevtutil sl Security /e:falsewevtutil sl Application /e:falsevboxserviceqemuhypervvmwaretasklist/fiIMAGENAME eq" (Indicator: "Set-MpPreference"; Source: "00000000-00004140.00000000.125023.06D8F000.00000002.mdmp") Found string ""powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"" (Indicator: "Set-MpPreference"; Source: "00000000-00008120.00000000.125402.AAA40000.00000004.mdmp") Found string "Set-MpPreference -DisableRealtimeMonitoring $true" (Indicator: "Set-MpPreference"; Source: "00000000-00008120.00000000.125402.AAA40000.00000004.mdmp, 00000000-00008120.00000000.125402.AAD20000.00000004.mdmp, 00000000-00008120.00000000.125402.AC420000.00000004.mdmp")4d:T1657,"mediasetupuimgr.dll.funksec" has type "data"- Location: [C:\$WINDOWS.~BT\DUDownload\Setup\mediasetupuimgr.dll.funksec]- [targetUID: 00000000-00004140] "e4S32jfhg4.exe" has type "PE32+ executable (console) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\e4S32jfhg4.exe]- [targetUID: 00000000-00004140] "migcore.dll.funksec" has type "data"- [targetUID: 00000000-00004140] "setupplatform.dll.funksec" has type "data"- [targetUID: N/A] "mediasetupuimgr.dll.funksec" has type "data"- [targetUID: 00000000-00004140] "migcore.dll.funksec" has type "data"- Location: [C:\$WINDOWS.~BT\DUDownload\Setup\migcore.dll.funksec]- [targetUID: 00000000-00004140] "winsetup.dll.funksec" has type "data"- [targetUID: N/A] "compatResources.dll.funksec" has type "OpenPGP Public Key"- [targetUID: N/A] "setupcore.dll.funksec" has type "data"- Location: [C:\$WINDOWS.~BT\DUDownload\Setup\setupcore.dll.funksec]- [targetUID: 00000000-00004140] "setupcore.dll.funksec" has type "data"- [targetUID: 00000000-00004140] "UpdateSetupUIMgr.dll.funksec" has type "data"- [targetUID: N/A] "appraiser.dll.funksec" has type "data"- [targetUID: N/A] "diagtrack.dll.funksec" has type "data"- Location: [C:\$WINDOWS.~BT\DUDownload\Setup\diagtrack.dll.funksec]- [targetUID: 00000000-00004140] "diagtrack.dll.funksec" has type "data"- [targetUID: 00000000-00004140] "windlp.dll.funksec" has type "data"- [targetUID: N/A] "wpx.dll.funksec" has type "data"- [targetUID: N/A] "migstore.dll.funksec" has type "data"- [targetUID: N/A] "unbcl.dll.funksec" has type "big endian ispell 3.0 hash file"- [targetUID: N/A] "reagent.dll.funksec" has type "data"- Location: [C:\$WINDOWS.~BT\DUDownload\Setup\reagent.dll.funksec]- [targetUID: 00000000-00004140] "reagent.dll.funksec" has type "data"- [targetUID: 00000000-00004140] "dismapi.dll.funksec" has type "data"- [targetUID: N/A] "wdsimage.dll.funksec" has type "data"- [targetUID: N/A] "setupmgr.dll.funksec" has type "data"- Location: [C:\$WINDOWS.~BT\DUDownload\Setup\setupmgr.dll.funksec]- [targetUID: 00000000-00004140] "setupmgr.dll.funksec" has type "data"- [targetUID: 00000000-00004140] "generaltel.dll.funksec" has type "data"- [targetUID: N/A] "aeinv.dll.funksec" has type "data"- [targetUID: N/A] "wdstptc.dll.funksec" has type "data"- [targetUID: N/A] "csiagent.dll.funksec" has type "data"- [targetUID: N/A] "wimprovider.dll.funksec" has type "data"- [targetUID: N/A] "devinv.dll.funksec" has type "data"- [targetUID: N/A] "vhdprovider.dll.funksec" has type "data"- [targetUID: N/A] "dismcore.dll.funksec" has type "data"- [targetUID: N/A] "acres.dll.funksec" has type "data"- [targetUID: N/A] "setupcompat.dll.funksec" has type "data"- [targetUID: N/A] "acmigration.dll.funksec" has type "data"- [targetUID: 00000000-00004140] "acmigration.dll.funksec" has type "data"- Location: [C:\$WINDOWS.~BT\DUDownload\Setup\acmigration.dll.funksec]- [targetUID: 00000000-00004140] "wdsclientapi.dll.funksec" has type "data"- [targetUID: N/A] "wdsutil.dll.funksec" has type "OpenPGP Public Key"- [targetUID: N/A] "Mitigation.dll.funksec" has type "data"- [targetUID: N/A] "dismprov.dll.funksec" has type "data"- [targetUID: N/A] "wdscore.dll.funksec" has type "data"- [targetUID: N/A] "unattend.dll.funksec" has type "data"- [targetUID: N/A] "imagingprovider.dll.funksec" has type "data"- [targetUID: N/A] "cmi2migxml.dll.funksec" has type "data"- [targetUID: N/A] "dismcoreps.dll.funksec" has type "data"- [targetUID: N/A] "compatprovider.dll.funksec" has type "data"- [targetUID: N/A] "compatctrl.dll.funksec" has type "data"- [targetUID: N/A] "DU.dll.funksec" has type "data"- [targetUID: N/A] "logprovider.dll.funksec" has type "COM executable for DOS"- [targetUID: N/A] "AppraiserRes.dll.funksec" has type "data"- [targetUID: N/A] "folderprovider.dll.funksec" has type "data"- [targetUID: N/A] "wdscsl.dll.funksec" has type "data"- [targetUID: N/A] "AppCompatServicing.dll.funksec" has type "DOS executable (COM 0x8C-variant)"- [targetUID: N/A] "reportgen.dll.funksec" has type "data"- [targetUID: N/A] "Diager.dll.funksec" has type "data"- [targetUID: N/A] "api-ms-win-downlevel-kernel32-l1-1-0.dll.funksec" has type "data"- [targetUID: N/A] "migres.dll.funksec" has type "data"- [targetUID: N/A] "api-ms-win-downlevel-advapi32-l1-1-1.dll.funksec" has type "data"- [targetUID: N/A] "api-ms-win-downlevel-advapi32-l1-1-0.dll.funksec" has type "data"- [targetUID: N/A] "api-ms-win-downlevel-shlwapi-l1-1-1.dll.funksec" has type "data"- [targetUID: N/A] "api-ms-win-downlevel-shlwapi-l1-1-0.dll.funksec" has type "OpenPGP Public Key"- [targetUID: N/A] "api-ms-win-downlevel-kernel32-l2-1-0.dll.funksec" has type "OpenPGP Public Key"- [targetUID: N/A] "api-ms-win-downlevel-advapi32-l2-1-1.dll.funksec" has type "data"- [targetUID: N/A] "api-ms-win-downlevel-ole32-l1-1-1.dll.funksec" has type "data"- [targetUID: N/A] "api-ms-win-downlevel-ole32-l1-1-0.dll.funksec" has type "data"- [targetUID: N/A] "api-ms-win-core-apiquery-l1-1-0.dll.funksec" has type "data"- [targetUID: N/A] "api-ms-win-downlevel-user32-l1-1-0.dll.funksec" has type "data"- [targetUID: N/A] "api-ms-win-downlevel-user32-l1-1-1.dll.funksec" has type "data"- [targetUID: N/A] "api-ms-win-downlevel-advapi32-l2-1-0.dll.funksec" has type "data"- [targetUID: N/A] "api-ms-win-downlevel-advapi32-l3-1-0.dll.funksec" has type "data"- [targetUID: N/A] "api-ms-win-downlevel-version-l1-1-0.dll.funksec" has type "data"- [targetUID: N/A] "api-ms-win-downlevel-advapi32-l4-1-0.dll.funksec" has type "data"- [targetUID: N/A] "ext-ms-win-advapi32-encryptedfile-l1-1-0.dll.funksec" has type "little endian ispell hash file (?) and 13202 string characters"- [targetUID: N/A]4e:T5e1,"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" marked "C:\$Recycle.Bin\S-1-5-18\desktop.ini" for deletion "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" marked "C:\$Recycle.Bin\S-1-5-21-735145574-3570218355-1207367261-1001\desktop.ini" for deletion "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" marked "C:\$WINDOWS.~BT\DUDownload\Setup\acmigration.dll" for deletion "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" marked "C:\$WINDOWS.~BT\DUDownload\Setup\diagtrack.dll" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_3j0e1dcu.sbr.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_mgxwgknp.50w.psm1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_xan2f30h.q3c.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_2emr2fa4.laq.psm1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_s4kspp5i.13m.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_vit1mxrx.a3w.psm1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_xeifkgky.c4k.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_4xean0dr.bp3.psm1" for deletion4f:T753,"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" opened "C:\$Recycle.Bin\S-1-5-18\desktop.ini" with delete access "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" opened "C:\$Recycle.Bin\S-1-5-21-735145574-3570218355-1207367261-1001\desktop.ini" with delete access "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" opened "C:\$WINDOWS.~BT\DUDownload\Setup\acmigration.dll" with delete access "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" opened "C:\$WINDOWS.~BT\DUDownload\Setup\diagtrack.dll" with delete access "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" opened "C:\$WINDOWS.~BT\DUDownload\Setup\mediasetupuimgr.dll" with delete access "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" opened "C:\$WINDOWS.~BT\DUDownload\Setup\migcore.dll" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_3j0e1dcu.sbr.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_mgxwgknp.50w.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_xan2f30h.q3c.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_2emr2fa4.laq.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_s4kspp5i.13m.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_vit1mxrx.a3w.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_xeifkgky.c4k.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_4xean0dr.bp3.psm1" with delete access50:T10a7,"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")51:T8c4,"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\net.exe" (Handle: 576) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\net.exe" (Handle: 576) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 560) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 560) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 552) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 552) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 572) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 572) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 556) "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 556) "powershell.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\wevtutil.exe" (Handle: 1968) "powershell.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\wevtutil.exe" (Handle: 1968) "powershell.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\wevtutil.exe" (Handle: 2020) "powershell.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\wevtutil.exe" (Handle: 2020)52:T42c,Spawned process "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe" (UID: 00000000-00004140) Spawned process "net.exe" with commandline ""net" session" (UID: 00000000-00002192) Spawned process "net1.exe" with commandline "%WINDIR%\\system32\\net1 session" (UID: 00000000-00000392) Spawned process "powershell.exe" with commandline ""powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"" (UID: 00000000-00008120) Spawned process "powershell.exe" with commandline ""powershell" -Command "wevtutil sl Security /e:false"" (UID: 00000000-00003068) Spawned process "powershell.exe" with commandline ""powershell" -Command "wevtutil sl Application /e:false"" (UID: 00000000-00001476) Spawned process "powershell.exe" with commandline ""powershell" -Command "Set-ExecutionPolicy Bypass -Scope Process -Force"" (UID: 00000000-00002796) Spawned process "wevtutil.exe" with commandline "sl Application /e:false" (UID: 00000000-00007860) Spawned process "wevtutil.exe" with commandline "sl Security /e:false" (UID: 00000000-00003732)1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791200586539,"unified_at":"2026-10-05T11:43:06.539Z","metadata":{"hashes":{"sha256":"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d","sha1":"aa8e0f879f1b6a0d83d2657e86cca4b66d8235cf","md5":"c8dd54784fb1b6cbd16cec060487fb8f","sha512":"8237a7b7142ec7155f66a8e02de2913f17139eb0f80235376e93cd3b7dbd60f3e48d427cc5f54575b2dcbd83868407d7d534f775ff8eec6b37cee5eaefac9765","ssdeep":"49152:1Ew0dMICHvoBWdKD27GidOx1Sjq+WSGeDfT2bjYqCFhkFDGgvDYldWxjvbbISmEj:7cSqGcF7lZ2uGUj","ssdeep_chunks":["49152:1Ew0dMI","49152:Ew0dMIC","49152:w0dMICH","49152:0dMICHv","49152:dMICHvo","49152:MICHvoB","49152:ICHvoBW","49152:CHvoBWd","49152:HvoBWdK","49152:voBWdKD","49152:oBWdKD2","49152:BWdKD27","49152:WdKD27G","49152:dKD27Gi","49152:KD27Gid","49152:D27GidO","49152:27GidOx","49152:7GidOx1","49152:GidOx1S","49152:idOx1Sj","49152:dOx1Sjq","49152:Ox1Sjq+","49152:x1Sjq+W","49152:1Sjq+WS","49152:Sjq+WSG","49152:jq+WSGe","49152:q+WSGeD","49152:+WSGeDf","49152:WSGeDfT","49152:SGeDfT2","49152:GeDfT2b","49152:eDfT2bj","49152:DfT2bjY","49152:fT2bjYq","49152:T2bjYqC","49152:2bjYqCF","49152:bjYqCFh","49152:jYqCFhk","49152:YqCFhkF","49152:qCFhkFD","49152:CFhkFDG","49152:FhkFDGg","49152:hkFDGgv","49152:kFDGgvD","49152:FDGgvDY","49152:DGgvDYl","49152:GgvDYld","49152:gvDYldW","49152:vDYldWx","49152:DYldWxj","49152:YldWxjv","49152:ldWxjvb","49152:dWxjvbb","49152:WxjvbbI","49152:xjvbbIS","49152:jvbbISm","49152:vbbISmE","49152:bbISmEj","98304:1Ew0dMI","98304:Ew0dMIC","98304:w0dMICH","98304:0dMICHv","98304:dMICHvo","98304:MICHvoB","98304:ICHvoBW","98304:CHvoBWd","98304:HvoBWdK","98304:voBWdKD","98304:oBWdKD2","98304:BWdKD27","98304:WdKD27G","98304:dKD27Gi","98304:KD27Gid","98304:D27GidO","98304:27GidOx","98304:7GidOx1","98304:GidOx1S","98304:idOx1Sj","98304:dOx1Sjq","98304:Ox1Sjq+","98304:x1Sjq+W","98304:1Sjq+WS","98304:Sjq+WSG","98304:jq+WSGe","98304:q+WSGeD","98304:+WSGeDf","98304:WSGeDfT","98304:SGeDfT2","98304:GeDfT2b","98304:eDfT2bj","98304:DfT2bjY","98304:fT2bjYq","98304:T2bjYqC","98304:2bjYqCF","98304:bjYqCFh","98304:jYqCFhk","98304:YqCFhkF","98304:qCFhkFD","98304:CFhkFDG","98304:FhkFDGg","98304:hkFDGgv","98304:kFDGgvD","98304:FDGgvDY","98304:DGgvDYl","98304:GgvDYld","98304:gvDYldW","98304:vDYldWx","98304:DYldWxj","98304:YldWxjv","98304:ldWxjvb","98304:dWxjvbb","98304:WxjvbbI","98304:xjvbbIS","98304:jvbbISm","98304:vbbISmE","98304:bbISmEj","49152:7cSqGcF","49152:cSqGcF7","49152:SqGcF7l","49152:qGcF7lZ","49152:GcF7lZ2","49152:cF7lZ2u","49152:F7lZ2uG","49152:7lZ2uGU","49152:lZ2uGUj"],"imphash":"3618f5646ce04014e413d2930595cbc4"},"file_info":{"file_name":"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":5493760,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1736704225000,"last_seen":1737114802000,"last_multi_scan":1737114802000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["onion","ransomware"]},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":78},"sandbox_signatures":{"informative_count":174,"suspicious_count":18,"malicious_count":8,"total":200},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Ransomware/Win.FunkSec","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.DelShad","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/FileCoder.sothu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.75310572","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Ransom_Win64_FunkSec_GNM_MTB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.75310572 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/Filecoder.RN trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005bf6401 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"FunkLocker-HUQ!C8DD54784FB1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.DelShad.kusdnb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/FunkSec-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/Ransom.SB.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Genus.HOO","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanPSW.Rusty","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.DelShad.Win32.2504","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"malicious","value":"Contains native function calls"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Contains ability to create named pipes for inter-process communication (IPC)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Able to delete volume snapshots"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"malicious","value":"Executes powershell requesting to bypass execution policy"},{"type":"suspicious","value":"Executes powershell accessing native variables"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"},{"type":"informative","value":"Set/modify configurations using PowerShell"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to start a process (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","identifiers":[{"type":"suspicious","value":"Found TLS callbacks"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Uses Rust based deflate/zlib compression/decompression library"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify Windows Defender preferences (Powershell command string)"},{"type":"informative","value":"Contains ability to modify PowerShell execution policies (Powershell command string)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"malicious","value":"Attempts to modify Windows Defender preferences"},{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"malicious","value":"The input sample contains a known anti-VM trick"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Reads files"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Contains ability to query registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Discovery","technique":"Log Enumeration","attack_id":"T1654","attack_id_wiki":"https://attack.mitre.org/techniques/T1654","identifiers":[{"type":"informative","value":"References Windows event log utility"},{"type":"informative","value":"References security-related event logs"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Discovery","technique":"Device Driver Discovery","attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"malicious","value":"Maps a network share location"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Uses Rust compression library for archiving"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Decrypted SSL network traffic"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops files with image extension"},{"type":"suspicious","value":"Drops executable files"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Communicates with HTTPS webserver (GET/POST requests)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"},{"type":"suspicious","value":"Process binds to unusual ports"},{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Command and Control","technique":"Multi-hop Proxy","attack_id":"T1090.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/003","identifiers":[{"type":"informative","value":"Contains Tor Onion URL"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Command and Control","technique":"Steganography","attack_id":"T1001.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1001/002","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"suspicious","value":"Write many files with double extensions (often indicator of ransomware infection)"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"tactic":"Impact","technique":"Defacement","attack_id":"T1491","attack_id_wiki":"https://attack.mitre.org/techniques/T1491","identifiers":[{"type":"suspicious","value":"Changes the desktop background picture"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00008120)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00008120)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00008120)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00008120)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '2077361045505', 'hResInfo': '2077361046752'}\" (UID: 00000000-00008120)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2077361045505', 'hResInfo': '2077361046784'}\" (UID: 00000000-00008120)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2077361045505', 'hResInfo': '2077361046800'}\" (UID: 00000000-00008120)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2077361045505', 'hResInfo': '2077361046768'}\" (UID: 00000000-00008120)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00003068.00000000.125401.F08DA000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003068.00000000.125401.F08DA000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify PowerShell execution policies (Powershell command string)","description":"Found string \"Set-ExecutionPolicy Bypass -Scope Process -Force\" (Indicator: \"Set-ExecutionPolicy\"; Source: \"00000000-00002796.00000000.125407.0CF70000.00000004.mdmp, 00000000-00002796.00000000.125407.0CFE0000.00000004.mdmp, 00000000-00002796.00000000.125407.0EA60000.00000004.mdmp\")\n Found string \"\"powershell\" -Command \"Set-ExecutionPolicy Bypass -Scope Process -Force\"\" (Indicator: \"Set-ExecutionPolicy\"; Source: \"00000000-00002796.00000000.125407.0CFE0000.00000004.mdmp\")\n Found string \"Set-ExecutionPolicy Bypass -Scope Process -ForceVM detected, aborting.\" (Indicator: \"Set-ExecutionPolicy\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-341","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify data representation (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Export-ModuleMember\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00008120-00000BC0-971482992\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00004140.00000001.126945.1EA10000.00000004.mdmp, 00000000-00004140.00000002.128865.1EA10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"$26","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Uses Rust based deflate/zlib compression/decompression library","description":"Found string \"C:\\Users\\Abdellah\\.cargo\\registry\\src\\index.crates.io-6f17d22bba15001f\\miniz_oxide-0.8.2\\src\\inflate\\core.rsC:\\Users\\Abdellah\\.cargo\\registry\\src\\index.crates.io-6f17d22bba15001f\\miniz_oxide-0.8.2\\src\\inflate\\output_buffer.rs\" (Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-636","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Uses Rust compression library for archiving","description":"Found string \"C:\\Users\\Abdellah\\.cargo\\registry\\src\\index.crates.io-6f17d22bba15001f\\miniz_oxide-0.8.2\\src\\inflate\\core.rsC:\\Users\\Abdellah\\.cargo\\registry\\src\\index.crates.io-6f17d22bba15001f\\miniz_oxide-0.8.2\\src\\inflate\\output_buffer.rs\" (Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":3,"id":"string-637","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor cl\n 01h in Stream UID: 26201-3677-00000001403761A0\n Assembly shows XOR instruction xor r8d\n ecx in Stream UID: 26201-3685-0000000140218940\n Assembly shows XOR instruction xor eax\n ecx in Stream UID: 26201-3685-0000000140218940\n Assembly shows XOR instruction xor ecx\n r8d in Stream UID: 26201-3685-0000000140218940\n Assembly shows XOR instruction xor ecx\n eax in Stream UID: 26201-3685-0000000140218940\n Assembly shows XOR instruction xor r9d\n ecx in Stream UID: 26201-3685-0000000140218940\n Assembly shows XOR instruction xor al\n 01h in Stream UID: 26201-3821-0000000140349940","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CertEnumCertificatesInStore\" (Indicator: \"CertEnumCertificatesInStore\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"CertCloseStore\" (Indicator: \"CertCloseStore\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002796.00000000.125407.0CFE0000.00000004.mdmp\")\n Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00008120.00000000.125402.AAA40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00004140.00000001.126945.1EA10000.00000004.mdmp, 00000000-00004140.00000002.128865.1EA10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"file/memory contains long string with (Indicator: \" ^ \"; File: \"wdsclientapi.dll.funksec\")\n Found string \"O ^ $\" (Indicator: \" ^ \"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Contains ability to perform Base64 encoding/decoding","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$27","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Spawned process connects to a network\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Contacts server","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008120-00000C29-976237836\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008120-00000C29-980115881\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"8120\" - (UID: 00000000-00008120)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"3068\" - (UID: 00000000-00003068)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"1476\" - (UID: 00000000-00001476)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"2796\" - (UID: 00000000-00002796)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00008120)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00003068)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00001476)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00002796)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004140)\n \"net1.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000392)\n \"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00008120)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$29","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00008120)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00008120)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00003068)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00003068)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00001476)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00001476)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00002796)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00002796)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00008120)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00003068)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00001476)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00002796)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00003068.00000000.125401.F08DA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@kernel32.dll at 26201-3833-0000000140347E30","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003068.00000000.125401.F08DA000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00003068.00000000.125401.F08DA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00003068.00000000.125401.F08DA000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00003068.00000000.125401.F08DA000.00000002.mdmp\")\n Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003068.00000000.125401.F08DA000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00003068.00000000.125401.F08DA000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00003068.00000000.125401.F08DA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00003068.00000000.125401.F08DA000.00000002.mdmp\")\n Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00003068.00000000.125401.F08DA000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00003068.00000000.125401.F08DA000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00003068.00000000.125401.F08DA000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")\n Found reference to API \"tlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00004140.00000000.125023.1EA10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe\" queries volume information of \"C:\\\" at 00000000-00004140-00000C15-968441639\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00008120-00000C15-987256299\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00003068-00000C15-990972427\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00001476-00000C15-989283391\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00002796-00000C15-990972353","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"net1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to retrieve device driver information","description":"\"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\SANDBOXFLTR\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1652","relevance":1,"id":"registry-174","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00008120)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00003068)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00001476)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00002796)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$2e","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"$2f","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"199.232.192.193:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")\n Found reference to API \"1498849678,6188,3140,,CreateProcessW,kernel32.dll,\"00:32:29.312\",RX=0,PX=0\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004140.00000000.125023.1EA10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Contains ability to create named pipes for inter-process communication (IPC)","description":"CreateNamedPipeW@kernel32.dll at 26201-3821-0000000140349940","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1559","relevance":10,"id":"stream-45","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"NtDeviceIoControlFile\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"DeviceIoControl\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"NtDeviceIoControlFile\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")\n Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@kernel32.dll at 26201-3684-0000000140375510\n Sleep@kernel32.dll at 26201-3687-0000000140374B20\n WaitForSingleObject@kernel32.dll at 26201-3827-00000001403487D0\n WaitForSingleObject@kernel32.dll at 26201-3830-0000000140348B10\n Sleep@kernel32.dll at 26201-3677-00000001403761A0\n Sleep@kernel32.dll at 26201-3685-0000000140218940","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00003068.00000000.125401.F08DA000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$32","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00003068.00000000.125401.F08DA000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00003068.00000000.125401.F08DA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Powershell command string)","description":"Found string \"powershellStart-Process -FilePath \"\" -Verb RunAs\" (Indicator: \"Start-Process\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-250","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$34","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8120:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:8120:120:WilError_01\"\n \"SM0:8120:120:WilError_01\"\n \"SM0:8120:304:WilStaging_02\"\n \"Local\\SM0:8120:304:WilStaging_02\"\n \"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:8120:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:3068:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3068:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:3068:120:WilError_01\"\n \"Local\\SM0:3068:304:WilStaging_02\"\n \"SM0:3068:304:WilStaging_02\"\n \"SM0:3068:120:WilError_01\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1476:304:WilStaging_02\"\n \"Local\\SM0:1476:304:WilStaging_02\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$35","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\__rust_anonymous_pipe1__.4140.5674161952380272259\n Found string - \\\\.\\pipe\\__rust_anonymous_pipe1__.4140.5674161952380272260\n Found string - \\\\.\\pipe\\PSHost.133816172433916939.8120.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.133816172434209637.3068.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.133816172434501819.1476.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.133816172434791487.2796.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\__rust_anonymous_pipe1__.\n Found string - \\.\\pipe\\__rust_anonymous_pipe1__.o","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"- Go to [Coinbase](https://www.coinbase.com/) or any similar website like [Blockchain](https://www.blockchain.com/), use your credit card to buy bitcoin (0.1 BTC), and then send it to the wallet address.\" (Indicator: \"coinbase.com\")\n \"- Go to [Coinbase](https://www.coinbase.com/) or any similar website like [Blockchain](https://www.blockchain.com/), use your credit card to buy bitcoin (0.1 BTC), and then send it to the wallet address.\" (Indicator: \"blockchain.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$36","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at 69800000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 7F5A0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 990E0000\n \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 98290000\n \"net.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 98290000\n \"net1.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 990E0000\n \"net1.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 98290000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 990E0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 98290000\n \"wevtutil.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 990E0000\n \"wevtutil.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 98290000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 6AE00000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 99D50000\n \"net.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 99D50000\n \"net1.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 99D50000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 99D50000\n \"wevtutil.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 99D50000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c73799f87f0000@ntdll.dll\"\n \"220023000000000018c73799f87f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$37","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\" file has an entrypoint instructions - \"sub\trsp, 0x28,call\t0x14036d548,add\trsp, 0x28,jmp\t0x14036d170,int3\t,int3\t,jmp\t0x14036d8f8,int3\t,int3\t,int3\t,sub\trsp, 0x28,call\t0x14036dbcc,test\teax, eax,je\t0x14036d336,mov\trax, qword ptr gs:[0x30],mov\trcx, qword ptr [rax + 8],jmp\t0x14036d329,cmp\trcx, rax,je\t0x14036d33d,xor\teax, eax,lock cmpxchg\tqword ptr [rip + 0x1a1f5c], rcx,jne\t0x14036d324,xor\tal, al,add\trsp, 0x28,ret\t,mov\tal, 1,jmp\t0x14036d338,int3\t,int3\t,int3\t,sub\trsp, 0x28,test\tecx, ecx,jne\t0x14036d353,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x37e000\" greater than 0x100000\n Raw size of \".rdata\" is \"0x18ca00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x37dfdf\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x18c960\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\net.exe\" [Source: 00000000-00004140-00000BC0-958518816]\n Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00004140-00000BC0-963574466]\n Observed system executable string:\"%WINDIR%\\system32\\net.exe\" [Source: 00000000-00004140-00000C44-1498849678]\n Observed system executable string:\"\"%WINDIR%\\system32\\wevtutil.exe\" sl Security /e:false\" [Source: 00000000-00003068-00000C44-72171817234]\n Observed system executable string:\"\"%WINDIR%\\system32\\wevtutil.exe\" sl Application /e:false\" [Source: 00000000-00001476-00000C44-66130311290]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"wevtutil.exe\" (UID: 00000000-00007860) was launched with modified environment variables: \"PSModulePath, PATHEXT\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"i.imgur.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$38","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"net.exe\" with commandline \"\"net\" session\" (UID: 00000000-00002192)\n Spawned process \"net1.exe\" with commandline \"%WINDIR%\\\\system32\\\\net1 session\" (UID: 00000000-00000392)\n Spawned process \"powershell.exe\" with commandline \"\"powershell\" -Command \"Set-MpPreference -DisableRealtimeMonitori ...\" (UID: 00000000-00008120), Spawned process \"powershell.exe\" with commandline \"\"powershell\" -Command \"wevtutil sl Security /e:false\"\" (UID: 00000000-00003068), Spawned process \"powershell.exe\" with commandline \"\"powershell\" -Command \"wevtutil sl Application /e:false\"\" (UID: 00000000-00001476), Spawned process \"powershell.exe\" with commandline \"\"powershell\" -Command \"Set-ExecutionPolicy Bypass -Scope Process ...\" (UID: 00000000-00002796)\n Spawned process \"wevtutil.exe\" with commandline \"sl Application /e:false\" (UID: 00000000-00007860)\n Spawned process \"wevtutil.exe\" with commandline \"sl Security /e:false\" (UID: 00000000-00003732)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"net.exe\" with commandline \"\"net\" session\" (UID: 00000000-00002192)\n Spawned process \"net1.exe\" with commandline \"%WINDIR%\\\\system32\\\\net1 session\" (UID: 00000000-00000392)\n Spawned process \"powershell.exe\" with commandline \"\"powershell\" -Command \"Set-MpPreference -DisableRealtimeMonitori ...\" (UID: 00000000-00008120), Spawned process \"powershell.exe\" with commandline \"\"powershell\" -Command \"wevtutil sl Security /e:false\"\" (UID: 00000000-00003068), Spawned process \"powershell.exe\" with commandline \"\"powershell\" -Command \"wevtutil sl Application /e:false\"\" (UID: 00000000-00001476), Spawned process \"powershell.exe\" with commandline \"\"powershell\" -Command \"Set-ExecutionPolicy Bypass -Scope Process ...\" (UID: 00000000-00002796)\n Spawned process \"wevtutil.exe\" with commandline \"sl Application /e:false\" (UID: 00000000-00007860)\n Spawned process \"wevtutil.exe\" with commandline \"sl Security /e:false\" (UID: 00000000-00003732)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB\" (SHA1: 39:5B:E1:0D:4A:FC:A4:C7:F3:71:DE:C4:5C:12:69:F9:5F:58:9F:42; see report for more information)\n The input sample is signed with a certificate issued by \"CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US\" (SHA1: 33:E4:E8:08:07:20:4C:2B:61:82:A3:A1:4B:59:1A:CD:25:B5:F0:DB; see report for more information)\n The input sample is signed with a certificate issued by \"CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB\" (SHA1: D8:9E:3B:D4:3D:5D:90:9B:47:A1:89:77:AA:9D:5C:E3:6C:EE:18:4C; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_3j0e1dcu.sbr.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_mgxwgknp.50w.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_xan2f30h.q3c.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_2emr2fa4.laq.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_s4kspp5i.13m.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_vit1mxrx.a3w.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_xeifkgky.c4k.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_4xean0dr.bp3.psm1\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003068.00000000.125401.F08DA000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$3a","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe\" queries basic process information of the \"C:\\20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe\" (UID: 4140)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: The input sample contains a known anti-VM trick","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$3e","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"\"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe\" touched file \"C:\\Program Files\\e4S32jfhg4.exe\"\n \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe\" touched file \"C:\\Program Files\\e4S32jfhg4.exe:Zone.Identifier\"","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe\" writes file \"c:\\readme-t0yhcghkwk.md\"\n \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe\" writes file \"c:\\downloaded_wallpaper.jpg\"\n \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe\" writes file \"c:\\program files\\e4s32jfhg4.exe\"\n \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe\" writes file \"c:\\program files\\e4s32jfhg4.exe:zone.identifier\"\n \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe\" writes file \"c:\\$recycle.bin\\s-1-5-18\\desktop.ini.funksec\"\n \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe\" writes file \"c:\\$recycle.bin\\s-1-5-21-735145574-3570218355-1207367261-1001\\desktop.ini.funksec\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTPS webserver (GET/POST requests)","description":"Found requests in header \"GET /HCYQoVR.jpeg HTTP/1.1accept: */*host: i.imgur.com\"; in File: \"SSL\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-505","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Network Related","name":"Contains Tor Onion URL","description":"\"- funkiydk7c6j3vvck5zk2giml2u746fa5irwalw2kjem6tvofji7rwid.onion\" (Indicator: \".onion\") in Source: 00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\n \"- funknqn44slwmgwgnewne6bintbooauwkaupik4yrlgtycew3ergraid.onion\" (Indicator: \".onion\") in Source: 00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\n \"- funkxxkovrk7ctnggbjnthdajav4ggex53k6m2x3esjwlxrkb3qiztid.onion\" (Indicator: \".onion\") in Source: 00000000-00004140.00000000.125023.06D8F000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1090.003","relevance":1,"id":"string-176","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Network Related","name":"Decrypted SSL network traffic","description":"$41","origin":"File/Memory","mitre_attack_id":"T1573","relevance":3,"id":"string-102","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"setupop.ini\" [Source: 00000000-00004140.00000001.126945.1EA10000.00000004.mdmp\n 00000000-00004140.00000002.128865.1EA10000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.37\"\n \"2.5.29.35\"\n \"127.0.0.1:34254could not resolve to any addresses\"\n \"2.5.29.17\"\n \"2.5.29.14\"\n \"2.5.29.32\"\n \"2.5.29.19\"\n \"2.5.29.31\"\n \"2.5.29.15\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.1\"\n \"2.5.29.10\"\n \"2.5.4.3\"\n \"2.5.29.16\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$42","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"https://i.imgur.com/hcyqovr.jpegfailed\" - Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")\n Found URL \"https://getsession.org/\" - Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")\n Found URL \"https://www.coinbase.com/)\" - Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")\n Found URL \"https://www.blockchain.com/),\" - Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")\n Found URL \"http://ns.adobe.queue\" - Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")\n Found URL \"http://httphttpsno_proxyno_proxyc:\\users\\abdellah\\.cargo\\registry\\src\\index.crates.io-6f17d22bba15001f\\reqwest-0.11.27\\src\\proxy.rsunknown\" - Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")\n Found URL \"https://should\" - Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")\n Found URL \"https://docs.rs/getrandom\" - Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$43","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /HCYQoVR.jpeg HTTP/1.1accept: */*\n host: i.imgur.com\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://i.imgur.com/HCYQoVR.jpeg","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"199.232.192.193\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"net1.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00008120)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00003068)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00001476)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00002796)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000030000000000000004000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00008120)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00003068)\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00001476)\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00002796)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$44","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$45","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"NtReadFile\" (Indicator: \"NtReadFile\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")\n Found reference to API \"NtReadFile\" (Indicator: \"NtReadFile\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003068.00000000.125401.F08DA000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003068.00000000.125401.F08DA000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003068.00000000.125401.F08DA000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003068.00000000.125401.F08DA000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"getsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003068.00000000.125401.F08DA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"has_authority means set_password shouldn't fail\" (Indicator: \"password\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")\n Found string \"password\" (Indicator: \"password\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Windows event log utility","description":"Found string \"wevtutil sl Application /e:false\" (File: \"AMSI\")\n Found string \"\"powershell\" -Command \"wevtutil sl Application /e:false\"\" (Source: \"00000000-00001476.00000000.125407.FF6E0000.00000004.mdmp\")\n Found string \"wevtutil sl Application /e:false\" (Source: \"00000000-00001476.00000000.125407.FF6E0000.00000004.mdmp, 00000000-00001476.00000000.125407.FF8D0000.00000004.mdmp, 00000000-00001476.00000000.125407.FFE30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1654","relevance":1,"id":"string-648","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References security-related event logs","description":"Found string \"wevtutil sl Security /e:false\" (File: \"AMSI\")\n Found string \"wevtutil sl Security /e:false\" (Source: \"00000000-00003068.00000000.125401.C6630000.00000004.mdmp, 00000000-00003068.00000000.125401.C6640000.00000004.mdmp, 00000000-00003068.00000000.125401.C8040000.00000004.mdmp\")\n Found string \"\"powershell\" -Command \"wevtutil sl Security /e:false\"\" (Source: \"00000000-00003068.00000000.125401.C6640000.00000004.mdmp\")\n Found string \"Set-MpPreference -DisableRealtimeMonitoring $truewevtutil sl Security /e:falsewevtutil sl Application /e:falsevboxserviceqemuhypervvmwaretasklist/fiIMAGENAME eq\" (Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1654","relevance":1,"id":"string-650","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00008120)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003068)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001476)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002796)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify Windows Defender preferences (Powershell command string)","description":"Found string \"Set-MpPreference -DisableRealtimeMonitoring $true\" (Indicator: \"Set-MpPreference\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"Set-MpPreference\"; File: \"AMSI\")\n Found string \"Set-MpPreference -DisableRealtimeMonitoring $truewevtutil sl Security /e:falsewevtutil sl Application /e:falsevboxserviceqemuhypervvmwaretasklist/fiIMAGENAME eq\" (Indicator: \"Set-MpPreference\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")\n Found string \"\"powershell\" -Command \"Set-MpPreference -DisableRealtimeMonitoring $true\"\" (Indicator: \"Set-MpPreference\"; Source: \"00000000-00008120.00000000.125402.AAA40000.00000004.mdmp\")\n Found string \"Set-MpPreference -DisableRealtimeMonitoring $true\" (Indicator: \"Set-MpPreference\"; Source: \"00000000-00008120.00000000.125402.AAA40000.00000004.mdmp, 00000000-00008120.00000000.125402.AAD20000.00000004.mdmp, 00000000-00008120.00000000.125402.AC420000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-275","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")\n Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00004140.00000000.125023.06D8F000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003068.00000000.125401.F08DA000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003068.00000000.125401.F08DA000.00000002.mdmp\")\n Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$4b","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00004140.00000001.126945.1EA10000.00000004.mdmp, 00000000-00004140.00000002.128865.1EA10000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00008120]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"downloaded_wallpaper.jpg\" has type \"JPEG image data JFIF standard 1.02 aspect ratio density 1x1 segment length 16 baseline precision 8 696x516 components 3\" and extension \"jpg\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"net1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"informative","category":"Unusual Characteristics","name":"Set/modify configurations using PowerShell","description":"Process \"powershell.exe\" with commandline \"\"powershell\" -Command \"Set-MpPreference -DisableRealtimeMonitoring $true\"\" (UID: 00000000-00008120)","origin":"Monitored Target","mitre_attack_id":"T1543.003","relevance":3,"id":"target-479","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"section contains high entropy","description":"\"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\" has section name .text with entropy \"6.25840413252\"\n \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\" has section name .pdata with entropy \"6.40446498429\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleA@kernel32.dll at 26201-3682-0000000140377BB0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe\" reads file \"C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini\"\n \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe\" reads file \"C:\\$Recycle.Bin\\S-1-5-21-735145574-3570218355-1207367261-1001\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$4d","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"bind@ws2_32.dll at 26201-3794-0000000140354920","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"suspicious","category":"Network Related","name":"Process binds to unusual ports","description":"Process \"C:\\20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe\" binds to port 34254","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":10,"id":"network-36","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 199.232.192.193 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"C:\\20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe\" connects to 199.232.192.193 on port 443 (TCP); Domain: \"i.imgur.com\"","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Able to delete volume snapshots","description":"Found string \"chrome.exefirefox.exesystem32.exeWinDefendscstoptaskkill/F/IMvssadmindelete shadows/all/quietShadow copies deleted successfully.\" (Source: \"00000000-00004140.00000000.125023.06D8F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-634","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Changes the desktop background picture","description":"\"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"WALLPAPER\"; Value: \"\\\\?\\C:\\downloaded_wallpaper.jpg\")","origin":"Registry Access","mitre_attack_id":"T1491","relevance":10,"id":"registry-22","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$4e","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$4f","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$50","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"suspicious","category":"System Security","name":"Writes registry keys","description":"\"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2F3\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")\n \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"WALLPAPER\"; Value: \"\\\\?\\C:\\downloaded_wallpaper.jpg\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2F3\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Executes powershell accessing native variables","description":"Process \"powershell.exe\" with commandline \"\"powershell\" -Command \"Set-MpPreference -DisableRealtimeMonitoring $true\"\" (Indicator: \"$true\", UID: 00000000-00008120)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":10,"id":"target-55","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Found TLS callbacks","description":"\"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\" has a TLS callback with entrypoint at 0x40354390\n \"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d\" has a TLS callback with entrypoint at 0x1","origin":"Static Parser","mitre_attack_id":"T1055.005","relevance":10,"id":"static-17","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n RegOpenKeyExW\n GetFileAttributesW\n GetModuleFileNameW\n IsDebuggerPresent\n UnhandledExceptionFilter\n CreateThread\n GetSystemDirectoryW\n SleepEx\n LoadLibraryA\n DeleteFileW\n GetSystemInfo\n FindNextFileW\n FindFirstFileW\n GetProcAddress\n CreateFileW\n GetCommandLineW\n CopyFileExW\n GetModuleHandleA\n WriteFileEx\n GetModuleHandleW\n CreateProcessW\n Sleep\n recv\n bind\n send\n WSASend\n WSAStartup\n WSASocketW\n closesocket\n connect","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Write many files with double extensions (often indicator of ransomware infection)","description":"\"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe\" write more than 100 files with extension \".dll.funksec\"","origin":"API Call","mitre_attack_id":"T1486","relevance":5,"id":"api-201","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"sample.bin\" (Offset: 3659404)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$51","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"malicious","category":"Network Related","name":"Maps a network share location","description":"Process \"net.exe\" with commandline \"\"net\" session\" (UID: 00000000-00002192)\n Process \"net1.exe\" with commandline \"%WINDIR%\\\\system32\\\\net1 session\" (UID: 00000000-00000392)","origin":"Monitored Target","mitre_attack_id":"T1049","relevance":3,"id":"target-88","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"malicious","category":"System Security","name":"Attempts to modify Windows Defender preferences","description":"Process \"powershell.exe\" with commandline \"\"powershell\" -Command \"Set-MpPreference -DisableRealtimeMonitoring $true\"\" (UID: 00000000-00008120)","origin":"Monitored Target","mitre_attack_id":"T1562.001","relevance":3,"id":"target-106","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"malicious","category":"System Security","name":"Executes powershell requesting to bypass execution policy","description":"Process \"powershell.exe\" with commandline \"\"powershell\" -Command \"Set-ExecutionPolicy Bypass -Scope Process -Force\"\" (UID: 00000000-00002796)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-29","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtReadFile@ntdll.dll at 26201-3827-00000001403487D0\n NtReadFile@ntdll.dll at 26201-3830-0000000140348B10","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$52","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Changes the desktop background picture"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"The input sample contains a known anti-VM trick"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]}]},"activity":{"stats":{"process_count":9,"spawned_processes_count":9,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":25,"imported_dlls_count":105,"dropped_files_count":0,"extracted_files_count":16,"files_written_count":28,"files_deleted_count":0,"registry_keys_created_count":39,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":39,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["onion","ransomware"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Decrypted SSL traffic"],"sandbox_reports":[{"id":"678a44b10f03782803097deb","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d","analysis_start_time":"2025-01-17T11:53:22+00:00","indicators_count":{"informative":174,"suspicious":45,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files","Decrypted SSL traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"199.232.192.193","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]}],"dns_resolutions":[{"domain":"i.imgur.com","address":"199.232.192.193","ttl":5289,"country":"United States","registrar_name":"ENOM, INC.","registrar_organization":"WHOISGUARD, INC.","registrar_name_servers":"DNS1.P03.NSONE.NET","registrar_creation_date":"2009-01-09T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}],"processes":[{"pid":4140,"ppid":0,"name":"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe","command_line":"","sha256":"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d","normalized_path":"C:\\20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe","uid":"00000000-00004140","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":2192,"ppid":4140,"name":"net.exe","command_line":"\"net\" session","sha256":"8267ee144d1bf557bc2a8a46335242bf0c52b919442e03401f69028726116615","normalized_path":"%WINDIR%\\system32\\net.exe","parent_uid":"00000000-00004140","uid":"00000000-00002192"},{"pid":392,"ppid":2192,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 session","sha256":"325158c8f4b250fe7438c88c8bac47aedebece852aac5926308ca7dc29d7e31c","normalized_path":"%WINDIR%\\system32\\net1.exe","parent_uid":"00000000-00002192","uid":"00000000-00000392"},{"pid":8120,"ppid":4140,"name":"powershell.exe","command_line":"\"powershell\" -Command \"Set-MpPreference -DisableRealtimeMonitoring $true\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00004140","uid":"00000000-00008120"},{"pid":3068,"ppid":4140,"name":"powershell.exe","command_line":"\"powershell\" -Command \"wevtutil sl Security /e:false\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00004140","uid":"00000000-00003068"},{"pid":3732,"ppid":3068,"name":"wevtutil.exe","command_line":"sl Security /e:false","sha256":"5de1d5b18e24a8f7294dad0911733f985ae4f9baa01eba9632ce45163d467c92","normalized_path":"%WINDIR%\\system32\\wevtutil.exe","parent_uid":"00000000-00003068","uid":"00000000-00003732"},{"pid":1476,"ppid":4140,"name":"powershell.exe","command_line":"\"powershell\" -Command \"wevtutil sl Application /e:false\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00004140","uid":"00000000-00001476"},{"pid":7860,"ppid":1476,"name":"wevtutil.exe","command_line":"sl Application /e:false","sha256":"5de1d5b18e24a8f7294dad0911733f985ae4f9baa01eba9632ce45163d467c92","normalized_path":"%WINDIR%\\system32\\wevtutil.exe","parent_uid":"00000000-00001476","uid":"00000000-00007860"},{"pid":2796,"ppid":4140,"name":"powershell.exe","command_line":"\"powershell\" -Command \"Set-ExecutionPolicy Bypass -Scope Process -Force\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00004140","uid":"00000000-00002796"}],"all_imported_dlls":["mpr.dll","mscoree.dll","userenv.dll","ucrtbase.dll","secur32.dll","mswsock.dll","nsi.dll","System.ni.dll","System.Xml.ni.dll","win32u.dll","cryptbase.dll","mscoreei.dll","miutils.dll","SHCore.dll","ucrtbase_clr0400.dll","System.Numerics.ni.dll","sppc.dll","wbemprox.dll","VxSSL64.dll","cryptnet.dll","dsrole.dll","wintrust.dll","MpOAV.dll","System.Data.ni.dll","clrjit.dll","msvcrt.dll","vcruntime140.dll","ncryptsslp.dll","System.Configuration.Install.ni.dll","kernel.appcore.dll","sspicli.dll","schannel.dll","ntasn1.dll","atl.dll","WK13VOEB.dll","System.Management.ni.dll","System.Data.dll","ntmarta.dll","wldp.dll","MpClient.dll","slc.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","sechost.dll","FWPUCLNT.DLL","mskeyprotect.dll","gpapi.dll","srvcli.dll","logoncli.dll","mscorlib.ni.dll","Microsoft.Management.Infrastructure.ni.dll","ntdll.dll","apphelp.dll","gdi32.dll","cfgmgr32.dll","msasn1.dll","System.Configuration.ni.dll","Microsoft.PowerShell.Commands.Management.ni.dll","mi.dll","kernel32.dll","windows.storage.dll","powrprof.dll","profapi.dll","ole32.dll","version.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","amsi.dll","user32.dll","cryptsp.dll","rsaenh.dll","netutils.dll","samcli.dll","vcruntime140_clr0400.dll","System.Core.ni.dll","System.DirectoryServices.ni.dll","KernelBase.dll","rpcrt4.dll","advapi32.dll","dnsapi.dll","IPHLPAPI.DLL","rasadhlp.dll","wkscli.dll","clr.dll","bcryptprimitives.dll","crypt32.dll","imm32.dll","psapi.dll","Microsoft.PowerShell.Security.ni.dll","wevtapi.dll","gdi32full.dll","oleaut32.dll","ncrypt.dll","System.Transactions.ni.dll","System.Transactions.dll","wbemcomn.dll","msvcp_win.dll","shell32.dll","combase.dll","ws2_32.dll","fltLib.dll","System.Management.Automation.ni.dll","clbcatq.dll","Microsoft.Management.Infrastructure.Native.ni.dll","shlwapi.dll","bcrypt.dll","uxtheme.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"e4S32jfhg4.exe","sha256":"2085148ec4b39317027564f6bc5caccd389fe36447de935d8abd4e0bdaf6ff2a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"acmigration.dll.funksec","sha256":"da7d14f9a00354e441eec5a07210ce8c3f554d27b28297f3f354b06dc69929e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"diagtrack.dll.funksec","sha256":"e7bf643b5ef7e6cc80583efcfa90820a380999ca4346329142c181801dcd2126","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"mediasetupuimgr.dll.funksec","sha256":"471ea991fef6238b7ed54b47c6bc3ccfe9d95d6e75acaab16f7952768ee151e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"migcore.dll.funksec","sha256":"c5f33d75fc32afce8c7225f0e3fd698f67ea2f4c9261872f4089f1794d743163","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"reagent.dll.funksec","sha256":"4ef93bf942317f63d5fa786f9262c21524c8cca6ecdb0841ebc52dde34d64e73","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"setupcore.dll.funksec","sha256":"298186c247390508d0fbf04513a85981494f0d2849811a6fa173fc0b2c315913","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"setupmgr.dll.funksec","sha256":"a7faddced5b4a80af8e25814deb562c5d1735054d630833ba1cb0d19aa498d46","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"setupplatform.exe.funksec","sha256":"fe1d6fab47bfd5b18379e5f396aa77427f60ee7233f456f767a14f12f71e5e14","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"setupprep.exe.funksec","sha256":"eff958d7e574f174335cbba76c66a37276db08c45d6c0ef4cac512c9d0183174","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"README-T0YhcgHKWK.md","sha256":"e29d95bfb815be80075f0f8bef4fa690abcc461e31a7b3b73106bfcd5cd79033","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"downloaded_wallpaper.jpg","sha256":"ea627d5499996bda0bdef215b41ff4353bc9e9c6886af45115d5ec5e170ead93","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe.funksec","sha256":"ad299a3df94b69e6c3ca4f81b33b9913d2c1642b616afc7cdcda144b1a395b89","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"setupplatform.dll.funksec","sha256":"98454b2d4737d74e3916788aeee797bac0eacf05cd4d4f7c2b8c48771245f5b4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"winsetup.dll.funksec","sha256":"729c8d76470b9af987d22e2ea6fd30eb70e3a54fe5b6760cbd30aba9af67f1da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]}],"files_written":[{"path":"C:\\README-T0YhcgHKWK.md","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"path":"C:\\downloaded_wallpaper.jpg","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"path":"%PROGRAMFILES%\\e4S32jfhg4.exe","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"path":"%PROGRAMFILES%\\e4S32jfhg4.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.funksec","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-21-735145574-3570218355-1207367261-1001\\desktop.ini.funksec","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"path":"C:\\$WINDOWS.~BT\\DUDownload\\Setup\\acmigration.dll.funksec","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"path":"C:\\$WINDOWS.~BT\\DUDownload\\Setup\\diagtrack.dll.funksec","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"path":"C:\\$WINDOWS.~BT\\DUDownload\\Setup\\mediasetupuimgr.dll.funksec","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"path":"C:\\$WINDOWS.~BT\\DUDownload\\Setup\\migcore.dll.funksec","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"path":"C:\\$WINDOWS.~BT\\DUDownload\\Setup\\reagent.dll.funksec","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"path":"C:\\$WINDOWS.~BT\\DUDownload\\Setup\\setupcore.dll.funksec","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"path":"C:\\$WINDOWS.~BT\\DUDownload\\Setup\\setupmgr.dll.funksec","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"path":"C:\\$WINDOWS.~BT\\DUDownload\\Setup\\setupplatform.exe.funksec","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"path":"C:\\$WINDOWS.~BT\\DUDownload\\Setup\\setupprep.exe.funksec","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_3j0e1dcu.sbr.ps1","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_mgxwgknp.50w.psm1","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_xan2f30h.q3c.ps1","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_2emr2fa4.laq.psm1","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_s4kspp5i.13m.ps1","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_vit1mxrx.a3w.psm1","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_xeifkgky.c4k.ps1","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_4xean0dr.bp3.psm1","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8120:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8120:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"SM0:8120:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"SM0:8120:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"Local\\SM0:8120:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8120:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3068:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3068:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3068:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"Local\\SM0:3068:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"SM0:3068:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"SM0:3068:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"Local\\SM0:1476:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"SM0:1476:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"SM0:1476:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"Local\\SM0:2796:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"SM0:2796:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"SM0:2796:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1476:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1476:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1476:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2796:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2796:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2796:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"678a44b10f03782803097deb"}]}]}},"report_ids":{"sandbox_job_ids":["678a44b10f03782803097deb"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 20ed21bfdb7a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 20ed21bfdb7a…. Malware family: Trojan.Generic. Threat score 100/100. 18/24 AV engines flagged this file. 8 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 20ed21bfdb7a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 20ed21bfdb7a…. Malware family: Trojan.Generic. Threat score 100/100. 18/24 AV engines flagged this file. 8 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 20ed21bfdb7a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 20ed21bfdb7a…. Malware family: Trojan.Generic. Threat score 100/100. 18/24 AV engines flagged this file. 8 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L53","11",{}]]