26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 68:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T48a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Barys.Generic Sample 23ed51909e20… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 23ed51909e20…. Malware family: Barys.Generic. Threat score 100/100. 8/27 AV engines flagged this file. 12 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/23ed51909e20f1e128aaf46cd8bc76f5c91488f80e9def6a101e0508a085629b","keywords":["Malicious","Barys.Generic","malware analysis","sandbox report","threat intelligence","23ed51909e20f1e128aaf46cd8bc76f5c91488f80e9def6a101e0508a085629b"],"about":{"@type":"SoftwareApplication","name":"svhost.bat","applicationCategory":["peexe","64bits","executable"],"identifier":"23ed51909e20f1e128aaf46cd8bc76f5c91488f80e9def6a101e0508a085629b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Barys.Generic","antivirusDetections":{"malicious":8,"total":27},"behavioralIndicators":{"malicious":12,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tff0,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00002616.00000000.225023.4C0D0000.00000004.mdmp, 00000000-00002616.00000001.225346.4C0D0000.00000004.mdmp") Found string ":\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation.ni.dll" (Source: "00000000-00002616.00000000.225023.4C0D0000.00000004.mdmp, 00000000-00002616.00000001.225346.4C0D0000.00000004.mdmp") Found string ".Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00002616.00000000.225023.4C0D0000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00002616.00000000.225023.4C0D0000.00000004.mdmp, 00000000-00002616.00000000.225023.4E470000.00000004.mdmp, 00000000-00002616.00000000.225023.4E630000.00000004.mdmp, 00000000-00002616.00000000.225023.88E75000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00002616.00000000.225023.4C0D0000.00000004.mdmp, 00000000-00002616.00000000.225023.4E630000.00000004.mdmp, 00000000-00002616.00000001.225346.4C0D0000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=MSIL" (Source: "00000000-00002616.00000000.225023.4E470000.00000004.mdmp, 00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "System.Management.Automation" (Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Management.Automation/v4.0_3.0.0.0__31bf3856ad364e35/System.Management.Automation.dll" (Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "System.Management.Automation.resources, Version=3.0.0.0, Culture=en-US, PublicKeyToken=31bf3856ad364e35" (Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp, 00000000-00002616.00000000.225023.88E75000.00000004.mdmp") Found string "# .ExternalHelp System.Management.Automation.dll-help.xml" (Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "[System.Management.Automation.PSCredential]" (Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('New-Item', [System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('Out-String',[System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput($inputScript, $cursorColumn," (Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "[System.Management.Automation.Language.Ast] $ast," (Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "[System.Management.Automation.Language.Token[]] $tokens," (Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "[System.Management.Automation.Language.IScriptPosition] $positionOfCursor," (Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput(" (Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "C:\Windows\System32\WindowsPowerShell\v1.0\System.Management.Automation.dll" (Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "System.Management.Automation.dll-Help.xml" (Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp")28:T569,file/memory contains long string with (Indicator: "Export-ModuleMember"; File: "AMSI") Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp")29:Te5e,"SystemDispatchSvc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\PROPERTYBAG") "SystemDispatchSvc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\PROPERTYBAG") "SystemDispatchSvc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\PROPERTYBAG") "SystemDispatchSvc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{C5ABBF53-E17F-4121-8900-86626FC2C973}\PROPERTYBAG") "SystemDispatchSvc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{56784854-C6CB-462B-8169-88E350ACB882}\PROPERTYBAG") "SystemDispatchSvc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{56784854-C6CB-462B-8169-88E350ACB882}\PROPERTYBAG") "SystemDispatchSvc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ALLOWEDENUMERATION") "SystemDispatchSvc.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ALLOWEDENUMERATION") "SystemDispatchSvc.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS") "SystemDispatchSvc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{BCBD3057-CA5C-4622-B42D-BC56DB0AE516}\PROPERTYBAG") "SystemDispatchSvc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{00BCFC5A-ED94-4E48-96A1-3F6217F21990}\PROPERTYBAG") "SystemDispatchSvc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{0DDD015D-B06C-45D5-8C4C-F59713854639}\PROPERTYBAG") "SystemDispatchSvc.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER") "SystemDispatchSvc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TERMINAL SERVER") "SystemDispatchSvc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TERMINAL SERVER") "SystemDispatchSvc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST\S-1-5-21-735145574-3570218355-1207367261-1001\FDEPLOY") "SystemDispatchSvc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{A302545D-DEFF-464B-ABE8-61C8648D939B}\PROPERTYBAG") "SystemDispatchSvc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\PROPERTYBAG") "SystemDispatchSvc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\PROPERTYBAG") "SystemDispatchSvc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\PROPERTYBAG") "SystemDispatchSvc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{054FAE61-4DD8-4787-80B6-090220C4B700}\PROPERTYBAG") "SystemDispatchSvc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\PROPERTYBAG")2a:Ta2c,"nul && powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\Microsoft\Protect\SystemDispatchSvc.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minut" - (UID: 00000000-00006336) "SystemDispatchSvc.exe" called "CreateProcessA" with parameter "cmd.exe /c chcp 65001 >nul && attrib +h +s "%APPDATA%\SystemDispatchSvc.exe"" - (UID: 00000000-00006336) "SystemDispatchSvc.exe" called "CreateProcessA" with parameter "cmd.exe /c chcp 65001 >nul && powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\SystemDispatchSvc.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-Sched" - (UID: 00000000-00006336), "SystemDispatchSvc.exe" called "CreateProcessA" with parameter "cmd.exe /c chcp 65001 >nul && powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\SystemDispatchSvc.exe';$t=New-ScheduledTaskTrigger -AtLogOn;$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -Dont" - (UID: 00000000-00006336) "SystemDispatchSvc.exe" called "CreateProcessA" with parameter "cmd.exe /c chcp 65001 >nul && attrib +h +s "%APPDATA%\Microsoft\Protect\SystemDispatchSvc.exe"" - (UID: 00000000-00006336) "SystemDispatchSvc.exe" called "CreateProcessW" with parameter ""%TEMP%\85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe"" - (UID: 00000000-00006336) "cmd.exe" called "CreateProcessW" with parameter "chcp 65001" - (UID: 00000000-00001348) "cmd.exe" called "CreateProcessW" with parameter "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\Microsoft\Protect\SystemDispa" - (UID: 00000000-00001348), "cmd.exe" called "CreateProcessW" with parameter "chcp 65001" - (UID: 00000000-00005540), "cmd.exe" called "CreateProcessW" with parameter "attrib +h +s "%APPDATA%\SystemDispatchSvc.exe"" - (UID: 00000000-00005540), "cmd.exe" called "CreateProcessW" with parameter "chcp 65001" - (UID: 00000000-00006852), "cmd.exe" called "CreateProcessW" with parameter "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\SystemDispatchSvc.exe';$t=New" - (UID: 00000000-00006852), "cmd.exe" called "CreateProcessW" with parameter "chcp 65001" - (UID: 00000000-00007536), "cmd.exe" called "CreateProcessW" with parameter "attrib +h +s "%APPDATA%\SystemDispatchSvc.exe"" - (UID: 00000000-00007536), "cmd.exe" called "CreateProcessW" with parameter "chcp 65001" - (UID: 00000000-00003292), "cmd.exe" called "CreateProcessW" with parameter "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\SystemDispatchSvc.exe';$t=New" - (UID: 00000000-00003292), "cmd.exe" called "CreateProcessW" with parameter "chcp 65001" - (UID: 00000000-00006612), "cmd.exe" called "CreateProcessW" with parameter "attrib +h +s "%APPDATA%\Microsoft\Protect\SystemDispatchSvc.exe"" - (UID: 00000000-00006612)36:Tc1cb,"nul && %s" (Indicator: "cmd.exe /c"; File: "23ed51909e20f1e128aaf46cd8bc76f5c91488f80e9def6a101e0508a085629b.bin") Found string "cmd.exe /c rmdir /s /q "%s"" (Indicator: "cmd.exe /c"; File: "23ed51909e20f1e128aaf46cd8bc76f5c91488f80e9def6a101e0508a085629b.bin") Found string "cmd.exe /c chcp 65001 >nul && powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\Microsoft\Protect\SystemDispatchSvc.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minut" (Indicator: "cmd.exe /c"; Source: "00000000-00006336-00000C46-1121145288") Found string "cmd.exe /c chcp 65001 >nul && attrib +h +s "%APPDATA%\SystemDispatchSvc.exe"" (Indicator: "cmd.exe /c"; Source: "00000000-00006336-00000C46-29431283312") Found string "cmd.exe /c chcp 65001 >nul && powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\SystemDispatchSvc.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-Sched" (Indicator: "cmd.exe /c"; Source: "00000000-00006336-00000C46-31598388593"), Found string "cmd.exe /c chcp 65001 >nul && powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\SystemDispatchSvc.exe';$t=New-ScheduledTaskTrigger -AtLogOn;$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -Dont" (Indicator: "cmd.exe /c"; Source: "00000000-00006336-00000C46-59724906833") Found string "cmd.exe /c chcp 65001 >nul && attrib +h +s "%APPDATA%\Microsoft\Protect\SystemDispatchSvc.exe"" (Indicator: "cmd.exe /c"; Source: "00000000-00006336-00000C46-83696009109")39:T1bc4,"HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 23ed51909e20f1e128aaf46cd8bc76f5c91488f80e9def6a101e0508a085629b.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 23ed51909e20f1e128aaf46cd8bc76f5c91488f80e9def6a101e0508a085629b.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 23ed51909e20f1e128aaf46cd8bc76f5c91488f80e9def6a101e0508a085629b.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 23ed51909e20f1e128aaf46cd8bc76f5c91488f80e9def6a101e0508a085629b.bin "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 23ed51909e20f1e128aaf46cd8bc76f5c91488f80e9def6a101e0508a085629b.bin "\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 23ed51909e20f1e128aaf46cd8bc76f5c91488f80e9def6a101e0508a085629b.bin "\BraveSoftware\Brave-Browser\User Data" in Source: 23ed51909e20f1e128aaf46cd8bc76f5c91488f80e9def6a101e0508a085629b.bin "%s\BraveSoftware\Brave-Browser\User Data\Default" in Source: 23ed51909e20f1e128aaf46cd8bc76f5c91488f80e9def6a101e0508a085629b.bin "%s\BraveSoftware\Brave-Browser\User Data\Local State" in Source: 23ed51909e20f1e128aaf46cd8bc76f5c91488f80e9def6a101e0508a085629b.bin "%s\Opera Software\Opera Stable" in Source: 23ed51909e20f1e128aaf46cd8bc76f5c91488f80e9def6a101e0508a085629b.bin "%s\Opera Software\Opera Stable\Local State" in Source: 23ed51909e20f1e128aaf46cd8bc76f5c91488f80e9def6a101e0508a085629b.bin "%s\BraveSoftware\Brave-Browser\User Data\Default\Local Storage\leveldb" in Source: 23ed51909e20f1e128aaf46cd8bc76f5c91488f80e9def6a101e0508a085629b.bin "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 23ed51909e20f1e128aaf46cd8bc76f5c91488f80e9def6a101e0508a085629b.bin "$dsPath='HKLM:\SOFTWARE\Classes\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance'" in Source: 23ed51909e20f1e128aaf46cd8bc76f5c91488f80e9def6a101e0508a085629b.bin "'[Schtask]';schtasks /query /fo list|Select-String TaskName|Select -First 10;'[Registry]';Get-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -EA SilentlyContinue|fl" in Source: 23ed51909e20f1e128aaf46cd8bc76f5c91488f80e9def6a101e0508a085629b.bin "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00001248.00000000.224932.E3F40000.00000004.mdmp 00000000-00001248.00000001.226851.E3F40000.00000004.mdmp 00000000-00001248.00000002.228772.E3F40000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00002616.00000000.225023.4C0D0000.00000004.mdmp 00000000-00002616.00000001.225346.4C0D0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002616.00000000.225023.4C0D0000.00000004.mdmp 00000000-00002616.00000001.225346.4C0D0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002616.00000000.225023.4C0D0000.00000004.mdmp 00000000-00002616.00000001.225346.4C0D0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002616.00000000.225023.4C0D0000.00000004.mdmp 00000000-00002616.00000001.225346.4C0D0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002616.00000000.225023.4E470000.00000004.mdmp 00000000-00002616.00000001.225346.4E470000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002616.00000000.225023.4E470000.00000004.mdmp 00000000-00002616.00000001.225346.4E470000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp3a:T9b8,Process SystemDispatchSvc.exe created mutex with name "\BaseNamedObjects\MSN_cc8a5a51b67440239a4b5e4928836a35_DEV-7cca83520e4c0071" Process SystemDispatchSvc.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6336:304:WilStaging_02" Process SystemDispatchSvc.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6336:120:WilError_01" Process SystemDispatchSvc.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process SystemDispatchSvc.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6336:120:WilError_01" Process SystemDispatchSvc.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process SystemDispatchSvc.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process SystemDispatchSvc.exe created mutex with name "SM0:6336:120:WilError_01" Process SystemDispatchSvc.exe created mutex with name "Local\SM0:6336:120:WilError_01" Process SystemDispatchSvc.exe created mutex with name "Local\SM0:6336:304:WilStaging_02" Process SystemDispatchSvc.exe created mutex with name "Local\ZonesCacheCounterMutex" Process SystemDispatchSvc.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2616:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2616:120:WilError_01" Process powershell.exe created mutex with name "Local\SM0:2616:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:2616:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:2616:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2616:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4768:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:4768:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:4768:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:4768:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4768:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4768:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6400:304:WilStaging_02"3b:T5db,Process "powershell.exe" with commandline "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\\Microsoft\\Protect\\SystemDispatchSvc.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\\Microsoft\\Windows\\Maintenance\\StateManagerRuntime' -Action $a -Trigger $t -Settings $s"" (UID: 00000000-00002616) Process "powershell.exe" with commandline "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\\SystemDispatchSvc.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\\Microsoft\\Windows\\Maintenance\\WinSvcHost' -Action $a -Trigger $t -Settings $s"" (UID: 00000000-00004768) Process "powershell.exe" with commandline "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\\SystemDispatchSvc.exe';$t=New-ScheduledTaskTrigger -AtLogOn;$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\\Microsoft\\Windows\\Servicing\\StartComponentCleanup' -Action $a -Trigger $t -Settings $s"" (UID: 00000000-00006400)3c:T123f,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135] "85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\ole32.dll" - [base:0; Status:c0000135]3d:T52f5,"SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00001248.00000000.224932.E3F40000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00001248.00000001.226851.E3F40000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00001248.00000002.228772.E3F40000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00002616.00000000.225023.4C0D0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002616.00000000.225023.4C0D0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002616.00000000.225023.4C0D0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002616.00000000.225023.4C0D0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002616.00000000.225023.4E470000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002616.00000000.225023.4E470000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00002616.00000000.225023.4E630000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00002616.00000001.225346.4C0D0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002616.00000001.225346.4C0D0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002616.00000001.225346.4C0D0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002616.00000001.225346.4C0D0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002616.00000001.225346.4E470000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002616.00000001.225346.4E470000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00002616.00000001.225346.4E470000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00002616.00000001.225346.66D9A000.00000004.mdmp "chine\Software\Classes\WOW6" in Source: 00000000-00002616.00000001.225346.66E70000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6w" in Source: 00000000-00002616.00000001.225346.66E70000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00002616.00000001.225346.ED18A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00002616.00000001.225346.ED18A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00002616.00000001.225346.ED18A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00002616.00000001.225346.ED18A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00002616.00000001.225346.ED18A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00002616.00000001.225346.ED18A000.00000002.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004768.00000000.225797.0AE60000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00004768.00000000.225797.0AE60000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004768.00000000.225797.25110000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004768.00000000.225797.25110000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004768.00000000.225797.ED18A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004768.00000000.225797.ED18A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004768.00000000.225797.ED18A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004768.00000000.225797.ED18A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004768.00000000.225797.ED18A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004768.00000000.225797.ED18A000.00000002.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004768.00000001.226106.0AE60000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00004768.00000001.226106.0AE60000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004768.00000001.226106.25110000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004768.00000001.226106.25110000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00004768.00000001.226106.259B0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004768.00000001.226106.259B0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00004768.00000001.226106.259B0000.00000004.mdmp "egistry\Machine\Software\Classes\WOW6432Node\CLSID\{4" in Source: 00000000-00004768.00000001.226106.25A2C000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{6" in Source: 00000000-00004768.00000001.226106.25A2C000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00005752.00000000.224833.6C710000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005752.00000000.224833.6C710000.00000004.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00005752.00000000.224833.884E4000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00005752.00000000.224833.884E4000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005752.00000000.224833.884E4000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005752.00000000.224833.884E4000.00000002.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005752.00000000.224833.884E4000.00000002.mdmp "\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 00000000-00005752.00000000.224833.884E4000.00000002.mdmp "\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00005752.00000000.224833.884E4000.00000002.mdmp "%s\BraveSoftware\Brave-Browser\User Data\Default" in Source: 00000000-00005752.00000000.224833.884E4000.00000002.mdmp "%s\BraveSoftware\Brave-Browser\User Data\Local State" in Source: 00000000-00005752.00000000.224833.884E4000.00000002.mdmp "%s\Opera Software\Opera Stable" in Source: 00000000-00005752.00000000.224833.884E4000.00000002.mdmp "%s\Opera Software\Opera Stable\Local State" in Source: 00000000-00005752.00000000.224833.884E4000.00000002.mdmp "%s\BraveSoftware\Brave-Browser\User Data\Default\Local Storage\leveldb" in Source: 00000000-00005752.00000000.224833.884E4000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005752.00000000.224833.884E4000.00000002.mdmp "$dsPath='HKLM:\SOFTWARE\Classes\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance'" in Source: 00000000-00005752.00000000.224833.884E4000.00000002.mdmp "'[Schtask]';schtasks /query /fo list|Select-String TaskName|Select -First 10;'[Registry]';Get-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -EA SilentlyContinue|fl" in Source: 00000000-00005752.00000000.224833.884E4000.00000002.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00006336.00000000.224888.77290000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006336.00000000.224888.77290000.00000004.mdmp "Y\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006336.00000000.224888.77290000.00000004.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00006336.00000000.224888.C9A44000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00006336.00000000.224888.C9A44000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00006336.00000000.224888.C9A44000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00006336.00000000.224888.C9A44000.00000002.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00006336.00000000.224888.C9A44000.00000002.mdmp "\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 00000000-00006336.00000000.224888.C9A44000.00000002.mdmp "\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00006336.00000000.224888.C9A44000.00000002.mdmp "%s\BraveSoftware\Brave-Browser\User Data\Default" in Source: 00000000-00006336.00000000.224888.C9A44000.00000002.mdmp "%s\BraveSoftware\Brave-Browser\User Data\Local State" in Source: 00000000-00006336.00000000.224888.C9A44000.00000002.mdmp "%s\Opera Software\Opera Stable" in Source: 00000000-00006336.00000000.224888.C9A44000.00000002.mdmp "%s\Opera Software\Opera Stable\Local State" in Source: 00000000-00006336.00000000.224888.C9A44000.00000002.mdmp "%s\BraveSoftware\Brave-Browser\User Data\Default\Local Storage\leveldb" in Source: 00000000-00006336.00000000.224888.C9A44000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00006336.00000000.224888.C9A44000.00000002.mdmp "$dsPath='HKLM:\SOFTWARE\Classes\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance'" in Source: 00000000-00006336.00000000.224888.C9A44000.00000002.mdmp "'[Schtask]';schtasks /query /fo list|Select-String TaskName|Select -First 10;'[Registry]';Get-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -EA SilentlyContinue|fl" in Source: 00000000-00006336.00000000.224888.C9A44000.00000002.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006336.00000001.226807.77290000.00000004.mdmp "Y\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006336.00000001.226807.77290000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006336.00000002.228728.77290000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00006400.00000000.226542.2E410000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}nul && powershell -NoP -W Hidden -C "$a=New-Sched ..." (UID: 00000000-00001348), Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00004500), Spawned process "powershell.exe" with commandline "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execu ..." (UID: 00000000-00002616) Spawned process "cmd.exe" with commandline "/c chcp 65001 >nul && attrib +h +s "%APPDATA%\\SystemDispatchSvc ..." (UID: 00000000-00005540), Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00004760), Spawned process "attrib.exe" with commandline "attrib +h +s "%APPDATA%\\SystemDispatchSvc.exe"" (UID: 00000000-00001304), Spawned process "cmd.exe" with commandline "/c chcp 65001 >nul && powershell -NoP -W Hidden -C "$a=New-Sched ..." (UID: 00000000-00006852) Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00004636) Spawned process "powershell.exe" with commandline "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execu ..." (UID: 00000000-00004768), Spawned process "cmd.exe" with commandline "/c chcp 65001 >nul && attrib +h +s "%APPDATA%\\SystemDispatchSvc ..." (UID: 00000000-00007536) Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00007752) Spawned process "attrib.exe" with commandline "attrib +h +s "%APPDATA%\\SystemDispatchSvc.exe"" (UID: 00000000-00001340) Spawned process "cmd.exe" with commandline "/c chcp 65001 >nul && powershell -NoP -W Hidden -C "$a=New-Sched ..." (UID: 00000000-00003292), Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00003668), Spawned process "powershell.exe" with commandline "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execu ..." (UID: 00000000-00006400) Spawned process "cmd.exe" with commandline "/c chcp 65001 >nul && attrib +h +s "%APPDATA%\\Microsoft\\Protec ..." (UID: 00000000-00006612), Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00004412), Spawned process "attrib.exe" with commandline "attrib +h +s "%APPDATA%\\Microsoft\\Protect\\SystemDispatchSvc. ..." (UID: 00000000-00001820) Spawned process "85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe" (UID: 00000000-00003040)46:T9a5,Spawned process "SystemDispatchSvc.exe" with commandline "--r" (UID: 00000000-00006336) Spawned process "SystemDispatchSvc.exe" with commandline "--wd 6336" (UID: 00000000-00001248) Spawned process "cmd.exe" with commandline "/c chcp 65001 >nul && powershell -NoP -W Hidden -C "$a=New-Sched ..." (UID: 00000000-00001348), Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00004500), Spawned process "powershell.exe" with commandline "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execu ..." (UID: 00000000-00002616) Spawned process "cmd.exe" with commandline "/c chcp 65001 >nul && attrib +h +s "%APPDATA%\\SystemDispatchSvc ..." (UID: 00000000-00005540), Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00004760), Spawned process "attrib.exe" with commandline "attrib +h +s "%APPDATA%\\SystemDispatchSvc.exe"" (UID: 00000000-00001304), Spawned process "cmd.exe" with commandline "/c chcp 65001 >nul && powershell -NoP -W Hidden -C "$a=New-Sched ..." (UID: 00000000-00006852) Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00004636) Spawned process "powershell.exe" with commandline "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execu ..." (UID: 00000000-00004768), Spawned process "cmd.exe" with commandline "/c chcp 65001 >nul && attrib +h +s "%APPDATA%\\SystemDispatchSvc ..." (UID: 00000000-00007536) Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00007752) Spawned process "attrib.exe" with commandline "attrib +h +s "%APPDATA%\\SystemDispatchSvc.exe"" (UID: 00000000-00001340) Spawned process "cmd.exe" with commandline "/c chcp 65001 >nul && powershell -NoP -W Hidden -C "$a=New-Sched ..." (UID: 00000000-00003292), Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00003668), Spawned process "powershell.exe" with commandline "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execu ..." (UID: 00000000-00006400) Spawned process "cmd.exe" with commandline "/c chcp 65001 >nul && attrib +h +s "%APPDATA%\\Microsoft\\Protec ..." (UID: 00000000-00006612), Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00004412), Spawned process "attrib.exe" with commandline "attrib +h +s "%APPDATA%\\Microsoft\\Protect\\SystemDispatchSvc. ..." (UID: 00000000-00001820) Spawned process "85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe" (UID: 00000000-00003040)47:Td1c,file/memory contains long string with (Indicator: "Add-Type"; File: "23ed51909e20f1e128aaf46cd8bc76f5c91488f80e9def6a101e0508a085629b.bin") file/memory contains long string with (Indicator: "New-Timespan"; File: "23ed51909e20f1e128aaf46cd8bc76f5c91488f80e9def6a101e0508a085629b.bin") file/memory contains long string with (Indicator: "New-Timespan"; File: "AMSI") file/memory contains long string with (Indicator: "New-Timespan"; File: "cmd.exe") file/memory contains long string with (Indicator: "New-Timespan"; File: "powershell.exe") file/memory contains long string with (Indicator: "New-Timespan"; Source: "00000000-00002616.00000000.225023.4C0D0000.00000004.mdmp, 00000000-00002616.00000001.225346.4C0D0000.00000004.mdmp") file/memory contains long string with (Indicator: "New-Timespan"; Source: "00000000-00002616.00000000.225023.4C0D0000.00000004.mdmp, 00000000-00002616.00000000.225023.4C230000.00000004.mdmp, 00000000-00002616.00000000.225023.4C260000.00000004.mdmp, 00000000-00002616.00000000.225023.4E470000.00000004.mdmp, 00000000-00002616.00000000.225023.4E630000.00000004.mdmp, 00000000-00002616.00000001.225346.4C0D0000.00000004.mdmp, 00000000-00002616.00000001.225346.4C260000.00000004.mdmp, 00000000-00002616.00000001.225346.4E470000.00000004.mdmp") Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") file/memory contains long string with (Indicator: "New-Timespan"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") file/memory contains long string with (Indicator: "New-Timespan"; Source: "00000000-00002616.00000001.225346.4C0D0000.00000004.mdmp")48:T1c8e,file/memory contains long string with (Indicator: "Get-ScheduledTask"; File: "23ed51909e20f1e128aaf46cd8bc76f5c91488f80e9def6a101e0508a085629b.bin") file/memory contains long string with (Indicator: "Register-ScheduledTask"; File: "23ed51909e20f1e128aaf46cd8bc76f5c91488f80e9def6a101e0508a085629b.bin") file/memory contains long string with (Indicator: "Unregister-ScheduledTask"; File: "23ed51909e20f1e128aaf46cd8bc76f5c91488f80e9def6a101e0508a085629b.bin") file/memory contains long string with (Indicator: "New-ScheduledTaskAction"; File: "23ed51909e20f1e128aaf46cd8bc76f5c91488f80e9def6a101e0508a085629b.bin") file/memory contains long string with (Indicator: "New-ScheduledTaskSettingsSet"; File: "23ed51909e20f1e128aaf46cd8bc76f5c91488f80e9def6a101e0508a085629b.bin") file/memory contains long string with (Indicator: "New-ScheduledTaskTrigger"; File: "23ed51909e20f1e128aaf46cd8bc76f5c91488f80e9def6a101e0508a085629b.bin") file/memory contains long string with (Indicator: "Register-ScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "New-ScheduledTaskAction"; File: "AMSI") file/memory contains long string with (Indicator: "New-ScheduledTaskSettingsSet"; File: "AMSI") file/memory contains long string with (Indicator: "New-ScheduledTaskTrigger"; File: "AMSI") file/memory contains long string with (Indicator: "Get-ScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Unregister-ScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Disable-ScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Enable-ScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Export-ScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Get-ScheduledTaskInfo"; File: "AMSI") file/memory contains long string with (Indicator: "New-ScheduledTaskPrincipal"; File: "AMSI") file/memory contains long string with (Indicator: "Set-ScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Start-ScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Stop-ScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Get-ClusteredScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Register-ClusteredScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Set-ClusteredScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Unregister-ClusteredScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Register-ScheduledTask"; File: "cmd.exe") file/memory contains long string with (Indicator: "New-ScheduledTaskAction"; File: "cmd.exe") file/memory contains long string with (Indicator: "New-ScheduledTaskSettingsSet"; File: "cmd.exe") file/memory contains long string with (Indicator: "New-ScheduledTaskTrigger"; File: "cmd.exe") file/memory contains long string with (Indicator: "Register-ScheduledTask"; File: "powershell.exe") file/memory contains long string with (Indicator: "New-ScheduledTaskAction"; File: "powershell.exe") file/memory contains long string with (Indicator: "New-ScheduledTaskSettingsSet"; File: "powershell.exe") file/memory contains long string with (Indicator: "New-ScheduledTaskTrigger"; File: "powershell.exe") file/memory contains long string with (Indicator: "Register-ScheduledTask"; Source: "00000000-00002616.00000000.225023.4C0D0000.00000004.mdmp, 00000000-00002616.00000001.225346.4C0D0000.00000004.mdmp") file/memory contains long string with (Indicator: "New-ScheduledTaskAction"; Source: "00000000-00002616.00000000.225023.4C0D0000.00000004.mdmp, 00000000-00002616.00000001.225346.4C0D0000.00000004.mdmp") file/memory contains long string with (Indicator: "New-ScheduledTaskSettingsSet"; Source: "00000000-00002616.00000000.225023.4C0D0000.00000004.mdmp, 00000000-00002616.00000001.225346.4C0D0000.00000004.mdmp") file/memory contains long string with (Indicator: "New-ScheduledTaskTrigger"; Source: "00000000-00002616.00000000.225023.4C0D0000.00000004.mdmp, 00000000-00002616.00000001.225346.4C0D0000.00000004.mdmp") file/memory contains long string with (Indicator: "Register-ScheduledTask"; Source: "00000000-00002616.00000000.225023.4C0D0000.00000004.mdmp, 00000000-00002616.00000000.225023.4C230000.00000004.mdmp, 00000000-00002616.00000000.225023.4C260000.00000004.mdmp, 00000000-00002616.00000000.225023.4E470000.00000004.mdmp, 00000000-00002616.00000000.225023.4E630000.00000004.mdmp, 00000000-00002616.00000001.225346.4C0D0000.00000004.mdmp, 00000000-00002616.00000001.225346.4C260000.00000004.mdmp, 00000000-00002616.00000001.225346.4E470000.00000004.mdmp") file/memory contains long string with (Indicator: "New-ScheduledTaskAction"; Source: "00000000-00002616.00000000.225023.4C0D0000.00000004.mdmp, 00000000-00002616.00000000.225023.4C230000.00000004.mdmp, 00000000-00002616.00000000.225023.4C260000.00000004.mdmp, 00000000-00002616.00000000.225023.4E470000.00000004.mdmp, 00000000-00002616.00000000.225023.4E630000.00000004.mdmp, 00000000-00002616.00000001.225346.4C0D0000.00000004.mdmp, 00000000-00002616.00000001.225346.4C260000.00000004.mdmp, 00000000-00002616.00000001.225346.4E470000.00000004.mdmp") file/memory contains long string with (Indicator: "New-ScheduledTaskSettingsSet"; Source: "00000000-00002616.00000000.225023.4C0D0000.00000004.mdmp, 00000000-00002616.00000000.225023.4C230000.00000004.mdmp, 00000000-00002616.00000000.225023.4C260000.00000004.mdmp, 00000000-00002616.00000000.225023.4E470000.00000004.mdmp, 00000000-00002616.00000000.225023.4E630000.00000004.mdmp, 00000000-00002616.00000001.225346.4C0D0000.00000004.mdmp, 00000000-00002616.00000001.225346.4C260000.00000004.mdmp, 00000000-00002616.00000001.225346.4E470000.00000004.mdmp") file/memory contains long string with (Indicator: "New-ScheduledTaskTrigger"; Source: "00000000-00002616.00000000.225023.4C0D0000.00000004.mdmp, 00000000-00002616.00000000.225023.4C230000.00000004.mdmp, 00000000-00002616.00000000.225023.4C260000.00000004.mdmp, 00000000-00002616.00000000.225023.4E470000.00000004.mdmp, 00000000-00002616.00000000.225023.4E630000.00000004.mdmp, 00000000-00002616.00000001.225346.4C0D0000.00000004.mdmp, 00000000-00002616.00000001.225346.4C260000.00000004.mdmp, 00000000-00002616.00000001.225346.4E470000.00000004.mdmp") file/memory contains long string with (Indicator: "Register-ScheduledTask"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") file/memory contains long string with (Indicator: "New-ScheduledTaskSettingsSet"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") file/memory contains long string with (Indicator: "New-ScheduledTaskTrigger"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") file/memory contains long string with (Indicator: "Register-ScheduledTask"; Source: "00000000-00002616.00000001.225346.4C0D0000.00000004.mdmp") file/memory contains long string with (Indicator: "New-ScheduledTaskSettingsSet"; Source: "00000000-00002616.00000001.225346.4C0D0000.00000004.mdmp") file/memory contains long string with (Indicator: "New-ScheduledTaskTrigger"; Source: "00000000-00002616.00000001.225346.4C0D0000.00000004.mdmp")49:T411,Process "powershell.exe" with commandline "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\\Microsoft\\Protect\\SystemDispatchSvc.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\\Microsoft\\Windows\\Maintenance\\StateManagerRuntime' -Action $a -Trigger $t -Settings $s"" (UID: 00000000-00002616) Process "powershell.exe" with commandline "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\\SystemDispatchSvc.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\\Microsoft\\Windows\\Maintenance\\WinSvcHost' -Action $a -Trigger $t -Settings $s"" (UID: 00000000-00004768)4a:T69a,"9iqmgvw,czcq6inf0inf0inf" - Source: "00000000-00002616.00000000.225023.4E470000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002616.00000000.225023.4E470000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002616.00000000.225023.4E470000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002616.00000000.225023.4E470000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002616.00000000.225023.4E470000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002616.00000000.225023.4E470000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e,czc%wvf" - Source: "00000000-00002616.00000000.225023.4E470000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002616.00000000.225023.4E470000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002616.00000000.225023.4E470000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%y[gnfbgnfcgnfkcgnfygnfcgnf]gnfdigi" - Source: "00000000-00002616.00000000.225023.4E470000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002616.00000000.225023.4E470000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002616.00000000.225023.4E470000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002616.00000000.225023.4E470000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002616.00000000.225023.4E470000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002616.00000000.225023.4E470000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002616.00000000.225023.4E470000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002616.00000000.225023.4E470000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002616.00000000.225023.4E470000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0f%w0digicert" - Source: "00000000-00002616.00000000.225023.4E470000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002616.00000000.225023.4E470000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0washington1redmond1microsoft" - Source: "00000000-00002616.00000000.225023.4E470000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*loft" - Source: "00000000-00002616.00000000.225023.4E470000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3@-gnf@-gnf4gnf=gnf" - Source: "00000000-00002616.00000000.225023.4E470000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002616.00000000.225023.4E470000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002616.00000000.225023.4E470000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002616.00000000.225023.4E470000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002616.00000000.225023.4E470000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lrnnfrnnfrnnfrnnfrnnfrnnfsnnfsnnf+snnf?snnfssnnfgsnnf" - Source: "00000000-00002616.00000000.225023.4E470000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0bjnffhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002616.00000000.225023.4E470000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead" - Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00002616.00000000.225023.66C20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002616.00000000.225023.66C20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002616.00000000.225023.66C20000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcq6inf0inf0inf" - Source: "00000000-00002616.00000001.225346.4E470000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002616.00000001.225346.4E470000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002616.00000001.225346.4E470000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002616.00000001.225346.4E470000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002616.00000001.225346.4E470000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002616.00000001.225346.4E470000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e,czc%wvf" - Source: "00000000-00002616.00000001.225346.4E470000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002616.00000001.225346.4E470000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002616.00000001.225346.4E470000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%y[gnfbgnfcgnfkcgnfygnfcgnf]gnfdigi" - Source: "00000000-00002616.00000001.225346.4E470000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002616.00000001.225346.4E470000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002616.00000001.225346.4E470000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002616.00000001.225346.4E470000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002616.00000001.225346.4E470000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002616.00000001.225346.4E470000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002616.00000001.225346.4E470000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002616.00000001.225346.4E470000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002616.00000001.225346.4E470000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0f%w0digicert" - Source: "00000000-00002616.00000001.225346.4E470000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002616.00000001.225346.4E470000.00000004.mdmp") Found URL "http://crl.vwashington1redmond1microsoft" - Source: "00000000-00002616.00000001.225346.4E470000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*loft" - Source: "00000000-00002616.00000001.225346.4E470000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3@-gnf@-gnf4gnf=gnf" - Source: "00000000-00002616.00000001.225346.4E470000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002616.00000001.225346.4E470000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002616.00000001.225346.4E470000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002616.00000001.225346.4E470000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002616.00000001.225346.4E470000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lrnnfrnnfrnnfrnnfrnnfrnnfsnnfsnnf+snnf?snnfssnnfgsnnf" - Source: "00000000-00002616.00000001.225346.4E470000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002616.00000001.225346.4E470000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0s9_>washington1x" - Source: "00000000-00002616.00000001.225346.4E559000.00000004.mdmp") Found URL "http://msdn.microsoft.com/en-us/library/yfsftwz6.aspx" - Source: "00000000-00002616.00000001.225346.5E630000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema" - Source: "00000000-00002616.00000001.225346.5E630000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4n!t" - Source: "00000000-00002616.00000001.225346.66D9A000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsofcerts/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00002616.00000001.225346.66D9A000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-jyqf;?0xdb7j[agysf0d1aoc1402+229879+719555cb-6de2-446c-acba-d90894acd8720m0k0ichttp://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-frastructure.ciminstance[]" - Source: "00000000-00002616.00000001.225346.66D9A000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00002616.00000001.225346.66D9A000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00002616.00000001.225346.88152000.00000002.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00004768.00000000.225797.25110000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00004768.00000000.225797.25110000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn9iqmgvw,czcaucooe:j9_($n6n5z6n5a6n5q6n5v1.2.840.113549.1.1.41.2.840.113549.1.1.2system.management.dll" - Source: "00000000-00004768.00000000.225797.25110000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004768.00000000.225797.25110000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00004768.00000000.225797.25110000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsanonymously" - Source: "00000000-00004768.00000000.225797.25110000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00004768.00000000.225797.25110000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsa+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00004768.00000000.225797.25110000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004768.00000000.225797.25110000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004768.00000000.225797.25110000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00004768.00000000.225797.258B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004768.00000000.225797.258B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004768.00000000.225797.258B0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00004768.00000001.226106.25110000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00004768.00000001.226106.25110000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn9iqmgvw,czcaucooe:j9_($n6n5z6n5a6n5q6n5v1.2.840.113549.1.1.41.2.840.113549.1.1.2system.management.dll" - Source: "00000000-00004768.00000001.226106.25110000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004768.00000001.226106.25110000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00004768.00000001.226106.25110000.00000004.mdmp") Found URL "http://www.microsoft.com/windows2&,l%ory08>=i@iqoz" - Source: "00000000-00004768.00000001.226106.2518E000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsheap" - Source: "00000000-00004768.00000001.226106.2518E000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsmicrosoft.powershell.cmdletization.generatedtypesrefemit_inmemorymanifestmodulemscorlibsystemenumstateenummicrosoft.powershell.cmdletization.generatedtypes.scheduledtaskvalue__unknowndisabledqueuedreadyrunningcompatibilityenumvistawin7win8runlevelenumlimitedhighestprocesstokensidtypeenumnoneunrestricteddefaultlogontypeenumpasswordinteractivegroupserviceaccountinteractiveorpasswordmultipleinstancesenumparallelqueueignorenewclustertasktypeenumresourcespecificanynodeclusterwideneratedtypes.scheduledtaskwrapnonexceptionthrows" - Source: "00000000-00004768.00000001.226106.2518E000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004768.00000001.226106.2518E000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00004768.00000001.226106.258B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004768.00000001.226106.258B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00004768.00000001.226106.25A2C000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004768.00000001.226106.25A2C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004768.00000001.226106.25A2C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pk4ngton1redmond1microsoft" - Source: "00000000-00004768.00000001.226106.25A2C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.c_n0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004768.00000001.226106.25A2C000.00000004.mdmp") Found URL "http://www.microsoft.cor]i='ea+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00004768.00000001.226106.25A2C000.00000004.mdmp") Found URL "http://crl.micro/pki/crl/products/microoceraut_2010-06-2n0l0j>http://www.micom/pki/certs/microoceraut_2010-06-23.crwww.microsoft.com/pki/docs/cps/default.h$vktok0d$" - Source: "00000000-00004768.00000001.226106.25A2C000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f9iqmgvw,czcu" - Source: "00000000-00006400.00000000.226542.48790000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e@yh(7yh(7yh(" - Source: "00000000-00006400.00000000.226542.48790000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006400.00000000.226542.48790000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006400.00000000.226542.48790000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006400.00000000.226542.48790000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006400.00000000.226542.48790000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006400.00000000.226542.48790000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;@yh(7yh(7yh(" - Source: "00000000-00006400.00000000.226542.48790000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006400.00000000.226542.48790000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006400.00000000.226542.48790000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006400.00000000.226542.48790000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006400.00000000.226542.48790000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006400.00000000.226542.48790000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0.zh(1.3.6.1.4.1.311.2.1.251.2.840.10045.2.1pno.(wvtasn1spclinkdecodemicrosoft" - Source: "00000000-00006400.00000000.226542.48790000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006400.00000000.226542.48790000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c30zh(@h" - Source: "00000000-00006400.00000000.226542.48790000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00006400.00000000.226542.48790000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00006400.00000000.226542.48790000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00006400.00000000.226542.48790000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006400.00000000.226542.48790000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l.vf" - Source: "00000000-00006400.00000000.226542.48790000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4g" - Source: "00000000-00006400.00000000.226542.48790000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0washington1redmond1microsoft" - Source: "00000000-00006400.00000000.226542.48790000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006400.00000000.226542.48790000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00006400.00000000.226542.48F30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006400.00000000.226542.48F30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006400.00000000.226542.48F30000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00006400.00000000.226542.8A1C2000.00000002.mdmp") Found URL "http://msdn.microsoft.com/en-us/library/yfsftwz6.aspx" - Source: "00000000-00006400.00000001.226795.40690000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema" - Source: "00000000-00006400.00000001.226795.40690000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00006400.00000001.226795.48790000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcu" - Source: "00000000-00006400.00000001.226795.48790000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e@yh(7yh(7yh(" - Source: "00000000-00006400.00000001.226795.48790000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006400.00000001.226795.48790000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006400.00000001.226795.48790000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006400.00000001.226795.48790000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006400.00000001.226795.48790000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006400.00000001.226795.48790000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;@yh(7yh(7yh(" - Source: "00000000-00006400.00000001.226795.48790000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006400.00000001.226795.48790000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006400.00000001.226795.48790000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006400.00000001.226795.48790000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006400.00000001.226795.48790000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006400.00000001.226795.48790000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0.zh(1.3.6.1.4.1.311.2.1.251.2.840.10045.2.1pno.(wvtasn1spclinkdecodemicrosoft" - Source: "00000000-00006400.00000001.226795.48790000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006400.00000001.226795.48790000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c30zh(@h" - Source: "00000000-00006400.00000001.226795.48790000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00006400.00000001.226795.48790000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00006400.00000001.226795.48790000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00006400.00000001.226795.48790000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006400.00000001.226795.48790000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l.vf" - Source: "00000000-00006400.00000001.226795.48790000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4g" - Source: "00000000-00006400.00000001.226795.48790000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0qs[\washington1redmond1microsoft" - Source: "00000000-00006400.00000001.226795.48833000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006400.00000001.226795.48833000.00000004.mdmp") Found URL "http://ww$" - Source: "00000000-00006400.00000001.226795.49030000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00006400.00000001.226795.49072000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00006400.00000001.226795.49072000.00000004.mdmp") Found URL "http://www.microsoft.com/windows\l" - Source: "00000000-00006400.00000001.226795.49072000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,mm.(ev$fna.(prg?j?" - Source: "00000000-00006400.00000001.226795.49072000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j9]mw?" - Source: "00000000-00006400.00000001.226795.49072000.00000004.mdmp") Found URL "http://crl.microsoft.coings" - Source: "00000000-00006400.00000001.226795.49072000.00000004.mdmp")55:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp")56:T411,Process "powershell.exe" with commandline "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\\Microsoft\\Protect\\SystemDispatchSvc.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\\Microsoft\\Windows\\Maintenance\\StateManagerRuntime' -Action $a -Trigger $t -Settings $s"" (UID: 00000000-00002616) Process "powershell.exe" with commandline "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\\SystemDispatchSvc.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\\Microsoft\\Windows\\Maintenance\\WinSvcHost' -Action $a -Trigger $t -Settings $s"" (UID: 00000000-00004768)57:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002616) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00002616) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002616) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00002616) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00002616) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00002616) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00002616) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00002616) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00002616) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00002616) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00002616) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00002616) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00002616) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00002616) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00002616) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00002616) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00002616) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00002616) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00002616) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00002616)58:T1612,Found string "Error: format filename:base64" (Indicator: "base64"; File: "23ed51909e20f1e128aaf46cd8bc76f5c91488f80e9def6a101e0508a085629b.bin") Found string "$b=[Convert]::ToBase64String([IO.File]::ReadAllBytes($f))" (Indicator: "base64"; File: "23ed51909e20f1e128aaf46cd8bc76f5c91488f80e9def6a101e0508a085629b.bin") Found string "$b=[Convert]::ToBase64String([IO.File]::ReadAllBytes($f))" (Indicator: "ToBase64String"; File: "23ed51909e20f1e128aaf46cd8bc76f5c91488f80e9def6a101e0508a085629b.bin") file/memory contains long string with (Indicator: ".encrypt"; File: "23ed51909e20f1e128aaf46cd8bc76f5c91488f80e9def6a101e0508a085629b.bin") Found string "$z=[IO.Path]::GetTempFileName()+'.zip';Compress-Archive -Path '%s\*' -DestinationPath $z -Force;$b=[Convert]::ToBase64String([IO.File]::ReadAllBytes($z));Remove-Item $z;'DOWNLOAD_DATA:archive.zip:'+$b" (Indicator: "base64"; File: "23ed51909e20f1e128aaf46cd8bc76f5c91488f80e9def6a101e0508a085629b.bin") Found string "$z=[IO.Path]::GetTempFileName()+'.zip';Compress-Archive -Path '%s\*' -DestinationPath $z -Force;$b=[Convert]::ToBase64String([IO.File]::ReadAllBytes($z));Remove-Item $z;'DOWNLOAD_DATA:archive.zip:'+$b" (Indicator: "ToBase64String"; File: "23ed51909e20f1e128aaf46cd8bc76f5c91488f80e9def6a101e0508a085629b.bin") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00002616.00000000.225023.4E470000.00000004.mdmp, 00000000-00002616.00000001.225346.4E470000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00002616.00000000.225023.4E470000.00000004.mdmp, 00000000-00002616.00000001.225346.4E470000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00002616.00000000.225023.4E630000.00000004.mdmp") Found string "[-WindowStyle