24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 5a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 25802493e7ef… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 25802493e7ef…. Malware family: Trojan.Generic. Threat score 100/100. 13/27 AV engines flagged this file. 13 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/25802493e7ef64523d6ab13ad6e5555b2b08fd4576ae2edd905ad939d256aa3a","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","25802493e7ef64523d6ab13ad6e5555b2b08fd4576ae2edd905ad939d256aa3a"],"about":{"@type":"SoftwareApplication","name":"25802493e7ef64523d6ab13ad6e5555b2b08fd4576ae2edd905ad939d256aa3a.bin","applicationCategory":["peexe","executable"],"identifier":"25802493e7ef64523d6ab13ad6e5555b2b08fd4576ae2edd905ad939d256aa3a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":13,"total":27},"behavioralIndicators":{"malicious":13,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1258,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00004184.00000000.185665.02B10000.00000004.mdmp, 00000000-00004184.00000000.185665.07240000.00000004.mdmp, 00000000-00004184.00000001.186392.02B10000.00000004.mdmp, 00000000-00004184.00000001.186392.07240000.00000004.mdmp, 00000000-00004184.00000001.186392.08870000.00000004.mdmp") Found string ".Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00004184.00000000.185665.02B10000.00000004.mdmp") Found string "2,"System.Management.Automation Version=3.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35",0" (Source: "00000000-00004184.00000000.185665.02B10000.00000004.mdmp, 00000000-00004184.00000001.186392.02B10000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00004184.00000000.185665.02B10000.00000004.mdmp, 00000000-00004184.00000000.185665.04A80000.00000004.mdmp, 00000000-00004184.00000001.186392.02B10000.00000004.mdmp") Found string "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00004184.00000000.185665.04A80000.00000004.mdmp") Found string "System.Management.Automation" (Source: "00000000-00004184.00000000.185665.04A80000.00000004.mdmp, 00000000-00004184.00000001.186392.04450000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00004184.00000000.185665.04A80000.00000004.mdmp, 00000000-00004184.00000001.186392.071EA000.00000004.mdmp") Found string "file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Management.Automation/v4.0_3.0.0.0__31bf3856ad364e35/System.Management.Automation.dll" (Source: "00000000-00004184.00000000.185665.04A80000.00000004.mdmp") Found string "System.Management.Automation.resources, Version=3.0.0.0, Culture=en-US, PublicKeyToken=31bf3856ad364e35" (Source: "00000000-00004184.00000000.185665.04A80000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput($inputScript, $cursorColumn," (Source: "00000000-00004184.00000000.185665.04A80000.00000004.mdmp") Found string "[System.Management.Automation.Language.Ast] $ast," (Source: "00000000-00004184.00000000.185665.04A80000.00000004.mdmp") Found string "[System.Management.Automation.Language.Token[]] $tokens," (Source: "00000000-00004184.00000000.185665.04A80000.00000004.mdmp") Found string "[System.Management.Automation.Language.IScriptPosition] $positionOfCursor," (Source: "00000000-00004184.00000000.185665.04A80000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput(" (Source: "00000000-00004184.00000000.185665.04A80000.00000004.mdmp") Found string "# .ExternalHelp System.Management.Automation.dll-help.xml" (Source: "00000000-00004184.00000000.185665.04A80000.00000004.mdmp") Found string "[System.Management.Automation.PSCredential]" (Source: "00000000-00004184.00000000.185665.04A80000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('New-Item', [System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00004184.00000000.185665.04A80000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('Out-String',[System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00004184.00000000.185665.04A80000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=MSIL" (Source: "00000000-00004184.00000000.185665.04A80000.00000004.mdmp") Found string "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\System.Management.Automation.dll" (Source: "00000000-00004184.00000000.185665.04A80000.00000004.mdmp") Found string "System.Management.Automation.dll-Help.xml" (Source: "00000000-00004184.00000000.185665.04A80000.00000004.mdmp") Found string "System.Management.Automationo" (Source: "00000000-00004184.00000000.185665.07240000.00000004.mdmp, 00000000-00004184.00000001.186392.07240000.00000004.mdmp") Found string "policy.3.0.System.Management.Automation." (Source: "00000000-00004184.00000001.186392.06FE9000.00000004.mdmp") Found string "policy.3.0.System.Management.Automation.resources" (Source: "00000000-00004184.00000001.186392.071EA000.00000004.mdmp") Found string "NDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00004184.00000001.186392.08870000.00000004.mdmp")26:T5a5,file/memory contains long string with (Indicator: "add-mppreference"; File: "AMSI") Found reference string "Add-MpPreference -ExclusionPath $updpath" (Indicator: "add-mppreference"; Source: "00000000-00002580.00000000.196204.04400000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $ProgramFilesX86" (Indicator: "add-mppreference"; Source: "00000000-00002580.00000000.196204.04400000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $AppData" (Indicator: "add-mppreference"; Source: "00000000-00002580.00000000.196204.04400000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $LocalAppData" (Indicator: "add-mppreference"; Source: "00000000-00002580.00000000.196204.04400000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $updpath" (Indicator: "add-mppreference"; Source: "00000000-00002588.00000000.196205.03C00000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $ProgramFilesX86" (Indicator: "add-mppreference"; Source: "00000000-00002588.00000000.196205.03C00000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $AppData" (Indicator: "add-mppreference"; Source: "00000000-00002588.00000000.196205.03C00000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $LocalAppData" (Indicator: "add-mppreference"; Source: "00000000-00002588.00000000.196205.03C00000.00000004.mdmp")27:T684,Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "25802493e7ef64523d6ab13ad6e5555b2b08fd4576ae2edd905ad939d256aa3a.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "25802493e7ef64523d6ab13ad6e5555b2b08fd4576ae2edd905ad939d256aa3a.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "25802493e7ef64523d6ab13ad6e5555b2b08fd4576ae2edd905ad939d256aa3a.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "25802493e7ef64523d6ab13ad6e5555b2b08fd4576ae2edd905ad939d256aa3a.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002580.00000000.196204.04400000.00000004.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002588.00000000.196205.03C00000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004184.00000000.185665.00A51000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004184.00000000.185665.00A51000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004184.00000000.185665.00A51000.00000002.mdmp, 00000000-00004184.00000001.186392.6E915000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004184.00000000.185665.00A51000.00000002.mdmp, 00000000-00004184.00000001.186392.6E915000.00000002.mdmp")28:T4bd,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "25802493e7ef64523d6ab13ad6e5555b2b08fd4576ae2edd905ad939d256aa3a.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "25802493e7ef64523d6ab13ad6e5555b2b08fd4576ae2edd905ad939d256aa3a.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002580.00000000.196204.04400000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002580.00000000.196204.04400000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002588.00000000.196205.03C00000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002588.00000000.196205.03C00000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004184.00000000.185665.00A51000.00000002.mdmp, 00000000-00004184.00000001.186392.6E915000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004184.00000000.185665.00A51000.00000002.mdmp, 00000000-00004184.00000001.186392.6E915000.00000002.mdmp")29:T71b,file/memory contains long string with (Indicator: "Export-ModuleMember"; File: "AMSI") Found string "elWrapper.EndProcessing() } } catch { throw } } # .EXTERNALHELP MSFT_MpWDOScan.cdxml-Help.xml}Microsoft.PowerShell.Core\Export-ModuleMember -Function 'Start-MpWDOScan' -Alias '*'" (Indicator: "Export-ModuleMember"; File: "AMSI") Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00004184.00000000.185665.04A80000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00004184.00000000.185665.04A80000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00004184.00000000.185665.04A80000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00004184.00000000.185665.04A80000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00004184.00000000.185665.04A80000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00004184.00000000.185665.04A80000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00004184.00000000.185665.04A80000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00004184.00000000.185665.04A80000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00004184.00000000.185665.04A80000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00004184.00000000.185665.04A80000.00000004.mdmp") Found string "# 170..180 | format-hex" (Indicator: "Format-Hex"; Source: "00000000-00004184.00000001.186392.088F5000.00000004.mdmp")2a:T722,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002580.00000000.196204.04400000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002580.00000000.196204.04400000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00002580.00000000.196204.04400000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00002580.00000000.196204.04400000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002588.00000000.196205.03C00000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002588.00000000.196205.03C00000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00002588.00000000.196205.03C00000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00002588.00000000.196205.03C00000.00000004.mdmp")2b:T537,"mn0<0http://cps.chambersign.org/cps/chambersroot.html0?w" - Source: "00000000-00002580.00000000.196204.04400000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0990709183120z190709184036z0salt" - Source: "00000000-00002580.00000000.196204.04400000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0;09071http://crl.usertrust.com/utn-userfirst-object.crl0)k%%-qcn>k't" - Source: "00000000-00002580.00000000.196204.04400000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?certificate041101171404z350101053719zcertificateaddtrust" - Source: "00000000-00002580.00000000.196204.04400000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00002580.00000000.196204.04400000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl;?f6xd" - Source: "00000000-00002580.00000000.196204.04400000.00000004.mdmp") Found URL "http://crl.comodo.net/aaacertificateservices.crlstarfield" - Source: "00000000-00002580.00000000.196204.04400000.00000004.mdmp") Found URL "http://crl.chambersign.org/chambersroot.crlquovadis" - Source: "00000000-00002580.00000000.196204.04400000.00000004.mdmp") Found URL "https://ocsp.quovadisoffshore.com(c)" - Source: "00000000-00002580.00000000.196204.04400000.00000004.mdmp") Found URL "https://ocsp.quovadisoffshore.com0reliance" - Source: "00000000-00002580.00000000.196204.04400000.00000004.mdmp") Found URL "http://www.quovadis.bm0quovadis" - Source: "00000000-00002580.00000000.196204.04400000.00000004.mdmp") Found URL "http://www.chambersign.orgchambers" - Source: "00000000-00002580.00000000.196204.04400000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00002580.00000000.196204.04400000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00002588.00000000.196205.03C00000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00002588.00000000.196205.03C00000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00002588.00000000.196205.03C00000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00002588.00000000.196205.03C00000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00002588.00000000.196205.03C00000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00002588.00000000.196205.03C00000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00002588.00000000.196205.03C00000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00002588.00000000.196205.03C00000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00002588.00000000.196205.03C00000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0&" - Source: "00000000-00002588.00000000.196205.03C00000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectsalt" - Source: "00000000-00002588.00000000.196205.03C00000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectgeotrust" - Source: "00000000-00002588.00000000.196205.03C00000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crl0addtrust" - Source: "00000000-00002588.00000000.196205.03C00000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" - Source: "00000000-00002588.00000000.196205.03C00000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0okk,%$rdtpmarizona1scottsdale1%0" - Source: "00000000-00002588.00000000.196205.03C00000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cps0g0e1quovadis" - Source: "00000000-00002588.00000000.196205.03C00000.00000004.mdmp") Found URL "http://www.chambersign.org1" - Source: "00000000-00002588.00000000.196205.03C00000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn0<0http://cps.chambersign.org/cps/chambersroot.html0?w" - Source: "00000000-00002588.00000000.196205.03C00000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0990709183120z190709184036z0salt" - Source: "00000000-00002588.00000000.196205.03C00000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0;09071http://crl.usertrust.com/utn-userfirst-object.crl0)k%%-qcn>k't" - Source: "00000000-00002588.00000000.196205.03C00000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?digicert" - Source: "00000000-00002588.00000000.196205.03C00000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00004184.00000000.185665.02BF1000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00004184.00000000.185665.02BF1000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004184.00000000.185665.02BF1000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004184.00000000.185665.02BF1000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;1.2.840.113549.1.1.5gu2http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004184.00000000.185665.02DB0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004184.00000000.185665.02DB0000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00004184.00000000.185665.07240000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004184.00000000.185665.07240000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004184.00000000.185665.07240000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fe" - Source: "00000000-00004184.00000000.185665.07240000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004184.00000000.185665.07240000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004184.00000000.185665.07240000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00004184.00000000.185665.07240000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>homedrive=c:os=windows_ntsystem.corepsystem.xml)systemdrive=c:systmscomscosystem.numericsmscosysth41hpmscosystmscokayx8gvp@p;]dgvp@p<]pgvp@p=]\gvp@p>]washington1redmond1microsoft" - Source: "00000000-00004184.00000000.185665.07240000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00004184.00000000.185665.6E901000.00000020.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00004184.00000001.186392.02B10000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00004184.00000001.186392.02B10000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00004184.00000001.186392.02B10000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004184.00000001.186392.02B10000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00004184.00000001.186392.02BF1000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00004184.00000001.186392.02BF1000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00004184.00000001.186392.02BF1000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00004184.00000001.186392.02BF1000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00004184.00000001.186392.02BF1000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00004184.00000001.186392.02BF1000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00004184.00000001.186392.02BF1000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00004184.00000001.186392.02BF1000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00004184.00000001.186392.02BF1000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004184.00000001.186392.02BF1000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004184.00000001.186392.02BF1000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;1.2.840.113549.1.1.5p7xsipverifyindirectdata2.16.840.1.113730.1.1g6" - Source: "00000000-00004184.00000001.186392.02BF1000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004184.00000001.186392.02BF1000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004184.00000001.186392.02BF1000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004184.00000001.186392.02BF1000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004184.00000001.186392.02BF1000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004184.00000001.186392.02BF1000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004184.00000001.186392.02BF1000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004184.00000001.186392.02BF1000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0root" - Source: "00000000-00004184.00000001.186392.02BF1000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00004184.00000001.186392.02BF1000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00004184.00000001.186392.07240000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004184.00000001.186392.07240000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004184.00000001.186392.07240000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004184.00000001.186392.07240000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00004184.00000001.186392.07329000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0^k*y-g&ui\l!" - Source: "00000000-00004184.00000001.186392.08870000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0n//ww;pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0.textionhandlin" - Source: "00000000-00004184.00000001.186392.08870000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt06" - Source: "00000000-00004184.00000001.186392.088D1000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004184.00000001.186392.088F5000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005080.00000000.186589.04130000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00005080.00000000.186589.06880000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00005080.00000000.186589.06880000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00005080.00000000.186589.06880000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00005080.00000000.186589.06880000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00005080.00000000.186589.06880000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crl0addtrust" - Source: "00000000-00005080.00000000.186589.06880000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" - Source: "00000000-00005080.00000000.186589.06880000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0okk,%$rdtpm*vppc:\windows\system32\/drivers/etc/hostssetfilecompletionnotificationmodeskb6e/e->" - Source: "00000000-00005080.00000000.186589.06880000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00005080.00000000.186589.06880000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00005080.00000000.186589.06880000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectsalt" - Source: "00000000-00005080.00000000.186589.06880000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectgeotrust" - Source: "00000000-00005080.00000000.186589.06880000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00005080.00000000.186589.06880000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00005080.00000000.186589.06880000.00000004.mdmp") Found URL "http://www.chambersign.org1" - Source: "00000000-00005080.00000000.186589.06880000.00000004.mdmp") Found URL "http://policy.camerfirma.com0+,t" - Source: "00000000-00005080.00000000.186589.06880000.00000004.mdmp") Found URL "http://policy.camerfirma.com0i$y'o)yrez3__68vr1[g-hlp]iskc" - Source: "00000000-00005080.00000000.186589.06880000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006976.00000000.185845.03910000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00006976.00000000.185845.05C80000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00006976.00000000.185845.05C80000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00006976.00000000.185845.05C80000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00006976.00000000.185845.05C80000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00006976.00000000.185845.05C80000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0&" - Source: "00000000-00006976.00000000.185845.05C80000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crl0addtrust" - Source: "00000000-00006976.00000000.185845.05C80000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" - Source: "00000000-00006976.00000000.185845.05C80000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0okk,%$rdtpm*vppa3d27cfa-1e7a-4ff8-8004-2be13417b6b13aa77714-be05-9828-b0ee-c0eff32414be(c)" - Source: "00000000-00006976.00000000.185845.05C80000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00006976.00000000.185845.05C80000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00006976.00000000.185845.05C80000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectsalt" - Source: "00000000-00006976.00000000.185845.05C80000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectgeotrust" - Source: "00000000-00006976.00000000.185845.05C80000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00006976.00000000.185845.05C80000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00006976.00000000.185845.05C80000.00000004.mdmp") Found URL "http://www.chambersign.org1" - Source: "00000000-00006976.00000000.185845.05C80000.00000004.mdmp") Found URL "http://policy.camerfirma.com0+,t" - Source: "00000000-00006976.00000000.185845.05C80000.00000004.mdmp") Found URL "http://policy.camerfirma.com0i$y'o)yrez3__68vr1[g-hlp]iskc" - Source: "00000000-00006976.00000000.185845.05C80000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cps0g0e1quovadis" - Source: "00000000-00006976.00000000.185845.05C80000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006976.00000001.185859.03910000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007196.00000000.185389.00560000.00000004.mdmp") Found URL "http://o.pki.goog/s/we1/i9e0%http://i.pki.goog/we1.crt0" - Source: "00000000-00007196.00000000.185389.05800000.00000004.mdmp") Found URL "http://c.pki.goog/we1/jkijdkdqfbc.crl0-(dy-;w9zv!)hwqx2@20260425020000z0s0q0i0" - Source: "00000000-00007196.00000000.185389.05800000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00007196.00000000.185389.05800000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00007196.00000000.185389.05800000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00007196.00000000.185389.05800000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:;avdallusersprofile=c:\programdataappdata=c:\users\hapubws\appdata\roamingcomspec=c:\windows\system32\cmd.exelocalappdata=c:\users\hapubws\appdata\locallogonserver=\\desktop-fvvf82anvm_symlink=c:\program" - Source: "00000000-00007196.00000000.185389.05800000.00000004.mdmp") Found URL "https://dns.google/resolve?name=salator.es=*\\e)u" - Source: "00000000-00007196.00000000.185389.05800000.00000004.mdmp") Found URL "http://c.pki.goog/we1/jkijdkdqfbc.crl!lgwg4229" - Source: "00000000-00007196.00000000.185389.05800000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00007196.00000000.185389.05800000.00000004.mdmp") Found URL "https://salator.es/sa1at/jhttps://salator.es/sa1at/sat," - Source: "00000000-00007196.00000000.185389.05800000.00000004.mdmp") Found URL "http://o.pki.goog/s/we1/i9ehttp://i.pki.goog/we1.crtvj" - Source: "00000000-00007196.00000000.185389.05800000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crlgoogle" - Source: "00000000-00007196.00000000.185389.05800000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crthttp://c.pki.goog/r/gsr1.crlqqrk+qx2@ktd'n\ijr;\l;avdwt8h-kwxu:2i_-kwxu:2i_wt8hk/_iwt8hs)q.8s)q.8wt8hy-),b/]93:/]93:n;" - Source: "00000000-00007196.00000000.185389.05800000.00000004.mdmp") Found URL "https://salator.es/sa1at/https://salator.es/sa1at/sat," - Source: "00000000-00007196.00000000.185389.05800000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00007196.00000000.185389.05800000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00007196.00000000.185389.05800000.00000004.mdmp") Found URL "http://o.pki.goog/wr2google" - Source: "00000000-00007196.00000000.185389.05800000.00000004.mdmp") Found URL "http://i.pki.goog/r1.crtglobalsign" - Source: "00000000-00007196.00000000.185389.05800000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00007196.00000000.185389.05800000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=qjjbwtcibpca8vuwkha1ywr4qfp34%2&=lir&=lir]m" (Indicator: "GetDC"; Source: "00000000-00004140.00000000.185046.00500000.00000004.mdmp, 00000000-00004140.00000001.185072.00500000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004140.00000000.185046.00500000.00000004.mdmp, 00000000-00004140.00000001.185072.00500000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004140.00000000.185046.00500000.00000004.mdmp, 00000000-00004140.00000001.185072.00500000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004140.00000000.185046.00500000.00000004.mdmp, 00000000-00004140.00000001.185072.00500000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004140.00000000.185046.00500000.00000004.mdmp, 00000000-00004140.00000001.185072.00500000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004140.00000000.185046.00500000.00000004.mdmp, 00000000-00004140.00000001.185072.00500000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004140.00000000.185046.00500000.00000004.mdmp, 00000000-00004140.00000001.185072.00500000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004140.00000000.185046.00500000.00000004.mdmp, 00000000-00004140.00000001.185072.00500000.00000004.mdmp")4c:T1369,Found string "aesKey" (Indicator: "aes"; File: "25802493e7ef64523d6ab13ad6e5555b2b08fd4576ae2edd905ad939d256aa3a.bin") Found string "chacha8" (Indicator: "chacha"; File: "25802493e7ef64523d6ab13ad6e5555b2b08fd4576ae2edd905ad939d256aa3a.bin") Found string "*aes.CTR" (Indicator: "aes"; File: "25802493e7ef64523d6ab13ad6e5555b2b08fd4576ae2edd905ad939d256aa3a.bin") Found string "crypto/aes" (Indicator: "aes"; File: "25802493e7ef64523d6ab13ad6e5555b2b08fd4576ae2edd905ad939d256aa3a.bin") Found string "`aesSK" (Indicator: "aes"; File: "25802493e7ef64523d6ab13ad6e5555b2b08fd4576ae2edd905ad939d256aa3a.bin") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; File: "00000000-00004184.00000001.186392.00A41000.00000020.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00004184.00000000.185665.02B10000.00000004.mdmp, 00000000-00004184.00000000.185665.07240000.00000004.mdmp, 00000000-00004184.00000001.186392.02B10000.00000004.mdmp, 00000000-00004184.00000001.186392.07240000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004184.00000000.185665.02BF1000.00000004.mdmp, 00000000-00004184.00000000.185665.07240000.00000004.mdmp, 00000000-00004184.00000001.186392.02BF1000.00000004.mdmp, 00000000-00004184.00000001.186392.07240000.00000004.mdmp, 00000000-00004184.00000001.186392.08870000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004184.00000000.185665.04A80000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004184.00000000.185665.04A80000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00004184.00000000.185665.04A80000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00004184.00000000.185665.04A80000.00000004.mdmp") Found string "[-WindowStyle