34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 60:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4a0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ser.Lazy.Generic Sample 4ff54bc771dc… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 4ff54bc771dc…. Malware family: Ser.Lazy.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 18 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4ff54bc771dc97403996794c50ded1a97b000c3f6eeff64afe3d049735e6bcdc","keywords":["Malicious","Ser.Lazy.Generic","malware analysis","sandbox report","threat intelligence","4ff54bc771dc97403996794c50ded1a97b000c3f6eeff64afe3d049735e6bcdc"],"about":{"@type":"SoftwareApplication","name":"4ff54.Trojan.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"4ff54bc771dc97403996794c50ded1a97b000c3f6eeff64afe3d049735e6bcdc","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ser.Lazy.Generic","antivirusDetections":{"malicious":12,"total":28},"behavioralIndicators":{"malicious":18,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T507,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp")37:T5ae,Found PE header "MZ" - Source: "00000000-00002544.00000000.68821.00390000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00002544.00000000.68821.6EF80000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004048.00000000.68527.00FC0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004048.00000000.68527.07C90000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004048.00000000.68527.07CB0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004048.00000000.68527.09CA0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004048.00000000.68527.6EB00000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004048.00000000.68527.6EBA0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004120.00000000.68832.00390000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004120.00000000.68832.6EF80000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006888.00000000.68955.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00006888.00000000.68955.008C0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006888.00000001.70874.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00006888.00000001.70874.008C0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006888.00000002.72792.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00006888.00000002.72792.008C0000.00000002.mdmp")38:T27be,"4ff54.Trojan.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000018000000355e42c82325a47308254f01687d7574a8f34f013054a473f1adabbafeffffffc4f24f01b240a37368f24f010000647460f34f01cb40a373e0df8a7608000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff3400000000000000f0f24f0100000000080000000000000000000000000000000000000000000000000000002d5e42c80000000030f34f0169923b74ffffffff34000000f0f24f0108000000000000000000647460f34f0127943b74f8f24f010b0000000000000048f34f01 (UID: 00000000-00004048) "4ff54.Trojan.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004048) "4ff54.Trojan.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004048) "4ff54.Trojan.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000058d54f01fcd44f01226e4c7600004305000000002d6e4c7619ccc57d2d000000ecb7017580d54f010000160110d56e0390a569030c00000080000000c0d44f010000160144d54f0170c84d761d69d80afeffffff2d000000d0cc10752700000014d54f01856a4e761c23537654d54f01f85f4e7608000000bb694d76b2694d76b1cdc57d2d000000ecb7017527000000d0cc107528d54f012d000000d0cc10752700000058d54f01856a4e761c235376a0d54f017e8a0f75ee8c0f75738a0f75dae787492d000000ecb7017527000000d0cc1075e428430578284305dae7874968d54f01fc524d7554d64f01e0840f7542c3833dfeffffff738a0f75 (UID: 00000000-00004048) "4ff54.Trojan.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000f16e187df16e00000000d0a9a67400009f749011a07488be6e0318bb680340e16e0318eb4f01feffffffc0ed4f01506a7377d8fc4943feffffffd8eb4f01eaa96f7788be6e030000000040e16e03a11400000a000b00b297f16e5c76f16e6876f16e40e16e0368586e0314000000000000000000000088be6e0300ec4f01cc2d747740e16e03000000004ce16e0300000000f800ea6e00000000cc0d24385ce87277684071770403000019000000110000001000000058bd670338ec4f018d9a0574f0b96703741a6f030000000058ec4f012c056703741a6f0370ec4f010000ea6efeffffff0400000020af057400000000000000000000ea6e60ec4f01 (UID: 00000000-00004048) "4ff54.Trojan.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000070770000000011b9397400000000c4505576000000001c0000000000430588e14f01000000002d9dba6ea301707718eb7d35404d4908d0079b0728000000d074ba6e3800000000009b0700000000a30000020000000004020006f02f4908a08043050e000000000000002000000000009b07cc019b0704089b070000000000089b070ce34f0180e14f01591670771c000000000000000407b96e00004305a8c26e032800000000000000000000000500000002000000000043051c000000000000002c5b4305a0e14f01ee1370771c000000ee13707700000000000000001c000000ffffffffc0e14f0150724c7600004305000000001c0000000407b96e (UID: 00000000-00004048) "4ff54.Trojan.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000006f77201b4b08201b4b0800000000886a4b0878be4a0850184b080c00000088be4a081100030050f56f7718474a0818474a080000000041f9c57d70bc4908c8374a082c00000080bc49080a002b0050f56f77b03a4b08b03a4b0800000000201b4b08c8be4a0860384b0811000000d8be4a0801001100700a9b076400000009f9c57d18474a0818474a0800000000feffffff84704c7618e24f0165704c76000043050000000084704c76fdfac57db03a4b08b03a4b0800000000e32eb56e18474a08b5ceb16ea288b98de0e14f01176fb26e74e24f0170c84d76c56ad80afeffffff84704c760a8eb46eb03a4b08f08db46e40e24f01a7ceb16e01000000 (UID: 00000000-00004048) "4ff54.Trojan.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000006f77d0194b08d0194b08000000000000000078be4a0850184b080600000050f56f7700444a0800444a080000000084704c7670bc4908c8374a082300000080bc49080a002d00480d9b076400000050f56f77b03a4b08b03a4b0800000000d0194b08c8be4a0860384b0811000000d8be4a0801001100700a9b076400000000444a0800444a0800000000feffffff84704c7614e24f0165704c76000043050000000084704c76f1fac57db03a4b08b03a4b0800000000e32eb56e00444a08b5ceb16e5e8bb98ddce14f01176fb26e74e24f0170c84d76c56ad80afeffffff84704c760a8eb46eb03a4b08f08db46e3ce24f01a7ceb16e01000000504bb26e (UID: 00000000-00004048) "4ff54.Trojan.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000006e0350052273000000002a00e873fc86e1732a00e873fb8c70770000000000000000fc86e173c0e14f010000000000000000000000002a00e87309000000d8bd6e0309000000fc86e173000000005005227318000000654d42c82325a473d8134f010000000040e44f013054a473f1adabbafeffffff80e14f01ea5ea37330e14f010000000000000000035fa373ace14f0100000000000000000000000000000000000000000000000001000000000000000100000000000000a8e14f0100000000b8e14f0100000000ace14f010000000000000000000000004b00ba765d4d42c8c0e14f0184da3974d4e87d35c4e14f01dab9397400001973b8e14f01 (UID: 00000000-00004048) "4ff54.Trojan.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000c8c05a0c38cf7077f435670334c15a0c01000000a8356703f4356703a8356703040000000400000000e045740010000034c15a0c01000000a8356703cd9770779c9770770cca6838b50f3c74a83567030000707700000000c421eb670000000080ee42740100000000000000f8e24574000000000400000080a9057448404474f8e2457438c15a0c80e8037718d16e0380e8037734c15a0c0000000080e8037700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000002e40700344407003 (UID: 00000000-00004048) "4ff54.Trojan.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e67d7103fe7d7103 (UID: 00000000-00004048) "4ff54.Trojan.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003e086f0352086f03 (UID: 00000000-00004048) "4ff54.Trojan.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a6867103be867103 (UID: 00000000-00004048) "4ff54.Trojan.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000364170034c417003 (UID: 00000000-00004048) "4ff54.Trojan.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000008e857103a6857103 (UID: 00000000-00004048) "4ff54.Trojan.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000468271035e827103 (UID: 00000000-00004048)39:T7a6,"powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "")3a:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")3b:T3a6a,Found reference to API (Indicator: "GetObject"; File: "4ff54.Trojan") Found reference to API (Indicator: "MessageBox"; File: "4ff54.Trojan") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00002544.00000000.68821.00391000.00000020.mdmp, 00000000-00002544.00000000.68821.6EF81000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00002544.00000000.68821.00391000.00000020.mdmp, 00000000-00002544.00000000.68821.6EF81000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00002544.00000000.68821.00391000.00000020.mdmp, 00000000-00002544.00000000.68821.6EF81000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp, 00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp, 00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp, 00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp, 00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp, 00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp, 00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp, 00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp, 00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp, 00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp, 00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp, 00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp, 00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp, 00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp, 00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp, 00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp, 00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp, 00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp, 00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp, 00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp, 00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp, 00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp, 00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp, 00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp, 00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp, 00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp, 00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp, 00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp, 00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp, 00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp, 00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp, 00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp, 00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp, 00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00002544.00000000.68821.003A1000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00002544.00000000.68821.6EF81000.00000020.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00002544.00000000.68821.6EF81000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00002544.00000000.68821.6EF81000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00002544.00000000.68821.6EF81000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00002544.00000000.68821.6EF81000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00002544.00000000.68821.6EF81000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00002544.00000000.68821.6EF81000.00000020.mdmp, 00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00002544.00000000.68821.6EF81000.00000020.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00002544.00000000.68821.6EF95000.00000002.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00002544.00000000.68821.7F880000.00000002.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00004048.00000000.68527.00FC2000.00000002.mdmp, 00000000-00004048.00000000.68527.07C90000.00000004.mdmp, 00000000-00004048.00000000.68527.09CA0000.00000004.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00004048.00000000.68527.00FC2000.00000002.mdmp, 00000000-00004048.00000000.68527.09CA0000.00000004.mdmp")3c:T16b6,"SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00002544.00000000.68821.00391000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00002544.00000000.68821.00391000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00002544.00000000.68821.00391000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00002544.00000000.68821.00391000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00002544.00000000.68821.00391000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00002544.00000000.68821.00391000.00000020.mdmp "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\PowerShell\Transcriptionptionf" in Source: 00000000-00002544.00000000.68821.00E38000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\EnterpriseCertificates\Disallowed" in Source: 00000000-00002544.00000000.68821.02EB0000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\EnterpriseCertificates\Disallowed" in Source: 00000000-00002544.00000000.68821.02EB0000.00000004.mdmp "Y\MACHINE\Software\Microsoft\EnterpriseCertificates\Disallowed" in Source: 00000000-00002544.00000000.68821.02EB0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002544.00000000.68821.02FE0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002544.00000000.68821.02FE0000.00000004.mdmp "Y\MACHINE\SOFTWARE\Microsoft\Winttws`" in Source: 00000000-00002544.00000000.68821.04C68000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00002544.00000000.68821.04DD0000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00002544.00000000.68821.04DD0000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00002544.00000000.68821.04DD0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00002544.00000000.68821.04DD0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00002544.00000000.68821.04DD0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00002544.00000000.68821.04DD0000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00002544.00000000.68821.04DD0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00002544.00000000.68821.04DD0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00002544.00000000.68821.04DD0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002544.00000000.68821.04DD0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002544.00000000.68821.04DD0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002544.00000000.68821.04DD0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002544.00000000.68821.04DD0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002544.00000000.68821.04DD0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002544.00000000.68821.04DD0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed" in Source: 00000000-00002544.00000000.68821.07318000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\CTLs\CTLs" in Source: 00000000-00002544.00000000.68821.07318000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default" in Source: 00000000-00002544.00000000.68821.07418000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.0.Microsoft.PowerShell.ConsoleHost.resources_en-US_31bf3856ad364e35" in Source: 00000000-00002544.00000000.68821.07418000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00002544.00000000.68821.7F880000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00002544.00000000.68821.7F880000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00002544.00000000.68821.7F880000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00002544.00000000.68821.7F880000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00002544.00000000.68821.7F880000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00002544.00000000.68821.7F880000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00002544.00000000.68821.7F880000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00002544.00000000.68821.7F880000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00002544.00000000.68821.7F880000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00002544.00000000.68821.7F880000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00002544.00000000.68821.7F880000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00002544.00000000.68821.7F880000.00000002.mdmp3d:Tb16,Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Press Enter to continue...me of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "$resolvedPaths = Resolve-Path -Path $filePath" (Indicator: "Resolve-Path"; Source: "00000000-00002544.00000000.68821.07610000.00000004.mdmp")3e:T1778,"4ff54.Trojan.exe" touched "Removable Drives" (Path: "HKCU\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE") "4ff54.Trojan.exe" touched "Computer" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCSERVER32") "4ff54.Trojan.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "4ff54.Trojan.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "4ff54.Trojan.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "4ff54.Trojan.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "4ff54.Trojan.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "4ff54.Trojan.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "4ff54.Trojan.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "4ff54.Trojan.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "4ff54.Trojan.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "4ff54.Trojan.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "4ff54.Trojan.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "4ff54.Trojan.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "4ff54.Trojan.exe" touched "This Device" (Path: "HKCU\WOW6432NODE\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "4ff54.Trojan.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\WOW6432NODE\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "4ff54.Trojan.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "4ff54.Trojan.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "4ff54.Trojan.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "4ff54.Trojan.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "4ff54.Trojan.exe" touched "Other Users Folder" (Path: "HKCU\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "4ff54.Trojan.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "4ff54.Trojan.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "4ff54.Trojan.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "4ff54.Trojan.exe" touched "Games Explorer" (Path: "HKCU\WOW6432NODE\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "4ff54.Trojan.exe" touched "StreamBackedFolder" (Path: "HKCU\WOW6432NODE\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "4ff54.Trojan.exe" touched "Computers and Devices" (Path: "HKCU\WOW6432NODE\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "4ff54.Trojan.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "4ff54.Trojan.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "4ff54.Trojan.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "4ff54.Trojan.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "4ff54.Trojan.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "4ff54.Trojan.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}") "powershell.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}") "powershell.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\LOCALSERVER32") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\WOW6432NODE\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\LOCALSERVER32") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\INPROCHANDLER") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\WOW6432NODE\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\INPROCSERVER32") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}")3f:T912,"4ff54.Trojan" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "afUoHw.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"40:T6f6,"4ff54.Trojan.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "4ff54.Trojan.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "4ff54.Trojan.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "4ff54.Trojan.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "4ff54.Trojan.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "KO-KR") "4ff54.Trojan.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "KO-KR") "4ff54.Trojan.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN") "4ff54.Trojan.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-CN") "4ff54.Trojan.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HK") "4ff54.Trojan.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HK") "4ff54.Trojan.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "JA-JP") "4ff54.Trojan.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "JA-JP") "4ff54.Trojan.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "4ff54.Trojan.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH")41:T4b4,Observed system executable string:"3,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: powershell.exe.log] Observed system executable string:"3,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll",0" [Source: powershell.exe.log] Observed system executable string:"3,"System.Xml Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll",0" [Source: powershell.exe.log] Observed system executable string:"3,"System.Configuration Version=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll",0" [Source: powershell.exe.log] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00004048-00000C28-852993160]42:T704,Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp")43:T438,"afUoHw.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%APPDATA%\afUoHw.exe]- [targetUID: 00000000-00004048] "powershell.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log]- [targetUID: 00000000-00002544] "4ff54.Trojan.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\4ff54.Trojan.exe.log]- [targetUID: 00000000-00004048] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00002544] "tmp55A4.tmp" has type "XML 1.0 document ASCII text"- Location: [%TEMP%\tmp55A4.tmp]- [targetUID: 00000000-00005480] "json_1_.json" has type "JSON data"- [targetUID: N/A] "logs.dat" has type "data"- Location: [%ALLUSERSPROFILE%\remcos\logs.dat]- [targetUID: 00000000-00006888] "afUoHw.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A]44:T835,"4ff54.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "4ff54.Trojan.exe" (Access type: "OPEN"; Path: "HKCU\DELEGATEFOLDERS"; Key: ""; Value: "") "4ff54.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\DELEGATEFOLDERS"; Key: ""; Value: "") "4ff54.Trojan.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "4ff54.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "4ff54.Trojan.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "4ff54.Trojan.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1"; Key: ""; Value: "") "4ff54.Trojan.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\DESKTOP\NAMESPACE"; Key: ""; Value: "") "4ff54.Trojan.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "4ff54.Trojan.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE"; Key: ""; Value: "") "4ff54.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE"; Key: ""; Value: "") "4ff54.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INPROCSERVER32"; Key: ""; Value: "") "4ff54.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCSERVER32"; Key: ""; Value: "") "4ff54.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE"; Key: ""; Value: "")45:Tec5,"4ff54.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "VALIDATEREGITEMS"; Value: "") "4ff54.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "MONITORREGISTRY"; Value: "") "4ff54.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: "STORAGEDELEGATESUPPRESSIONPOLICY"; Value: "") "4ff54.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: "STORAGEDELEGATE"; Value: "") "4ff54.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INPROCSERVER32"; Key: ""; Value: "") "4ff54.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE"; Key: "CLSID"; Value: "") "4ff54.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCSERVER32"; Key: ""; Value: "") "4ff54.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCSERVER32"; Key: "LOADWITHOUTCOM"; Value: "") "4ff54.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE"; Key: "VALIDATEREGITEMS"; Value: "") "4ff54.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE"; Key: "MONITORREGISTRY"; Value: "") "4ff54.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE\INITPROPERTYBAG"; Key: "HIDENONREMOVABLEDRIVES"; Value: "") "4ff54.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE\INITPROPERTYBAG"; Key: "ALLOWCHILDALIASREGISTRATION"; Value: "") "4ff54.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE\INITPROPERTYBAG"; Key: "USEREMOVABLESTORAGEREGPATH"; Value: "") "4ff54.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE\INITPROPERTYBAG"; Key: "USEREMOVABLEDRIVESREGPATH"; Value: "") "4ff54.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE\INITPROPERTYBAG"; Key: "NODELEGATESEARCHROOT"; Value: "") "4ff54.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE\INITPROPERTYBAG"; Key: "HIDENONSTORAGESERVICEMOUNTEDDRIVES"; Value: "") "4ff54.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE\INITPROPERTYBAG"; Key: "FORCEALLDRIVESREMOVABLE"; Value: "") "4ff54.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE\INITPROPERTYBAG"; Key: "SHOWALLOPTICALDEVICES"; Value: "") "4ff54.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: ""; Value: "") "4ff54.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "GENERATION"; Value: "")46:Tcb1,"4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\OLE32.DLL" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\RPCSS.DLL" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.DLL" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\UXTHEME.DLL" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\BCRYPT.DLL" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\CRYPTSP.DLL" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\DWRITE.DLL" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\MSCORRC.DLL" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\MSCORRC.DLL.DLL" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\X86\SLC.DLL" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\X86\SPPC.DLL" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\WINDOWSCODECS.DLL" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\NTDLL.DLL"47:T843,"4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\4FF54.TROJAN.EXE.CONFIG" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\4FF54.TROJAN.EXE.LOG" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\YRTW" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\4FF54.TROJAN.INI" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.WINDOWS.FORMS" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.WINDOWS.FORMS.INI" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.DRAWING" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\SYSTEM.DRAWING.INI" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\4FF54.TROJAN.EXE.LOCAL" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\ACCESSIBILITY" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\ACCESSIBILITY.INI" "4ff54.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\MICROSOFT.V9921E851#"48:T19e6,Heuristic match: "1eh.ZM" Heuristic match: "Z;I,W.KY" Heuristic match: "b].BE" Heuristic match: "nE.sr" Pattern match: "http://schemas.microsoft.com/windows/2004/02/mit/task" Pattern match: "www.maxmind.com" Heuristic match: "geoplugin.net" Heuristic match: "/json.gp" Pattern match: "http://schemas.microsoft.com/SMI/2016/WindowsSettings" Heuristic match: ".exe.co" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Heuristic match: ":\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "icrosoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q" Pattern match: "http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "www.digicert.com1" Heuristic match: "uP.Mu" Heuristic match: ":\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1$0" Pattern match: "http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v" Pattern match: "crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0F" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0L" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/ThawtePCA-G3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0K" Pattern match: "http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=" Pattern match: "https://www.digicert.com/CPS0" Pattern match: "http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0" Pattern match: "crl.usertrust.com/AddTrustExternalCARoot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "http://www.microsoft.com0" Pattern match: "www.verisign.com/CPS" Pattern match: "https://www.verisign.com/CPS04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/Docs/Repository.htm" Pattern match: "http://www.microsoft.com/windows" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0" Pattern match: "www.microsoft.com/PKI/docs/CPS/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0" Pattern match: "Microsoft.Net/assembly/GAC_MSIL/System.Management.Automation/v4.0_3.0.0.0__31bf3856ad364e35/System.Management.Automation.dll" Pattern match: "http://schemas.microsoft.com/powershell/Microsoft.PowerShell" Heuristic match: "Set-Location $MyInvocation.MyCommand.Name" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=225750" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=225747" Heuristic match: "Get-Content $file | more.com" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=113316" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=160712" Pattern match: "Microsoft.Net/assembly/GAC_MSIL/Microsoft.PowerShell.ConsoleHost/v4.0_3.0.0.0__31bf3856ad364e35/Microsoft.PowerShell.ConsoleHost.dll" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/XMLSchema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Heuristic match: "C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: ":\windows\microsoft.net\assembly\gac_msil\system.ma" Heuristic match: "ntrust.net" Heuristic match: "Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "Microsoft-Windows-Client-Features-WOW64-Package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt07" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/CPS_2048" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://www.certplus.com/CRL/class2.crl0" Pattern match: "http://crl.securetrust.com/STCA.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/CPS" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.comodoca.com/AAACertificateServices.crl06" Pattern match: "crl.comodo.net/AAACertificateServices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "http://cert.startcom.org/sfsca-crl.cr" Pattern match: "http://www.microsoft.com/windows0" Pattern match: "www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0" Pattern match: "http://www.validationtest.contoso.com/test%d.html"49:T4f76,Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002544.00000000.68821.02FE0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002544.00000000.68821.030B5000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002544.00000000.68821.030B5000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002544.00000000.68821.030B5000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002544.00000000.68821.030B5000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;se]l+>%ystn/2.5.4.5n5h/globalsign" - Source: "00000000-00002544.00000000.68821.030B5000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002544.00000000.68821.030B5000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002544.00000000.68821.030B5000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00002544.00000000.68821.030B5000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00002544.00000000.68821.030B5000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002544.00000000.68821.030B5000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002544.00000000.68821.030B5000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00002544.00000000.68821.030B5000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002544.00000000.68821.030B5000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002544.00000000.68821.030B5000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002544.00000000.68821.030B5000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002544.00000000.68821.030B5000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002544.00000000.68821.030B5000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002544.00000000.68821.030B5000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002544.00000000.68821.030B5000.00000004.mdmp") Found URL "http://www.microsoft.com0h" - Source: "00000000-00002544.00000000.68821.030B5000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002544.00000000.68821.030B5000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0com/system.xml.dllsystem.xml.dll2.5.4.3pkcs1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00002544.00000000.68821.030B5000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002544.00000000.68821.030B5000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00002544.00000000.68821.032B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002544.00000000.68821.032B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002544.00000000.68821.032B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0ta[17iusai:" - Source: "00000000-00002544.00000000.68821.07610000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002544.00000000.68821.07610000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?geotrust" - Source: "00000000-00002544.00000000.68821.07610000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mne" - Source: "00000000-00002544.00000000.68821.07610000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002544.00000000.68821.07610000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002544.00000000.68821.07610000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00002544.00000000.68821.07610000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00002544.00000000.68821.6EF81000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004048.00000000.68527.03670000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json09/27" - Source: "00000000-00004048.00000000.68527.079A0000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,009/27" - Source: "00000000-00004048.00000000.68527.079A0000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportcalizednamengineparanoidmodeuickscarvalchedulequickscantimeutdatedplatersionuickscanintervalervicehardeningisableheuristicsisabletokenrecoveryisableheuristicsisableemailscanningindows" - Source: "00000000-00004048.00000000.68527.08480000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00004048.00000000.68527.6EB01000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00004048.00000000.68527.6EB01000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00004048.00000000.68527.6EB01000.00000020.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00004048.00000000.68527.6EBA1000.00000020.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00004120.00000000.68832.02C6A000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00004120.00000000.68832.02C6A000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00004120.00000000.68832.02C6A000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00004120.00000000.68832.02C6A000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00004120.00000000.68832.02C6A000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00004120.00000000.68832.02C6A000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00004120.00000000.68832.02C6A000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00004120.00000000.68832.02C6A000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcxjtr0l1" - Source: "00000000-00004120.00000000.68832.02C6A000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004120.00000000.68832.02C6A000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004120.00000000.68832.02C6A000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004120.00000000.68832.02C6A000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;se]l+>%ydigicert" - Source: "00000000-00004120.00000000.68832.02C6A000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004120.00000000.68832.02C6A000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004120.00000000.68832.02C6A000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004120.00000000.68832.02C6A000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00004120.00000000.68832.02C6A000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004120.00000000.68832.02C6A000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004120.00000000.68832.02C6A000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004120.00000000.68832.02C6A000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004120.00000000.68832.02C6A000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0pca3.crl0internet1verisign," - Source: "00000000-00004120.00000000.68832.02C6A000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004120.00000000.68832.07110000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00004120.00000000.68832.07110000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn" - Source: "00000000-00004120.00000000.68832.6EF81000.00000020.mdmp") Found URL "http://geoplugin.net/json.gpcmd.exe\sysinfo.txttempdxdiagimage/jpegimage/pngwnd_%04i%02i%02i_%02i%02i%02itime_%04i%02i%02i_%02i%02i%02i" - Source: "00000000-00006888.00000000.68955.00400000.00000040.mdmp") Found URL "http://geoplugin.net/json.gpgeoplugin.net/json.gpcalrpccalrpceoplugin.neteoplugin.netgeoplugin.neteoplugin.neteoplugin.neteoplugin.netummy://url/geoplugin.netet-xhqkmdlpstfet-xhqkmdlpstfeoplugin.net:\shareet-xhqkmdlpstf:\analysiseoplugin.neteoplugin.net:\vxstreamdevice\mup\:\analysisgeoplugin.netgeoplugin.net4ekoowyybloom_section_" - Source: "00000000-00006888.00000000.68955.03030000.00000004.mdmp") Found URL "http://geoplugin.net/json.gphttp://geoplugin.net/json.gpc:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie\4ekoowyy\json[1].json" - Source: "00000000-00006888.00000000.68955.03030000.00000004.mdmp") Found URL "http://geoplugin.net/json.gphttp://geoplugin.net/json.gphttp://geoplugin.net/json.gpgeoplugin.netgeoplugin.netlmem0geoplugin.netb8h3" - Source: "00000000-00006888.00000000.68955.03030000.00000004.mdmp") Found URL "http://geoplugin.net/json.gphttp://geoplugin.net/json.gppt" - Source: "00000000-00006888.00000000.68955.03030000.00000004.mdmp") Found URL "http://geoplugin.net/json.gp" - Source: "00000000-00006888.00000000.68955.03030000.00000004.mdmp") Found URL "http://geoplugin.net/json.gpcmd.exe\sysinfo.txttempdxdiagimage/jpegimage/pngwnd_%04i%02i%02i_%02i%02i%02itime_%04i%02i%02i_%02i%02i%02i" - Source: "00000000-00006888.00000001.70874.00400000.00000040.mdmp") Found URL "http://geoplugin.net/json.gphttp://geoplugin.net/json.gphttp://geoplugin.net/json.gpgeoplugin.netgeoplugin.netlmem0geoplugin.netb8h3" - Source: "00000000-00006888.00000001.70874.03030000.00000004.mdmp") Found URL "http://geoplugin.net/json.gpgeoplugin.net/json.gpcalrpccalrpceoplugin.neteoplugin.netgeoplugin.netrogram" - Source: "00000000-00006888.00000001.70874.03079000.00000004.mdmp") Found URL "http://geoplugin.net/json.gp" - Source: "00000000-00006888.00000001.70874.03079000.00000004.mdmp") Found URL "http://geoplugin.net/json.gpcmd.exe\sysinfo.txttempdxdiagimage/jpegimage/pngwnd_%04i%02i%02i_%02i%02i%02itime_%04i%02i%02i_%02i%02i%02i" - Source: "00000000-00006888.00000002.72792.00400000.00000040.mdmp") Found URL "http://geoplugin.net/json.gphttp://geoplugin.net/json.gphttp://geoplugin.net/json.gpgeoplugin.netgeoplugin.netlmem0geoplugin.netb8h3" - Source: "00000000-00006888.00000002.72792.03030000.00000004.mdmp") Found URL "http://geoplugin.net/json.gp" - Source: "00000000-00006888.00000002.72792.03095000.00000004.mdmp")4a:Ta9c,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp")4b:T9cc,"4ff54.Trojan.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004048) "4ff54.Trojan.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00004048) "4ff54.Trojan.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004048) "4ff54.Trojan.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00004048) "4ff54.Trojan.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00004048) "4ff54.Trojan.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00004048) "4ff54.Trojan.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00004048) "4ff54.Trojan.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00004048) "4ff54.Trojan.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00004048) "4ff54.Trojan.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00004048) "4ff54.Trojan.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00004048) "4ff54.Trojan.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00004048) "4ff54.Trojan.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00004048) "4ff54.Trojan.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00004048) "4ff54.Trojan.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00004048) "4ff54.Trojan.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00004048) "4ff54.Trojan.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00004048) "4ff54.Trojan.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00004048) "4ff54.Trojan.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00004048) "4ff54.Trojan.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00004048) "4ff54.Trojan.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00004048) "4ff54.Trojan.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00004048) "4ff54.Trojan.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00004048) "4ff54.Trojan.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00004048)4c:Ta8c,Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00002544.00000000.68821.00391000.00000020.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002544.00000000.68821.00391000.00000020.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002544.00000000.68821.00391000.00000020.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002544.00000000.68821.00391000.00000020.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002544.00000000.68821.00391000.00000020.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002544.00000000.68821.00391000.00000020.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002544.00000000.68821.00391000.00000020.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002544.00000000.68821.00391000.00000020.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002544.00000000.68821.00391000.00000020.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00002544.00000000.68821.030B5000.00000004.mdmp, 00000000-00002544.00000000.68821.07610000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00002544.00000000.68821.030B5000.00000004.mdmp, 00000000-00002544.00000000.68821.07610000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00002544.00000000.68821.04DD0000.00000004.mdmp") Found string "[-WindowStyle