24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 7c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Virus.Neshta Sample 61d0fa3933d0… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 61d0fa3933d0…. Malware family: Virus.Neshta. Threat score 100/100. 21/27 AV engines flagged this file. 14 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","keywords":["Malicious","Virus.Neshta","malware analysis","sandbox report","threat intelligence","61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e"],"about":{"@type":"SoftwareApplication","name":"bounty-55440007270979826","applicationCategory":["peexe","executable"],"identifier":"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Virus.Neshta","antivirusDetections":{"malicious":21,"total":27},"behavioralIndicators":{"malicious":14,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1780,Found reference to API (Indicator: "DeleteFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBox"; Source: "sample.bin"), Found reference to API (Indicator: "GetDriveTypeA"; Source: "sample.bin"), Found reference to API (Indicator: "SetEndOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectory"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSize"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "CopyImage"; Source: "sample.bin"), Found reference to API (Indicator: "GetIconInfo"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyIcon"; Source: "sample.bin"), Found reference to API (Indicator: "GetDIBits"; Source: "sample.bin"), Found reference to API (Indicator: "CharLowerBuffA"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteDC"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GetKeyboardType"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteObject"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileA"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseMutex"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathA"; Source: "sample.bin"), Found reference to API (Indicator: "SysFreeString"; Source: "sample.bin"), Found reference to API (Indicator: "BitBlt"; Source: "sample.bin"), Found reference to API (Indicator: "GetLogicalDriveStringsA"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "GetObjectA"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "CreateCompatibleDC"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetSysColor"; Source: "sample.bin"), Found reference to API (Indicator: "GetShortPathNameA"; Source: "sample.bin"), Found reference to API (Indicator: "SelectObject"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "SysReAllocStringLen"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "WinExec"; Source: "sample.bin"), Found reference to API (Indicator: "ExtractIconA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteA"; Source: "sample.bin"), Found reference to API (Indicator: "FillRect"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetThreadLocale"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "GetObject"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualFree"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileA"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSolidBrush"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "SetDIBits"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin")26:T1e04,Found string "le:///C:/Windows/System32/WindowsPowerShell/v1.0/en-US/System.Management.Automation.resources.DLL" (Source: "00000000-00002332.00000001.88751.00280000.00000004.mdmp") Found string ":\Windows\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\73a1a80aed03e789a49cec899b7505dd\System.Management.Automation.ni.dll" (Source: "00000000-00002332.00000001.88751.00280000.00000004.mdmp, 00000000-00002332.00000001.88751.01C60000.00000004.mdmp, 00000000-00002332.00000002.89745.00280000.00000004.mdmp, 00000000-00002332.00000002.89745.01C60000.00000004.mdmp, 00000000-00003560.00000001.88687.01DD0000.00000004.mdmp, 00000000-00003560.00000002.90611.01DD0000.00000004.mdmp, 00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found string ":\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00002332.00000001.88751.00280000.00000004.mdmp, 00000000-00002332.00000001.88751.01C60000.00000004.mdmp, 00000000-00002332.00000002.89745.00280000.00000004.mdmp, 00000000-00002332.00000002.89745.01C60000.00000004.mdmp, 00000000-00002332.00000002.89745.052B0000.00000004.mdmp, 00000000-00003560.00000001.88687.00320000.00000004.mdmp, 00000000-00003560.00000001.88687.01DD0000.00000004.mdmp, 00000000-00003560.00000002.90611.00320000.00000004.mdmp, 00000000-00003560.00000002.90611.01DD0000.00000004.mdmp, 00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00002332.00000001.88751.00280000.00000004.mdmp, 00000000-00002332.00000002.89745.00280000.00000004.mdmp, 00000000-00003560.00000001.88687.00320000.00000004.mdmp, 00000000-00003560.00000002.90611.00320000.00000004.mdmp") Found string "$errorCategory = [System.Management.Automation.ErrorCategory]::InvalidArgument" (Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp, 00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found string "$errorRecord = [System.Management.Automation.ErrorRecord]::New($exception, $errorId, $errorCategory, $null)" (Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00002332.00000002.89745.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp, 00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found string "$errorRecord = [System.Management.Automation.ErrorRecord]::new($_.Exception,"NewTemporaryFileWriteError", "WriteError", $env:TEMP)" (Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00002332.00000002.89745.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp, 00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ([System.Management.Automation.ErrorCategory]::InvalidData) -ErrorId "FormatHexResolvePathError"" (Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp, 00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found string "$errorRecord = [System.Management.Automation.ErrorRecord]::new($exception,"FormatHexFileAccessError", ([System.Management.Automation.ErrorCategory]::ReadError), $targetFilePath)" (Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00002332.00000002.89745.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp, 00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ([System.Management.Automation.ErrorCategory]::ParserError) -ErrorId "FormatHexFailureTypeNotSupported"" (Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00002332.00000002.89745.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp, 00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found string "$errorCategory = [System.Management.Automation.ErrorCategory]::InvalidData" (Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00002332.00000002.89745.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp, 00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found string "$ast = [System.Management.Automation.Language.Parser]::ParseFile(($resolvedPath.ProviderPath), [ref] $null, [ref] $parseErrors)" (Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00002332.00000002.89745.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp, 00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found string "$data = $ast.Find( { $args[0] -is [System.Management.Automation.Language.HashtableAst] }, $false )" (Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp, 00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found string "ite-Error -Message $errorMessage -Category ([System.Management.Automation.ErrorCategory]::InvalidData) -ErrorId "FormatHexResolvePathError"" (Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00002332.00000002.89745.01680000.00000004.mdmp") Found string "tomation.resources/System.Management.Automation.resources" (Source: "00000000-00002332.00000001.88751.01C60000.00000004.mdmp, 00000000-00002332.00000002.89745.01C60000.00000004.mdmp") Found string "" (Source: "00000000-00002332.00000001.88751.01C60000.00000004.mdmp, 00000000-00002332.00000002.89745.01C60000.00000004.mdmp") Found string "$script:wildcardOptions = [System.Management.Automation.WildcardOptions]::CultureInvariant -bor `" (Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "[System.Management.Automation.WildcardOptions]::IgnoreCase" (Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$requiredAssembly = @( [System.Management.Automation.PSCmdlet].Assembly.FullName," (Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "using System.Management.Automation;" (Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "elseif($module.GetType().ToString() -ne "System.Management.Automation.PSModuleInfo")" (Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "[System.Management.Automation.Language.Token[]]$tokens = $null;" (Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "[System.Management.Automation.Language.ParseError[]]$errors = $null;" (Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$ast = [System.Management.Automation.Language.Parser]::ParseFile($scriptFilePath, ([ref]$tokens), ([ref]$errors))" (Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp")27:T774,file/memory contains long string(File: "javaw.exe") file/memory contains long string(File: "java.exe") file/memory contains long string(File: "WI02EA~1.EXE") file/memory contains long string(File: "WININS~1.EXE") file/memory contains long string(File: "WI5ED8~1.EXE") file/memory contains long string(File: "WI2335~1.EXE") file/memory contains long string(File: "WIC467~1.EXE") Found string "system.io.compression" (Source: "00000000-00002332.00000001.88751.01B00000.00000004.mdmp, 00000000-00002332.00000001.88751.01B20000.00000004.mdmp, 00000000-00002332.00000001.88751.01B70000.00000004.mdmp, 00000000-00003560.00000001.88687.017F0000.00000004.mdmp, 00000000-00003560.00000001.88687.018D0000.00000004.mdmp, 00000000-00003560.00000002.90611.018C0000.00000004.mdmp") Found string "compressionmode" (Source: "00000000-00002332.00000001.88751.01B00000.00000004.mdmp, 00000000-00003560.00000001.88687.017F0000.00000004.mdmp") Found string "decompressionmethods" (Source: "00000000-00002332.00000001.88751.01B00000.00000004.mdmp, 00000000-00003560.00000001.88687.017F0000.00000004.mdmp") Found string "compressionlevel" (Source: "00000000-00002332.00000001.88751.01B20000.00000004.mdmp, 00000000-00003560.00000002.90611.018C0000.00000004.mdmp") Found string "compressionstrategy" (Source: "00000000-00002332.00000001.88751.01B20000.00000004.mdmp, 00000000-00003560.00000002.90611.018C0000.00000004.mdmp") Found string "compressionmethod" (Source: "00000000-00002332.00000001.88751.01B20000.00000004.mdmp, 00000000-00003560.00000002.90611.018C0000.00000004.mdmp") Found string "compressiontracingswitchlevel" (Source: "00000000-00002332.00000001.88751.01B20000.00000004.mdmp, 00000000-00003560.00000002.90611.018C0000.00000004.mdmp") Found string "compressiontracingswitch" (Source: "00000000-00002332.00000001.88751.01B20000.00000004.mdmp, 00000000-00003560.00000002.90611.018C0000.00000004.mdmp")28:T1469,Found string "Microsoft.PowerShell.Management\Remove-Item $tempModulePath -Force -Recurse -ErrorAction SilentlyContinue -WarningAction SilentlyContinue -Confirm:$false -WhatIf:$false" (Indicator: "Remove-Item"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Management\Remove-Item $tempScriptPath -Force -Recurse -ErrorAction SilentlyContinue -WarningAction SilentlyContinue -Confirm:$false -WhatIf:$false" (Indicator: "Remove-Item"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Management\Remove-Item -Path $installedScriptInfoFilePath -Force -ErrorAction SilentlyContinue" (Indicator: "Remove-Item"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Management\Remove-Item -Path $tempScriptFilePath -Force -WhatIf:$false -Confirm:$false -ErrorAction SilentlyContinue -WarningAction SilentlyContinue" (Indicator: "Remove-Item"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Management\Remove-Item $NupkgPath -Force -ErrorAction SilentlyContinue -WarningAction SilentlyContinue -Confirm:$false -WhatIf:$false" (Indicator: "Remove-Item"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Management\Remove-Item $NuspecPath -Force -ErrorAction SilentlyContinue -WarningAction SilentlyContinue -Confirm:$false -WhatIf:$false" (Indicator: "Remove-Item"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Management\Remove-Item $tempErrorFile -Force -ErrorAction SilentlyContinue -WarningAction SilentlyContinue -Confirm:$false -WhatIf:$false" (Indicator: "Remove-Item"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Management\Remove-Item $tempOutputFile -Force -ErrorAction SilentlyContinue -WarningAction SilentlyContinue -Confirm:$false -WhatIf:$false" (Indicator: "Remove-Item"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Management\Remove-Item -Path $InstalledScriptInfo2.Path `" (Indicator: "Remove-Item"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Management\Remove-Item $tempDestination -Force -Recurse -ErrorAction SilentlyContinue -WarningAction SilentlyContinue -Confirm:$false -WhatIf:$false" (Indicator: "Remove-Item"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Management\Remove-Item -Path $ModuleBaseFolderToBeRemoved `" (Indicator: "Remove-Item"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Management\Remove-Item -Path $scriptFilePath `" (Indicator: "Remove-Item"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Management\Remove-Item -Path $installledScriptInfoFilePath `" (Indicator: "Remove-Item"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Management\Remove-Item -Path $scriptInfoFile.FullName -Force -ErrorAction SilentlyContinue" (Indicator: "Remove-Item"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Management\Remove-Item -LiteralPath $tempPath -Force -ErrorAction SilentlyContinue -WarningAction SilentlyContinue -Confirm:$false -WhatIf:$false" (Indicator: "Remove-Item"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Management\Remove-Item -Path $DestinationPath -Recurse -Force -ErrorAction SilentlyContinue -WarningAction SilentlyContinue -Confirm:$false -WhatIf:$false" (Indicator: "Remove-Item"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Management\Remove-Item -Path "$DestinationPath\$($PSGetItemInfo.Name).nupkg" -Force -ErrorAction SilentlyContinue -WarningAction SilentlyContinue -Confirm:$false -WhatIf:$false" (Indicator: "Remove-Item"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp")29:T992,Found reference string ""%WINDIR%\svchost.com" "%WINDIR%\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "%USERPROFILE%\AppD" (Indicator: "add-mppreference"; Source: "00000000-00004028-00000C47-41907881026"), Found reference string "%WINDIR%\System32\WINDOW~1\v1.0\powershell.exe Add-MpPreference -ExclusionPath %APPDATA%\eiVfWxqyEFoV.exe" (Indicator: "add-mppreference"; Source: "00000000-00001372-00000C46-1808442920"), Found reference string ""%WINDIR%\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "%TEMP%\3582-490\61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe"" (Indicator: "add-mppreference"; File: "svchost.com"), Found reference string "Add-MpPreference -ExclusionPath %TEMP%\3582-490\61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Indicator: "add-mppreference"; File: "powershell.exe"), Found reference string ""%WINDIR%\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "%APPDATA%\eiVfWxqyEFoV.exe"" (Indicator: "add-mppreference"; File: "svchost.com"), Found reference string "Add-MpPreference -ExclusionPath %APPDATA%\eiVfWxqyEFoV.exe" (Indicator: "add-mppreference"; File: "powershell.exe"), Found reference string ""%WINDIR%\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "%TEMP%\3582-490\61D0FA~1.EXE"" (Indicator: "add-mppreference"; File: "svchost.com"), Found reference string "C:\Windows\System32\WINDOW~1\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\HAPUBWS\AppData\Roaming\eiVfWxqyEFoV.exe" (Indicator: "add-mppreference"; Source: "00000000-00002332.00000000.86829.00280000.00000004.mdmp 00000000-00002332.00000001.88751.00280000.00000004.mdmp 00000000-00002332.00000002.89745.00280000.00000004.mdmp 00000000-00004068.00000000.90323.00200000.00000004.mdmp"), Found reference string "HostApplication=C:\Windows\System32\WINDOW~1\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\HAPUBWS\AppData\Roaming\eiVfWxqyEFoV.exe" (Indicator: "add-mppreference"; Source: "00000000-00002332.00000001.88751.01C60000.00000004.mdmp 00000000-00002332.00000002.89745.01C60000.00000004.mdmp"), Found reference string "v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\HAPUBWS\AppData\Roaming\eiVfWxqyEFoV.exe" (Indicator: "add-mppreference"; Source: "00000000-00002332.00000001.88751.01C60000.00000004.mdmp 00000000-00002332.00000002.89745.01C60000.00000004.mdmp")2a:T65d,Found string "Microsoft.PowerShell.Management\Set-Content -Value $ScriptMetadataString -Path $tempScriptFilePath -Force -WhatIf:$false -Confirm:$false" (Indicator: "Set-Content"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Management\Set-Content -LiteralPath $tempScriptFilePath `" (Indicator: "Set-Content"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Management\Set-Content -Value $tempContents -Path $tempScriptFilePath -Force -WhatIf:$false -Confirm:$false" (Indicator: "Set-Content"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Management\Set-Content -Value $nuspec -Path $NuspecPath -Force -Confirm:$false -WhatIf:$false" (Indicator: "Set-Content"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "} | Set-Content -Path $tempPath -Confirm:$false -WhatIf:$false" (Indicator: "Set-Content"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Management\Set-Content -Path $Path -Value $newContent -Confirm:$false -WhatIf:$false" (Indicator: "Set-Content"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp")2b:T85a,"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindResourceW" with parameter "2572704" - (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindResourceW" with parameter "6" - (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindResourceW" with parameter "103" - (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindResourceW" with parameter "5" - (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindResourceW" with parameter "128" - (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindResourceW" with parameter "7" - (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindResourceW" with parameter "2" - (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindResourceW" with parameter "32512" - (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindResourceW" with parameter "2000" - (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindResourceW" with parameter "10" - (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindResourceW" with parameter "1" - (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindResourceW" with parameter "100" - (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindResourceW" with parameter "11" - (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindResourceW" with parameter "501" - (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindResourceW" with parameter "101" - (UID: 00000000-00003556)2c:T1060,"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadResource with parameter {'hModule': '766967810', 'hResInfo': '767750760'}" (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadResource with parameter {'hModule': '766967810', 'hResInfo': '767750728'}" (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadResource with parameter {'hModule': '764870658', 'hResInfo': '765792824'}" (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadResource with parameter {'hModule': '764870658', 'hResInfo': '765792776'}" (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadResource with parameter {'hModule': '25427970', 'hResInfo': '25772672'}" (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadResource with parameter {'hModule': '25427970', 'hResInfo': '25772624'}" (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadResource with parameter {'hModule': '25427970', 'hResInfo': '25791744'}" (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadResource with parameter {'hModule': '25427970', 'hResInfo': '25791072'}" (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadResource with parameter {'hModule': '32768002', 'hResInfo': '41167976'}" (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadResource with parameter {'hModule': '32768002', 'hResInfo': '41160096'}" (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadResource with parameter {'hModule': '25427970', 'hResInfo': '25592592'}" (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadResource with parameter {'hModule': '25427970', 'hResInfo': '25592544'}" (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadResource with parameter {'hModule': '25427970', 'hResInfo': '25752336'}" (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadResource with parameter {'hModule': '25427970', 'hResInfo': '25752288'}" (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadResource with parameter {'hModule': '25427970', 'hResInfo': '25882952'}" (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadResource with parameter {'hModule': '25427970', 'hResInfo': '25882920'}" (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadResource with parameter {'hModule': '25427970', 'hResInfo': '25448992'}" (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadResource with parameter {'hModule': '25427970', 'hResInfo': '25448960'}" (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadResource with parameter {'hModule': '32768002', 'hResInfo': '33478376'}" (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadResource with parameter {'hModule': '32768002', 'hResInfo': '33472776'}" (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadResource with parameter {'hModule': '25427970', 'hResInfo': '25503664'}" (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadResource with parameter {'hModule': '25427970', 'hResInfo': '25503360'}" (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadResource with parameter {'hModule': '32768002', 'hResInfo': '32909272'}" (UID: 00000000-00003556)2d:T86f,Found string "# Format-Hex cmdlet helps in displaying the Hexadecimal equivalent of the input data." (Indicator: "Format-Hex"; Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00002332.00000002.89745.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp, 00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found string "function Format-Hex" (Indicator: "Format-Hex"; Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00002332.00000002.89745.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp, 00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found string "# valid values (supported on all paltforms where Format-Hex is avaliable)" (Indicator: "Format-Hex"; Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00002332.00000002.89745.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp, 00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found string "# 170..180 | format-hex" (Indicator: "Format-Hex"; Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp") Found string "# PS# 170..180 | format-hex -Raw" (Indicator: "Format-Hex"; Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00002332.00000002.89745.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp, 00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found string "# .{ $i;$i;$i;$i64 } | format-hex" (Indicator: "Format-Hex"; Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00002332.00000002.89745.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp, 00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found string "function ConvertFrom-SddlString" (Indicator: "ConvertFrom-SddlString"; Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00002332.00000002.89745.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp, 00000000-00003560.00000002.90611.015E0000.00000004.mdmp")2e:T6fc,Found reference to "CryptCNGInitHMAC" (Indicator: "HMAC"; Source: "00000000-00002332.00000001.88751.00280000.00000004.mdmp, 00000000-00002332.00000002.89745.00280000.00000004.mdmp, 00000000-00003560.00000001.88687.01DD0000.00000004.mdmp, 00000000-00003560.00000002.90611.01DD0000.00000004.mdmp") Found reference to "[ValidateSet("SHA1", "SHA256", "SHA384", "SHA512", "MACTripleDES", "MD5", "RIPEMD160")]" (Indicator: "SHA384"; Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp") Found reference to "[ValidateSet("SHA1", "SHA256", "SHA384", "SHA512", "MACTripleDES", "MD5", "RIPEMD160")]" (Indicator: "SHA512"; Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp") Found reference to "[ValidateSet("SHA1", "SHA256", "SHA384", "SHA512", "MACTripleDES", "MD5", "RIPEMD160")]" (Indicator: "TripleDES"; Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp") Found reference to "if ($Algorithm -eq "MACTripleDES")" (Indicator: "TripleDES"; Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp") Found reference to "[System.Security.Cryptography.HashAlgorithm]" (Indicator: "HashAlgorithm"; Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp, 00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found reference to "$sha1Object = New-Object System.Security.Cryptography.SHA1Managed" (Indicator: "SHA1Managed"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp")2f:T8e1,Found PE header "MZ" - Source: "00000000-00000468.00000000.87465.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00000468.00000001.87861.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00000940.00000000.88155.00409000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00000940.00000001.88759.00409000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001372.00000000.78600.00409000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001416.00000000.79896.00409000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001416.00000001.80093.00409000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002580.00000001.81697.02C70000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002768.00000000.79048.00409000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002916.00000001.84169.00860000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002916.00000001.84169.02B40000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002952.00000000.82517.00409000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002952.00000001.82780.00409000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002996.00000000.81537.00409000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003064.00000001.90201.003A0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003280.00000000.78443.00409000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003280.00000001.80367.00409000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003280.00000002.82291.00409000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003280.00000003.86440.00409000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003440.00000000.90322.00409000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003556.00000000.77096.00409000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003556.00000001.79018.00409000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003556.00000002.80940.00409000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003556.00000003.86440.00409000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003960.00000000.89905.00409000.00000004.mdmp")30:T673,"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELLFOLDER") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELLFOLDER") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELLFOLDER") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELLFOLDER")31:Tf3a,"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" queried SystemProcessInformation at 00000000-00004028-00000105-13629558 [PID: 4028] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" queried SystemProcessInformation at 00000000-00004028-00000105-15074725 [PID: 4028] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" queried SystemProcessInformation at 00000000-00004028-00000105-15277265 [PID: 4028] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" queried SystemProcessInformation at 00000000-00004028-00000105-15479842 [PID: 4028] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" queried SystemProcessInformation at 00000000-00004028-00000105-17020359 [PID: 4028] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" queried SystemProcessInformation at 00000000-00004028-00000105-19344241 [PID: 4028] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" queried SystemProcessInformation at 00000000-00004028-00000105-19686616 [PID: 4028] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" queried SystemProcessInformation at 00000000-00004028-00000105-19972315 [PID: 4028] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" queried SystemProcessInformation at 00000000-00004028-00000105-20202849 [PID: 4028] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" queried SystemProcessInformation at 00000000-00004028-00000105-24989590 [PID: 4028] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" queried SystemProcessInformation at 00000000-00004028-00000105-25467612 [PID: 4028] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" queried SystemProcessInformation at 00000000-00004028-00000105-25938978 [PID: 4028] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" queried SystemProcessInformation at 00000000-00004028-00000105-26409299 [PID: 4028] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" queried SystemProcessInformation at 00000000-00004028-00000105-26730857 [PID: 4028] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" queried SystemProcessInformation at 00000000-00004028-00000105-27121451 [PID: 4028] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" queried SystemProcessInformation at 00000000-00004028-00000105-27461249 [PID: 4028] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" queried SystemProcessInformation at 00000000-00004028-00000105-27989009 [PID: 4028] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" queried SystemProcessInformation at 00000000-00004028-00000105-28317407 [PID: 4028] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" queried SystemProcessInformation at 00000000-00004028-00000105-28786047 [PID: 4028] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" queried SystemProcessInformation at 00000000-00004028-00000105-29099430 [PID: 4028] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" queried SystemProcessInformation at 00000000-00004028-00000105-29422049 [PID: 4028] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" queried SystemProcessInformation at 00000000-00004028-00000105-30346601 [PID: 4028] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" queried SystemProcessInformation at 00000000-00004028-00000105-30706614 [PID: 4028] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" queried SystemProcessInformation at 00000000-00004028-00000105-31016810 [PID: 4028] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" queried SystemProcessInformation at 00000000-00004028-00000105-31855101 [PID: 4028]32:T711,Found api reference "CertFreeCertificateChain(handle);" (Indicator: "CertFreeCertificateChain"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found api reference "private static extern void CertFreeCertificateChain(IntPtr handle);" (Indicator: "CertFreeCertificateChain"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found api reference "bool CertVerifyCertificateChainPolicy(" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found api reference "$SafeX509ChainHandleClassName CertDuplicateCertificateChain(" (Indicator: "CertDuplicateCertificateChain"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found api reference "SafeX509ChainHandle CertDuplicateCertificateChain(" (Indicator: "CertDuplicateCertificateChain"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found api reference "if(CertVerifyCertificateChainPolicy(new IntPtr(CERT_CHAIN_POLICY_MICROSOFT_ROOT)," (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found api reference "// so additional CertVerifyCertificateChainPolicy call is required to verify the given certificate is in Microsoft Application Root." (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp")33:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIbVQYJKoZIhvcNAQcCoIIbRjCCG0ICAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQU+zz3vaNz0s6W8CREgPojmh03NLSgghYqMIIEEjCCAvqgAwIBAgIPAMEAizw8iBHRPvZj7N9AMA0GCSqGSIb3DQ" "cchString": "9628" "dwFlags": "1" "pbBinary": "30821b5506092a864886f70d010702a0821b4630821b42020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414fb3cf7bda373d2ce96f0244480fa239a1d3734b4a082162a30820412308202faa003020102020f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d01010405003070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479301e170d3937303131303037303030305a170d3230313233313037303030305a3070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a902bdc170e63bf24e1b289f97785e30eaa2a98d255ff8fe954ca3b7fe9da2203e7c51a29ba28f60326bd1426479eeac76c954daf2eb9c861c8f9f8466b3c56b7a6223d61d3cde0f0192e896c4bf2d669a9a682699d03a2cbf0cb55826c146e70a3e38962ca92839a8ec498342e3840fbb9a6c5561ac827ca1602d774ce999b4643b9a501c310824149fa9e7912b18e63d986314605805659f1d375287f7a7ef9402c61bd3bf5545b38980bf3aec54944eaefda77a6d744eaf18cc96092821005790606937bb4b12073c56ff5bfba4660a08a6d2815657efb63b5e16817704daf6beae8095feb0cd7fd6a71a725c3ccabcf008a32230b30685c9b320771385df0203010001a381a83081a53081a20603551d0104819a30819780105bd070ef69729e23517e14b24d8effcba1723070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479820f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d0101040500038201010095e80bc08df3971835edb80124d87711f35c60329f9e0bcb3e0591888fc93ae621f2f057932cb5a047c862effcd7cc3b3b5aa9365469fe246d3fc9ccaade057cdd318d3d9f10706abbfe124f1869c0fcd043e311" "pcbBinary": "591b0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIbVQYJKoZIhvcNAQcCoIIbRjCCG0ICAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9628" "dwFlags": "1" "pbBinary": "30821b5506092a864886f70d010702a0821b4630821b42020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414fb3cf7bda373d2ce96f0244480fa239a1d3734b4a082162a30820412308202faa003020102020f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d01010405003070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479301e170d3937303131303037303030305a170d3230313233313037303030305a3070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a902bdc170e63bf24e1b289f97785e30eaa2a98d255ff8fe954ca3b7fe9da2203e7c51a29ba28f60326bd1426479eeac76c954daf2eb9c861c8f9f8466b3c56b7a6223d61d3cde0f0192e896c4bf2d669a9a682699d03a2cbf0cb55826c146e70a3e38962ca92839a8ec498342e3840fbb9a6c5561ac827ca1602d774ce999b4643b9a501c310824149fa9e7912b18e63d986314605805659f1d375287f7a7ef9402c61bd3bf5545b38980bf3aec54944eaefda77a6d744eaf18cc96092821005790606937bb4b12073c56ff5bfba4660a08a6d2815657efb63b5e16817704daf6beae8095feb0cd7fd6a71a725c3ccabcf008a32230b30685c9b320771385df0203010001a381a83081a53081a20603551d0104819a30819780105bd070ef69729e23517e14b24d8effcba1723070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479820f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d0101040500038201010095e80bc08df3971835edb80124d87711f35c60329f9e0bcb3e0591888fc93ae621f2f057932cb5a047c862effcd7cc3b3b5aa9365469fe246d3fc9ccaade057cdd318d3d9f10706abbfe124f1869c0fcd043e311" "pcbBinary": "591b0000" "pdwFlags": "01000000"}34:T490,Found string ":\Windows\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00000468.00000000.87465.00500000.00000004.mdmp, 00000000-00000468.00000001.87861.00500000.00000004.mdmp, 00000000-00002332.00000000.86829.00280000.00000004.mdmp, 00000000-00002332.00000001.88751.00280000.00000004.mdmp, 00000000-00002332.00000002.89745.00280000.00000004.mdmp, 00000000-00002916.00000000.82579.004F0000.00000004.mdmp, 00000000-00002916.00000001.84169.004F0000.00000004.mdmp, 00000000-00003064.00000001.90201.00610000.00000004.mdmp, 00000000-00003560.00000000.86765.00320000.00000004.mdmp, 00000000-00003560.00000001.88687.00320000.00000004.mdmp, 00000000-00003560.00000002.90611.00320000.00000004.mdmp, 00000000-00004068.00000000.90323.00200000.00000004.mdmp, 00000000-00004604.00000000.81976.00560000.00000004.mdmp, 00000000-00004604.00000001.82212.00560000.00000004.mdmp, 00000000-00005300.00000000.84449.002A0000.00000004.mdmp, 00000000-00005300.00000001.84746.002A0000.00000004.mdmp, 00000000-00005568.00000000.85134.00420000.00000004.mdmp, 00000000-00005568.00000001.87057.00420000.00000004.mdmp, 00000000-00005568.00000002.87218.00420000.00000004.mdmp")35:T4f7,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Able to decrypt/decode data Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Contains reference to cryptographic keys Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match - ChaCha20 encryption algorithm Matched sigs: YARA signature match - AES encryption Matched sigs: YARA signature match – cryptographic algorithms Matched sigs: YARA signature match - Customized RC4 encryption for MSIL36:T7480,Found XOR loop in file "setup.exe" at offset 1076245; code bytes = 30d0 Found XOR loop in file "setup.exe" at offset 1083195; code bytes = 30d0 Found XOR loop in file "setup.exe" at offset 1091039; code bytes = 30d0 Found XOR loop in file "setup.exe" at offset 1094095; code bytes = 30d0 Found XOR loop in file "setup.exe" at offset 1094495; code bytes = 30d0 Found XOR loop in file "setup.exe" at offset 349792; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 350408; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 362844; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 483257; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 581027; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 658267; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 1075042; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 1075394; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 1076230; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 1079064; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 1090520; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 1091812; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 1093276; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 1094456; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 1096633; code bytes = 8030 Found XOR loop in file "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" at offset 129355; code bytes = 30d0 Found XOR loop in file "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" at offset 160283; code bytes = 30d0 Found XOR loop in file "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" at offset 237149; code bytes = 30d0 Found XOR loop in file "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" at offset 243987; code bytes = 30d0 Found XOR loop in file "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" at offset 287223; code bytes = 30d0 Found XOR loop in file "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" at offset 331412; code bytes = 30d0 Found XOR loop in file "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" at offset 372736; code bytes = 30d0 Found XOR loop in file "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" at offset 374146; code bytes = 30d0 Found XOR loop in file "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" at offset 498447; code bytes = 30d0 Found XOR loop in file "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" at offset 500220; code bytes = 30d0 Found XOR loop in file "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" at offset 534368; code bytes = 30d0 Found XOR loop in file "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" at offset 621071; code bytes = 30d0 Found XOR loop in file "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" at offset 642335; code bytes = 30d0 Found XOR loop in file "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" at offset 642384; code bytes = 30d0 Found XOR loop in file "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" at offset 779068; code bytes = 30d0 Found XOR loop in file "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" at offset 779272; code bytes = 30d0 Found XOR loop in file "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" at offset 791625; code bytes = 30d0 Found XOR loop in file "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" at offset 320883; code bytes = 33c1 Found XOR loop in file "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" at offset 322269; code bytes = 33c1 Found XOR loop in file "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" at offset 351434; code bytes = 33c1 Found XOR loop in file "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" at offset 352362; code bytes = 33c1 Found XOR loop in file "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" at offset 373635; code bytes = 33c1 Found XOR loop in file "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" at offset 401372; code bytes = 33c1 Found XOR loop in file "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" at offset 418622; code bytes = 33c1 Found XOR loop in file "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" at offset 513822; code bytes = 33c1 Found XOR loop in file "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" at offset 74782; code bytes = 8030 Found XOR loop in file "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" at offset 126196; code bytes = 8030 Found XOR loop in file "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" at offset 445894; code bytes = 8030 Found XOR loop in file "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" at offset 566508; code bytes = 8030 Found XOR loop in file "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" at offset 605110; code bytes = 8030 Found XOR loop in file "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" at offset 647884; code bytes = 8030 Found XOR loop in file "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" at offset 667314; code bytes = 8030 Found XOR loop in file "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" at offset 778886; code bytes = 8030 Found XOR loop in file "dwtrig20.exe" at offset 512641; code bytes = 30d0 Found XOR loop in file "dwtrig20.exe" at offset 220540; code bytes = 33c1 Found XOR loop in file "dwtrig20.exe" at offset 221156; code bytes = 33c1 Found XOR loop in file "dwtrig20.exe" at offset 506607; code bytes = 33c1 Found XOR loop in file "dwtrig20.exe" at offset 355075; code bytes = 8030 Found XOR loop in file "dwtrig20.exe" at offset 432315; code bytes = 8030 Found XOR loop in file "dwtrig20.exe" at offset 512620; code bytes = 8030 Found XOR loop in file "dwtrig20.exe" at offset 515513; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 386223; code bytes = 30d0 Found XOR loop in file "setup.exe" at offset 386335; code bytes = 30d0 Found XOR loop in file "setup.exe" at offset 408329; code bytes = 30d0 Found XOR loop in file "setup.exe" at offset 134426; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 134564; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 455858; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 459246; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 170010; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 456736; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 459119; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 462233; code bytes = 8030 Found XOR loop in file "python.exe" at offset 414667; code bytes = 30d0 Found XOR loop in file "python.exe" at offset 416949; code bytes = 30d0 Found XOR loop in file "python.exe" at offset 420951; code bytes = 30d0 Found XOR loop in file "python.exe" at offset 421939; code bytes = 30d0 Found XOR loop in file "python.exe" at offset 47635; code bytes = 33c1 Found XOR loop in file "python.exe" at offset 260131; code bytes = 33c1 Found XOR loop in file "python.exe" at offset 418163; code bytes = 33c1 Found XOR loop in file "python.exe" at offset 441309; code bytes = 33c1 Found XOR loop in file "python.exe" at offset 334590; code bytes = 30040e Found XOR loop in file "python.exe" at offset 345295; code bytes = 8030 Found XOR loop in file "python.exe" at offset 349902; code bytes = 8030 Found XOR loop in file "python.exe" at offset 371850; code bytes = 8030 Found XOR loop in file "python.exe" at offset 420912; code bytes = 8030 Found XOR loop in file "python.exe" at offset 421920; code bytes = 8030 Found XOR loop in file "python.exe" at offset 425358; code bytes = 8030 Found XOR loop in file "python.exe" at offset 427633; code bytes = 8030 Found XOR loop in file "python.exe" at offset 451537; code bytes = 8030 Found XOR loop in file "pythonw.exe" at offset 346803; code bytes = 30d0 Found XOR loop in file "pythonw.exe" at offset 349514; code bytes = 30d0 Found XOR loop in file "pythonw.exe" at offset 371852; code bytes = 30d0 Found XOR loop in file "pythonw.exe" at offset 418593; code bytes = 30d0 Found XOR loop in file "pythonw.exe" at offset 419963; code bytes = 30d0 Found XOR loop in file "pythonw.exe" at offset 420955; code bytes = 30d0 Found XOR loop in file "pythonw.exe" at offset 47667; code bytes = 33c1 Found XOR loop in file "pythonw.exe" at offset 260515; code bytes = 33c1 Found XOR loop in file "pythonw.exe" at offset 440318; code bytes = 33c1 Found XOR loop in file "pythonw.exe" at offset 336725; code bytes = 8030 Found XOR loop in file "pythonw.exe" at offset 416404; code bytes = 8030 Found XOR loop in file "pythonw.exe" at offset 420936; code bytes = 8030 Found XOR loop in file "pythonw.exe" at offset 424334; code bytes = 8030 Found XOR loop in file "pythonw.exe" at offset 426608; code bytes = 8030 Found XOR loop in file "KMSSS.exe" at offset 222196; code bytes = 30d0 Found XOR loop in file "KMSSS.exe" at offset 238322; code bytes = 30d0 Found XOR loop in file "KMSSS.exe" at offset 290917; code bytes = 30d0 Found XOR loop in file "KMSSS.exe" at offset 295281; code bytes = 30d0 Found XOR loop in file "KMSSS.exe" at offset 111978; code bytes = 33c1 Found XOR loop in file "KMSSS.exe" at offset 112597; code bytes = 33c1 Found XOR loop in file "KMSSS.exe" at offset 236504; code bytes = 33c1 Found XOR loop in file "KMSSS.exe" at offset 92984; code bytes = 8030 Found XOR loop in file "KMSSS.exe" at offset 240739; code bytes = 8030 Found XOR loop in file "KMSSS.exe" at offset 287320; code bytes = 8030 Found XOR loop in file "KMSSS.exe" at offset 295264; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 259147; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 266487; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 260699; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 299043; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 299189; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 181425; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 182250; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 259108; code bytes = 8030 Found XOR loop in file "javaws.exe" at offset 255733; code bytes = 30d0 Found XOR loop in file "javaws.exe" at offset 74519; code bytes = 33c1 Found XOR loop in file "javaws.exe" at offset 75138; code bytes = 33c1 Found XOR loop in file "javaws.exe" at offset 105960; code bytes = 33c1 Found XOR loop in file "javaws.exe" at offset 266472; code bytes = 8030 Found XOR loop in file "javaws.exe" at offset 267723; code bytes = 8030 Found XOR loop in file "javaw.exe" at offset 183295; code bytes = 30d0 Found XOR loop in file "javaw.exe" at offset 127306; code bytes = 8030 Found XOR loop in file "javaw.exe" at offset 187112; code bytes = 8030 Found XOR loop in file "javaw.exe" at offset 188363; code bytes = 8030 Found XOR loop in file "java.exe" at offset 182775; code bytes = 30d0 Found XOR loop in file "java.exe" at offset 180461; code bytes = 33c1 Found XOR loop in file "java.exe" at offset 54932; code bytes = 8030 Found XOR loop in file "java.exe" at offset 127298; code bytes = 8030 Found XOR loop in file "java.exe" at offset 186600; code bytes = 8030 Found XOR loop in file "java.exe" at offset 187851; code bytes = 8030 Found XOR loop in file "ose.exe" at offset 138227; code bytes = 30d0 Found XOR loop in file "ose.exe" at offset 145337; code bytes = 8030 Found XOR loop in file "python.exe" at offset 102510; code bytes = 33c1 Found XOR loop in file "python.exe" at offset 111022; code bytes = 30040e Found XOR loop in file "python.exe" at offset 49290; code bytes = 8030 Found XOR loop in file "python.exe" at offset 94094; code bytes = 8030 Found XOR loop in file "python.exe" at offset 96368; code bytes = 8030 Found XOR loop in file "python.exe" at offset 104546; code bytes = 8030 Found XOR loop in file "python.exe" at offset 121727; code bytes = 8030 Found XOR loop in file "python.exe" at offset 126334; code bytes = 8030 Found XOR loop in file "python.exe" at offset 109974; code bytes = 30040e Found XOR loop in file "python.exe" at offset 92924; code bytes = 8030 Found XOR loop in file "python.exe" at offset 95894; code bytes = 8030 Found XOR loop in file "python.exe" at offset 103056; code bytes = 8030 Found XOR loop in file "python.exe" at offset 120679; code bytes = 8030 Found XOR loop in file "python.exe" at offset 125286; code bytes = 8030 Found XOR loop in file "pythonw.exe" at offset 48780; code bytes = 30d0 Found XOR loop in file "pythonw.exe" at offset 121187; code bytes = 30d0 Found XOR loop in file "pythonw.exe" at offset 123898; code bytes = 30d0 Found XOR loop in file "pythonw.exe" at offset 100983; code bytes = 33c1 Found XOR loop in file "pythonw.exe" at offset 92558; code bytes = 8030 Found XOR loop in file "pythonw.exe" at offset 94832; code bytes = 8030 Found XOR loop in file "pythonw.exe" at offset 103010; code bytes = 8030 Found XOR loop in file "pythonw.exe" at offset 111109; code bytes = 8030 Found XOR loop in file "t32.exe" at offset 94637; code bytes = 30d0 Found XOR loop in file "t32.exe" at offset 126771; code bytes = 30d0 Found XOR loop in file "t32.exe" at offset 94657; code bytes = 33c1 Found XOR loop in file "t32.exe" at offset 92982; code bytes = 8030 Found XOR loop in file "pythonw.exe" at offset 120139; code bytes = 30d0 Found XOR loop in file "pythonw.exe" at offset 122850; code bytes = 30d0 Found XOR loop in file "pythonw.exe" at offset 91388; code bytes = 8030 Found XOR loop in file "pythonw.exe" at offset 94358; code bytes = 8030 Found XOR loop in file "pythonw.exe" at offset 101536; code bytes = 8030 Found XOR loop in file "pythonw.exe" at offset 110061; code bytes = 8030 Found XOR loop in file "w32.exe" at offset 93320; code bytes = 30d0 Found XOR loop in file "w32.exe" at offset 106208; code bytes = 30d0 Found XOR loop in file "w32.exe" at offset 114012; code bytes = 30d0 Found XOR loop in file "pip.exe" at offset 86933; code bytes = 30d0 Found XOR loop in file "pip.exe" at offset 91203; code bytes = 30d0 Found XOR loop in file "t32.exe" at offset 86933; code bytes = 30d0 Found XOR loop in file "t32.exe" at offset 90823; code bytes = 30d0 Found XOR loop in file "w32.exe" at offset 82667; code bytes = 30d0 Found XOR loop in file "devcon.exe" at offset 76015; code bytes = 30d0 Found XOR loop in file "devcon.exe" at offset 102763; code bytes = 33c1 Found XOR loop in file "devcon.exe" at offset 75996; code bytes = 8030 Found XOR loop in file "devcon.exe" at offset 91162; code bytes = 8030 Found XOR loop in file "devcon.exe" at offset 76407; code bytes = 30d0 Found XOR loop in file "devcon.exe" at offset 76388; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 1900475; code bytes = 30d0 Found XOR loop in file "TOR-GE~1.EXE" at offset 1901003; code bytes = 30d0 Found XOR loop in file "TOR-GE~1.EXE" at offset 1903374; code bytes = 30d0 Found XOR loop in file "TOR-GE~1.EXE" at offset 2232508; code bytes = 30d0 Found XOR loop in file "TOR-GE~1.EXE" at offset 2586447; code bytes = 30d0 Found XOR loop in file "TOR-GE~1.EXE" at offset 2586646; code bytes = 30d0 Found XOR loop in file "TOR-GE~1.EXE" at offset 3068138; code bytes = 30d0 Found XOR loop in file "TOR-GE~1.EXE" at offset 3075455; code bytes = 30d0 Found XOR loop in file "TOR-GE~1.EXE" at offset 3228613; code bytes = 30d0 Found XOR loop in file "TOR-GE~1.EXE" at offset 3432525; code bytes = 30d0 Found XOR loop in file "TOR-GE~1.EXE" at offset 3532249; code bytes = 30d0 Found XOR loop in file "TOR-GE~1.EXE" at offset 3541709; code bytes = 30d0 Found XOR loop in file "TOR-GE~1.EXE" at offset 3546639; code bytes = 30d0 Found XOR loop in file "TOR-GE~1.EXE" at offset 3549639; code bytes = 30d0 Found XOR loop in file "TOR-GE~1.EXE" at offset 3552699; code bytes = 30d0 Found XOR loop in file "TOR-GE~1.EXE" at offset 3559619; code bytes = 30d0 Found XOR loop in file "TOR-GE~1.EXE" at offset 3562581; code bytes = 30d0 Found XOR loop in file "TOR-GE~1.EXE" at offset 3563933; code bytes = 30d0 Found XOR loop in file "TOR-GE~1.EXE" at offset 3564433; code bytes = 30d0 Found XOR loop in file "TOR-GE~1.EXE" at offset 3565443; code bytes = 30d0 Found XOR loop in file "TOR-GE~1.EXE" at offset 3566967; code bytes = 30d0 Found XOR loop in file "TOR-GE~1.EXE" at offset 3568699; code bytes = 30d0 Found XOR loop in file "TOR-GE~1.EXE" at offset 3569473; code bytes = 30d0 Found XOR loop in file "TOR-GE~1.EXE" at offset 3573291; code bytes = 30d0 Found XOR loop in file "TOR-GE~1.EXE" at offset 3577245; code bytes = 30d0 Found XOR loop in file "TOR-GE~1.EXE" at offset 3579703; code bytes = 30d0 Found XOR loop in file "TOR-GE~1.EXE" at offset 3582929; code bytes = 30d0 Found XOR loop in file "TOR-GE~1.EXE" at offset 2025630; code bytes = 33c1 Found XOR loop in file "TOR-GE~1.EXE" at offset 2026400; code bytes = 33c1 Found XOR loop in file "TOR-GE~1.EXE" at offset 2233221; code bytes = 33c1 Found XOR loop in file "TOR-GE~1.EXE" at offset 2421956; code bytes = 33c1 Found XOR loop in file "TOR-GE~1.EXE" at offset 2493573; code bytes = 33c1 Found XOR loop in file "TOR-GE~1.EXE" at offset 2590600; code bytes = 33c1 Found XOR loop in file "TOR-GE~1.EXE" at offset 2605957; code bytes = 33c1 Found XOR loop in file "TOR-GE~1.EXE" at offset 2898476; code bytes = 33c1 Found XOR loop in file "TOR-GE~1.EXE" at offset 3077030; code bytes = 33c1 Found XOR loop in file "TOR-GE~1.EXE" at offset 3094133; code bytes = 33c1 Found XOR loop in file "TOR-GE~1.EXE" at offset 3230284; code bytes = 33c1 Found XOR loop in file "TOR-GE~1.EXE" at offset 3352944; code bytes = 33c1 Found XOR loop in file "TOR-GE~1.EXE" at offset 3434196; code bytes = 33c1 Found XOR loop in file "TOR-GE~1.EXE" at offset 3500667; code bytes = 33c1 Found XOR loop in file "TOR-GE~1.EXE" at offset 3502387; code bytes = 33c1 Found XOR loop in file "TOR-GE~1.EXE" at offset 3507803; code bytes = 33c1 Found XOR loop in file "TOR-GE~1.EXE" at offset 3507969; code bytes = 33c1 Found XOR loop in file "TOR-GE~1.EXE" at offset 3521473; code bytes = 33c1 Found XOR loop in file "TOR-GE~1.EXE" at offset 3526503; code bytes = 33c1 Found XOR loop in file "TOR-GE~1.EXE" at offset 3532793; code bytes = 33c1 Found XOR loop in file "TOR-GE~1.EXE" at offset 3533237; code bytes = 33c1 Found XOR loop in file "TOR-GE~1.EXE" at offset 3534395; code bytes = 33c1 Found XOR loop in file "TOR-GE~1.EXE" at offset 475794; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 475810; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 502037; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 502053; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 525317; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 525333; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 599576; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 599592; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 652380; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 652396; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 676928; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 676944; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 738535; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 738749; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 1306622; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 1306645; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 2312738; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 2312937; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 2341259; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 2354347; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 2521519; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 2532303; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 2561534; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 2715425; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 2715641; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 2715729; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 2715846; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 2715960; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 2718108; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 2718618; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 2718706; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 2718823; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 2718937; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 2721085; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 2807359; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 2830346; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 2830527; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 2835262; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 3068072; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 3069470; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 3143020; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 3194638; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 3196045; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 3196684; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 3329724; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 3329788; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 3329852; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 3393444; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 3393508; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 3504306; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 3505690; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 3516504; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 3525386; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 3548638; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 3551672; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 3554592; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 3559580; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 3563877; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 3564394; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 3565404; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 3566004; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 3568680; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 3573252; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 3577212; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 3579664; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 3581050; code bytes = 8030 Found XOR loop in file "TOR-GE~1.EXE" at offset 3582096; code bytes = 8030 Found XOR loop in file "CHROME~1.EXE" at offset 131839; code bytes = 30d0 Found XOR loop in file "CHROME~1.EXE" at offset 135997; code bytes = 30d0 Found XOR loop in file "CHROME~1.EXE" at offset 167686; code bytes = 30d0 Found XOR loop in file "CHROME~1.EXE" at offset 201532; code bytes = 30d0 Found XOR loop in file "CHROME~1.EXE" at offset 204542; code bytes = 30d0 Found XOR loop in file "CHROME~1.EXE" at offset 215666; code bytes = 30d0 Found XOR loop in file "CHROME~1.EXE" at offset 271006; code bytes = 30d0 Found XOR loop in file "CHROME~1.EXE" at offset 488050; code bytes = 30d0 Found XOR loop in file "CHROME~1.EXE" at offset 514754; code bytes = 30d0 Found XOR loop in file "CHROME~1.EXE" at offset 563975; code bytes = 30d0 Found XOR loop in file "CHROME~1.EXE" at offset 697885; code bytes = 30d0 Found XOR loop in file "CHROME~1.EXE" at offset 700763; code bytes = 30d0 Found XOR loop in file "CHROME~1.EXE" at offset 807567; code bytes = 30d0 Found XOR loop in file "CHROME~1.EXE" at offset 817779; code bytes = 30d0 Found XOR loop in file "CHROME~1.EXE" at offset 905485; code bytes = 30d0 Found XOR loop in file "CHROME~1.EXE" at offset 1012814; code bytes = 30d0 Found XOR loop in file "CHROME~1.EXE" at offset 1080958; code bytes = 30d0 Found XOR loop in file "CHROME~1.EXE" at offset 1085582; code bytes = 30d0 Found XOR loop in file "CHROME~1.EXE" at offset 1125877; code bytes = 30d0 Found XOR loop in file "CHROME~1.EXE" at offset 1141833; code bytes = 30d0 Found XOR loop in file "CHROME~1.EXE" at offset 1274729; code bytes = 30d0 Found XOR loop in file "CHROME~1.EXE" at offset 1357107; code bytes = 30d0 Found XOR loop in file "CHROME~1.EXE" at offset 138597; code bytes = 33c1 Found XOR loop in file "CHROME~1.EXE" at offset 248037; code bytes = 33c1 Found XOR loop in file "CHROME~1.EXE" at offset 276166; code bytes = 33c1 Found XOR loop in file "CHROME~1.EXE" at offset 309468; code bytes = 33c1 Found XOR loop in file "CHROME~1.EXE" at offset 444375; code bytes = 33c1 Found XOR loop in file "CHROME~1.EXE" at offset 631795; code bytes = 33c1 Found XOR loop in file "CHROME~1.EXE" at offset 647937; code bytes = 33c1 Found XOR loop in file "CHROME~1.EXE" at offset 689449; code bytes = 33c1 Found XOR loop in file "CHROME~1.EXE" at offset 754500; code bytes = 33c1 Found XOR loop in file "CHROME~1.EXE" at offset 998469; code bytes = 33c1 Found XOR loop in file "CHROME~1.EXE" at offset 1004505; code bytes = 33c1 Found XOR loop in file "CHROME~1.EXE" at offset 1013405; code bytes = 33c1 Found XOR loop in file "CHROME~1.EXE" at offset 1013972; code bytes = 33c1 Found XOR loop in file "CHROME~1.EXE" at offset 1056043; code bytes = 33c1 Found XOR loop in file "CHROME~1.EXE" at offset 1107947; code bytes = 33c1 Found XOR loop in file "CHROME~1.EXE" at offset 1164128; code bytes = 33c1 Found XOR loop in file "CHROME~1.EXE" at offset 1173299; code bytes = 33c1 Found XOR loop in file "CHROME~1.EXE" at offset 1174378; code bytes = 33c1 Found XOR loop in file "CHROME~1.EXE" at offset 1177009; code bytes = 33c1 Found XOR loop in file "CHROME~1.EXE" at offset 1189355; code bytes = 33c1 Found XOR loop in file "CHROME~1.EXE" at offset 1275329; code bytes = 33c1 Found XOR loop in file "CHROME~1.EXE" at offset 1354333; code bytes = 33c1 Found XOR loop in file "CHROME~1.EXE" at offset 1369801; code bytes = 33c1 Found XOR loop in file "CHROME~1.EXE" at offset 1395848; code bytes = 33c1 Found XOR loop in file "CHROME~1.EXE" at offset 1400352; code bytes = 33c1 Found XOR loop in file "CHROME~1.EXE" at offset 1400481; code bytes = 33c1 Found XOR loop in file "CHROME~1.EXE" at offset 241345; code bytes = 8030 Found XOR loop in file "CHROME~1.EXE" at offset 295060; code bytes = 8030 Found XOR loop in file "CHROME~1.EXE" at offset 303680; code bytes = 8030 Found XOR loop in file "CHROME~1.EXE" at offset 318363; code bytes = 8030 Found XOR loop in file "CHROME~1.EXE" at offset 346521; code bytes = 8030 Found XOR loop in file "CHROME~1.EXE" at offset 347200; code bytes = 8030 Found XOR loop in file "CHROME~1.EXE" at offset 403250; code bytes = 8030 Found XOR loop in file "CHROME~1.EXE" at offset 443333; code bytes = 8030 Found XOR loop in file "CHROME~1.EXE" at offset 500986; code bytes = 8030 Found XOR loop in file "CHROME~1.EXE" at offset 598893; code bytes = 8030 Found XOR loop in file "CHROME~1.EXE" at offset 609916; code bytes = 8030 Found XOR loop in file "CHROME~1.EXE" at offset 680996; code bytes = 8030 Found XOR loop in file "CHROME~1.EXE" at offset 696139; code bytes = 8030 Found XOR loop in file "CHROME~1.EXE" at offset 933904; code bytes = 8030 Found XOR loop in file "CHROME~1.EXE" at offset 967449; code bytes = 8030 Found XOR loop in file "CHROME~1.EXE" at offset 976807; code bytes = 8030 Found XOR loop in file "CHROME~1.EXE" at offset 1016010; code bytes = 8030 Found XOR loop in file "CHROME~1.EXE" at offset 1082142; code bytes = 8030 Found XOR loop in file "CHROME~1.EXE" at offset 1258341; code bytes = 8030 Found XOR loop in file "CHROME~1.EXE" at offset 1261495; code bytes = 8030 Found XOR loop in file "CHROME~1.EXE" at offset 1294889; code bytes = 8030 Found XOR loop in file "CHROME~1.EXE" at offset 1308809; code bytes = 8030 Found XOR loop in file "CHROME~1.EXE" at offset 1354974; code bytes = 8030 Found XOR loop in file "CHROME~1.EXE" at offset 1360101; code bytes = 8030 Found XOR loop in file "CHROME~1.EXE" at offset 1371869; code bytes = 8030 Found XOR loop in file "CHROME~1.EXE" at offset 1372116; code bytes = 803037:T877,Found string "C:\Program Files\Oracle\VirtualBox Guest Additions\uninst.exe" (Source: "00000000-00002332.00000000.86829.00280000.00000004.mdmp, 00000000-00002332.00000001.88751.00280000.00000004.mdmp, 00000000-00002332.00000002.89745.00280000.00000004.mdmp, 00000000-00003560.00000000.86765.00320000.00000004.mdmp, 00000000-00004068.00000000.90323.00200000.00000004.mdmp") Found string "{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Oracle\VirtualBox Guest Additions\uninst.exe" (Source: "00000000-00002332.00000000.86829.00280000.00000004.mdmp, 00000000-00002332.00000001.88751.00280000.00000004.mdmp, 00000000-00002332.00000002.89745.00280000.00000004.mdmp, 00000000-00003560.00000000.86765.00320000.00000004.mdmp, 00000000-00004068.00000000.90323.00200000.00000004.mdmp") Found string "C:\Program Files\Oracle\VirtualBox Guest Additions\Oracle VM VirtualBox Guest Additions.url" (Source: "00000000-00002332.00000000.86829.00280000.00000004.mdmp, 00000000-00002332.00000001.88751.00280000.00000004.mdmp, 00000000-00002332.00000002.89745.00280000.00000004.mdmp, 00000000-00003560.00000000.86765.00320000.00000004.mdmp") Found string "{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Oracle\VirtualBox Guest Additions\Oracle VM VirtualBox Guest Additions.url" (Source: "00000000-00002332.00000000.86829.00280000.00000004.mdmp, 00000000-00002332.00000001.88751.00280000.00000004.mdmp, 00000000-00002332.00000002.89745.00280000.00000004.mdmp, 00000000-00003560.00000000.86765.00320000.00000004.mdmp") Found string "\Program Files\Oracle\VirtualBox Guest Additions\uninst.exe" (Source: "00000000-00002332.00000001.88751.00280000.00000004.mdmp, 00000000-00003560.00000001.88687.00320000.00000004.mdmp, 00000000-00003560.00000002.90611.00320000.00000004.mdmp, 00000000-00004068.00000000.90323.00200000.00000004.mdmp") Found string "7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Oracle\VirtualBox Guest Additions\Oracle VM VirtualBox Guest Additions.url" (Source: "00000000-00002332.00000001.88751.00280000.00000004.mdmp, 00000000-00002332.00000002.89745.00280000.00000004.mdmp, 00000000-00003560.00000000.86765.00320000.00000004.mdmp, 00000000-00004068.00000000.90323.00200000.00000004.mdmp")38:Tde8,Found reference to API "GetDriveTypeA" (Indicator: "GetDriveTypeA"; File: "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e") Found reference to API "GetLogicalDriveStringsA" (Indicator: "GetLogicalDriveStringsA"; File: "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e") Found reference to API "GetLogicalDriveStringsA" (Indicator: "GetLogicalDriveStringsA"; Source: "00000000-00000468.00000000.87465.00400000.00000040.mdmp, 00000000-00000468.00000001.87861.00400000.00000040.mdmp, 00000000-00000940.00000000.88155.00409000.00000004.mdmp, 00000000-00000940.00000001.88759.00409000.00000004.mdmp, 00000000-00002916.00000001.84169.02B40000.00000004.mdmp, 00000000-00002952.00000000.82517.00409000.00000004.mdmp, 00000000-00002952.00000001.82780.00409000.00000004.mdmp, 00000000-00002996.00000000.81537.00409000.00000004.mdmp, 00000000-00003440.00000000.90322.00409000.00000004.mdmp, 00000000-00003960.00000000.89905.00409000.00000004.mdmp, 00000000-00004008.00000000.81283.00409000.00000004.mdmp, 00000000-00004112.00000000.90111.00409000.00000004.mdmp, 00000000-00004420.00000000.90806.00409000.00000004.mdmp, 00000000-00004604.00000000.81976.00400000.00000040.mdmp, 00000000-00004604.00000001.82212.00400000.00000040.mdmp, 00000000-00005004.00000000.84057.00409000.00000004.mdmp, 00000000-00005052.00000000.83689.00409000.00000004.mdmp, 00000000-00005088.00000000.83829.00409000.00000004.mdmp, 00000000-00005300.00000000.84449.00400000.00000040.mdmp, 00000000-00005300.00000001.84746.00400000.00000040.mdmp, 00000000-00005424.00000000.85048.00409000.00000004.mdmp, 00000000-00005424.00000001.85505.00409000.00000004.mdmp, 00000000-00005568.00000001.87057.02B90000.00000004.mdmp, 00000000-00005568.00000002.87218.02B90000.00000004.mdmp, 00000000-00005868.00000000.86686.00409000.00000004.mdmp, 00000000-00005976.00000000.87012.00409000.00000004.mdmp, 00000000-00006120.00000000.86800.00409000.00000004.mdmp") Found reference to API "GetDriveTypeA" (Indicator: "GetDriveTypeA"; Source: "00000000-00000468.00000000.87465.00400000.00000040.mdmp, 00000000-00000468.00000001.87861.00400000.00000040.mdmp, 00000000-00000940.00000000.88155.00409000.00000004.mdmp, 00000000-00000940.00000001.88759.00409000.00000004.mdmp, 00000000-00002916.00000001.84169.02B40000.00000004.mdmp, 00000000-00002952.00000000.82517.00409000.00000004.mdmp, 00000000-00002952.00000001.82780.00409000.00000004.mdmp, 00000000-00002996.00000000.81537.00409000.00000004.mdmp, 00000000-00003440.00000000.90322.00409000.00000004.mdmp, 00000000-00003960.00000000.89905.00409000.00000004.mdmp, 00000000-00004008.00000000.81283.00409000.00000004.mdmp, 00000000-00004112.00000000.90111.00409000.00000004.mdmp, 00000000-00004420.00000000.90806.00409000.00000004.mdmp, 00000000-00004604.00000000.81976.00400000.00000040.mdmp, 00000000-00004604.00000001.82212.00400000.00000040.mdmp, 00000000-00005004.00000000.84057.00409000.00000004.mdmp, 00000000-00005052.00000000.83689.00409000.00000004.mdmp, 00000000-00005088.00000000.83829.00409000.00000004.mdmp, 00000000-00005300.00000000.84449.00400000.00000040.mdmp, 00000000-00005300.00000001.84746.00400000.00000040.mdmp, 00000000-00005424.00000000.85048.00409000.00000004.mdmp, 00000000-00005424.00000001.85505.00409000.00000004.mdmp, 00000000-00005568.00000001.87057.02B90000.00000004.mdmp, 00000000-00005568.00000002.87218.02B90000.00000004.mdmp, 00000000-00005868.00000000.86686.00409000.00000004.mdmp, 00000000-00005976.00000000.87012.00409000.00000004.mdmp, 00000000-00006120.00000000.86800.00409000.00000004.mdmp")39:T563,file/memory contains long string(File: "ose.exe") Found string "k__BackingField" (Source: "00000000-00000468.00000000.87465.00EC2000.00000020.mdmp, 00000000-00002144.00000000.90863.003B2000.00000020.mdmp, 00000000-00002916.00000000.82579.00C52000.00000020.mdmp, 00000000-00003064.00000001.90201.003B2000.00000020.mdmp, 00000000-00005300.00000000.84449.00C52000.00000020.mdmp, 00000000-00005568.00000002.87218.00EC2000.00000020.mdmp") Found string "get_UserName" (Source: "00000000-00000468.00000000.87465.00EC2000.00000020.mdmp, 00000000-00002144.00000000.90863.003B2000.00000020.mdmp, 00000000-00002916.00000000.82579.00C52000.00000020.mdmp, 00000000-00002916.00000001.84169.00860000.00000004.mdmp, 00000000-00002916.00000001.84169.02B40000.00000004.mdmp, 00000000-00003064.00000001.90201.003B2000.00000020.mdmp, 00000000-00005300.00000000.84449.00C52000.00000020.mdmp, 00000000-00005568.00000002.87218.00EC2000.00000020.mdmp, 00000000-00005568.00000002.87218.02B90000.00000004.mdmp") Found string "set_UserName" (Source: "00000000-00000468.00000000.87465.00EC2000.00000020.mdmp, 00000000-00002144.00000000.90863.003B2000.00000020.mdmp, 00000000-00002916.00000000.82579.00C52000.00000020.mdmp, 00000000-00003064.00000001.90201.003B2000.00000020.mdmp, 00000000-00005300.00000000.84449.00C52000.00000020.mdmp, 00000000-00005568.00000002.87218.00EC2000.00000020.mdmp")3a:T6db,Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00000468.00000000.87465.00400000.00000040.mdmp, 00000000-00000468.00000001.87861.00400000.00000040.mdmp, 00000000-00000940.00000000.88155.00409000.00000004.mdmp, 00000000-00000940.00000001.88759.00409000.00000004.mdmp, 00000000-00002916.00000001.84169.02B40000.00000004.mdmp, 00000000-00002952.00000000.82517.00409000.00000004.mdmp, 00000000-00002952.00000001.82780.00409000.00000004.mdmp, 00000000-00002996.00000000.81537.00409000.00000004.mdmp, 00000000-00003440.00000000.90322.00409000.00000004.mdmp, 00000000-00003960.00000000.89905.00409000.00000004.mdmp, 00000000-00004008.00000000.81283.00409000.00000004.mdmp, 00000000-00004112.00000000.90111.00409000.00000004.mdmp, 00000000-00004420.00000000.90806.00409000.00000004.mdmp, 00000000-00004604.00000000.81976.00400000.00000040.mdmp, 00000000-00004604.00000001.82212.00400000.00000040.mdmp, 00000000-00005004.00000000.84057.00409000.00000004.mdmp, 00000000-00005052.00000000.83689.00409000.00000004.mdmp, 00000000-00005088.00000000.83829.00409000.00000004.mdmp, 00000000-00005300.00000000.84449.00400000.00000040.mdmp, 00000000-00005300.00000001.84746.00400000.00000040.mdmp, 00000000-00005424.00000000.85048.00409000.00000004.mdmp, 00000000-00005424.00000001.85505.00409000.00000004.mdmp, 00000000-00005568.00000001.87057.02B90000.00000004.mdmp, 00000000-00005568.00000002.87218.02B90000.00000004.mdmp, 00000000-00005868.00000000.86686.00409000.00000004.mdmp, 00000000-00005976.00000000.87012.00409000.00000004.mdmp, 00000000-00006120.00000000.86800.00409000.00000004.mdmp")3b:T639,file/memory contains long string(File: "ModuleAnalysisCache") Found string "$dscResources = Microsoft.PowerShell.Management\Get-ChildItem -Path $dscResourcesDir -Directory -Name" (Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$RoleCapabilityNames = Microsoft.PowerShell.Management\Get-ChildItem -Path $RoleCapabilitiesDir `" (Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$packageFiles = Microsoft.PowerShell.Management\Get-ChildItem -Path $tempPackagePath -Recurse -Exclude "*.nupkg","*.nuspec"" (Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$scriptInfoFiles = Get-ChildItem -Path $location `" (Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$scriptFiles = Get-ChildItem -Path $location `" (Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$Files = Microsoft.PowerShell.Management\Get-ChildItem -Path $ModuleBase" (Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$FileList = Get-ChildItem -Path $ModuleBasePath `" (Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp")3c:T6db,Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00000468.00000000.87465.00400000.00000040.mdmp, 00000000-00000468.00000001.87861.00400000.00000040.mdmp, 00000000-00000940.00000000.88155.00409000.00000004.mdmp, 00000000-00000940.00000001.88759.00409000.00000004.mdmp, 00000000-00002916.00000001.84169.02B40000.00000004.mdmp, 00000000-00002952.00000000.82517.00409000.00000004.mdmp, 00000000-00002952.00000001.82780.00409000.00000004.mdmp, 00000000-00002996.00000000.81537.00409000.00000004.mdmp, 00000000-00003440.00000000.90322.00409000.00000004.mdmp, 00000000-00003960.00000000.89905.00409000.00000004.mdmp, 00000000-00004008.00000000.81283.00409000.00000004.mdmp, 00000000-00004112.00000000.90111.00409000.00000004.mdmp, 00000000-00004420.00000000.90806.00409000.00000004.mdmp, 00000000-00004604.00000000.81976.00400000.00000040.mdmp, 00000000-00004604.00000001.82212.00400000.00000040.mdmp, 00000000-00005004.00000000.84057.00409000.00000004.mdmp, 00000000-00005052.00000000.83689.00409000.00000004.mdmp, 00000000-00005088.00000000.83829.00409000.00000004.mdmp, 00000000-00005300.00000000.84449.00400000.00000040.mdmp, 00000000-00005300.00000001.84746.00400000.00000040.mdmp, 00000000-00005424.00000000.85048.00409000.00000004.mdmp, 00000000-00005424.00000001.85505.00409000.00000004.mdmp, 00000000-00005568.00000001.87057.02B90000.00000004.mdmp, 00000000-00005568.00000002.87218.02B90000.00000004.mdmp, 00000000-00005868.00000000.86686.00409000.00000004.mdmp, 00000000-00005976.00000000.87012.00409000.00000004.mdmp, 00000000-00006120.00000000.86800.00409000.00000004.mdmp")3d:T386e,"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360048e4e708583d12006d82e176e4c9270004010000 (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000650032003500320061006300340031003900620034003600330034003100610064003100650061006300350064006600660037006300390036003700360065002e00650078006500000000000000000000000000000000000000000000000000000000000000ff2b53775fef5b77d8eb0177ac0122000000220000000000000000001a007a0003000000000000000000000000000000000000001b007500030000000000000000000000d86f220000000000200000000000000000000000e0eb2500c86c2200e86d2200b0cf27009071220000000000f42712000000000074291200 (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000012005a005c0054361200783812003437120553002d0031002d0035002d00320031002d0032003000390032003300350036003000340033002d0034003000340031003700300030003800310037002d003600360033003100320037003200300034002d00310030003000310000009c3b12009e0062011700000030cd290000002200f8cd290018000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360064eee708343712006d82e176f4fe2a0004010000 (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002b00f83b0000ff07000000002200000000007f070000c4002200a82f2200385b0000a436120067e550770000220020062b0000000000000022000000000020062b0000000000e45a00be80000000c8082b00c4002200e0412a00003b0000000022000000000020062b00c01700000000220018032b00f83b0000ff07000000002200000000007f070000c40022007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360064eee708343712006d82e17614012b0004010000 (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002b00f83b0000ff07000000002200000000007f070000c4002200a82f2200f45a0000a436120067e550770000220040082b0000000000000022000000000040082b0000000000a05a00fa80000000e80a2b00c400220010422a00003b0000000022000000000040082b00c01700000000220038052b00f83b0000ff07000000002200000000007f070000c40022007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360064eee708343712006d82e176bc022b0004010000 (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002b00f83b0000ff07000000002200000000007f070000c4002200a82f2200bf5a0000a436120067e5507700002200e8092b00000000000000220000000000e8092b00000000006b5a003180000000900c2b00c400220098412a00003b00000000220000000000e8092b00c017000000002200e0062b00f83b0000ff07000000002200000000007f070000c40022007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360064eee708343712006d82e176ec032b0004010000 (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002b00f83b0000ff07000000002200000000007f070000c4002200a82f2200995a0000a436120067e5507700002200180b2b00000000000000220000000000180b2b0000000000455a001f80000000c00d2b00c400220098412a00003b00000000220000000000180b2b00c01700000000220010082b00f83b0000ff07000000002200000000007f070000c40022007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360064eee708343712006d82e1761c052b0004010000 (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002b00f83b0000ff07000000002200000000007f070000c4002200a82f2200735a0000a436120067e5507700002200480c2b00000000000000220000000000480c2b00000000001f5a004580000000f00e2b00c400220000422a00003b00000000220000000000480c2b00c01700000000220040092b00f83b0000ff07000000002200000000007f070000c40022007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360064eee708343712006d82e17644062b0004010000 (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002b00f83b0000ff07000000002200000000007f070000c4002200a82f22004e5a0000a436120067e5507700002200700d2b00000000000000220000000000700d2b0000000000fa5900a38000000018102b00c400220098412a00003b00000000220000000000700d2b00c017000000002200680a2b00f83b0000ff07000000002200000000007f070000c40022007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360064eee708343712006d82e17674072b0004010000 (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002b00f83b0000ff07000000002200000000007f070000c4002200a82f2200285a0000a436120067e5507700002200a00e2b00000000000000220000000000a00e2b0000000000d459008d8000000048112b00c400220000422a00003b00000000220000000000a00e2b00c017000000002200980b2b00f83b0000ff07000000002200000000007f070000c40022007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360064eee708343712006d82e176a4082b0004010000 (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002b00f83b0000ff07000000002200000000007f070000c4002200a82f2200025a0000a436120067e5507700002200d00f2b00000000000000220000000000d00f2b0000000000ae5900f78000000078122b00c400220000422a00003b00000000220000000000d00f2b00c017000000002200c80c2b00f83b0000ff07000000002200000000007f070000c40022007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360064eee708343712006d82e176cc092b0004010000 (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002b00f83b0000ff07000000002200000000007f070000c4002200a82f2200dd590000a436120067e5507700002200f8102b00000000000000220000000000f8102b0000000000895900d080000000a0132b00c400220098412a00003b00000000220000000000f8102b00c017000000002200f00d2b00f83b0000ff07000000002200000000007f070000c40022007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360064eee708343712006d82e176040b2b0004010000 (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000a13ff10854401200544012001e75407100000000782b2a008c471200a0010000000000000000000000000000304512005ecba575a001000000000000005da3758c4712000e5da37524431200dcaaa775010000000000000072000000ffffffffffffffffac401200780200000000000025000000ac4012007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036009499e708044112006d82e176dc112b0004010000 (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000ffff1400200180000000620ba57500000000d86f2200000000005000000024142b0002000000806b260000000000010000089891270000742200380ba575383f120002000000ec3f12003f08d77602000000806b2600000000000100001888fbd676dc3f1200c81ca775b241120095fbd67610411200806b260000000000000000000000000098401200000022007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036004899e708584012006d82e176dc112b0004010000 (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360020e0e708703912006d82e176fc162b0004010000 (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2b5377578e5b773c4a1200cc01220000002200000000000000000011006101a80200009c42120064490101ec5c120092e0427112005801a8020000544912004c9c4271a0491200000000008e000000f0491200feffffff78491200cf005477d60054775f8e5b778e00000047000000f04912000d0c00004c49120095e14f77b449120095e14f773fc11a00feffffffd60054772f7b41750100000047002c0e167b4175085df008 (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000058962b009c4b12000464537738012200e0635377bb8c5b77000000000000220060962b006dd1d676eb5ff0086cae75750000000000000000d8be397780d32b00a82f22000100000000002200500122000c00000060962b00a82f220002000002180000008d4100cc820000000000000000000000030000003c4b1200820000007f070000000000008d4100cc02000000c075de7680d32b0000000000c075de76584b1200b830220000000000a82f2200b04b1200ff2b5377c38c5b777400000004022200000022001100e2020e000000000000001000000000000101bc4a1200 (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002c0060bc2c005bbc2c0000000000000000000000220000000001e43b1200000000004849120095e14f770fd51a00feffffff435c537750595377aa000000b80000005abc2c0058bc2c006c3d1200a4411200000000006100640031006500610063003500640066006600e01b0000000022001c5c527760d84175ffffffff170000001c3d120024000000030000000c42120038471200a441120086000000483d120096ed537782bc2c00a06a2975860000006c3d1200a44112000000000086008800a06a29756c3d1200916c297582bc2c00a06a2975a06a2975dc41120002020000 (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003556)3e:T1c42,"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb0177b0cf27000030fd7f9a5c547700f0fd7f382912004430fd7f00000000400000003f0000001b0000000030fd7f2c291200c15c547760825b771b0000000030fd7f9a5c547700f0fd7f502912005789537780835b7713174275d8eb0177 (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000043003a005c00550073006500720073005c0048004100500055004200570053005c004100700070004400610074006100000000000100000061006c0001000000000000000000000061006d00060000060ca9000050a94400c08c44005c0050007900740068006f006e00330036002d00 (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310076f5f65377343c6a77f42ecb7170724400a035cb71443c6a77fce9230070544400b2f45377543c6a770cea23000000c4710000c4710000000068e92300f0000000f000c4710000000078e92300530000000ceb23000000000001000000dce9230040f553770000000000000000c8e92300 (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c47e973309e4b008c47e97300000000309e4b00d4da2300086d537718815b770000000088db230000000000de54576414db230095e14f7720c41a00feffffff6b2c547731194275021000000000000000000100e8da2300c89f53778c47e9730000000000000000 (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb0177a061490400f0fd7f9a5c54770040fd7ffcc36d0544f0fd7f00000000400000003f0000002f00000000f0fd7ff0c36d05c15c547760825b772f00000000f0fd7f9a5c54770040fd7f14c46d055789537780835b7713174275d8eb0177 (UID: 00000000-00004028) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb0177b80a18000030fd7f9a5c547700f0fd7f68ba07004430fd7f00000000400000003f0000001d0000000030fd7f5cba0700c15c547760825b771d0000000030fd7f9a5c547700f0fd7f80ba07005789537780835b7713174275d8eb0177 (UID: 00000000-00004148) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000001010000000000051200000000101800ff011f000102000000000005200000002002000000102400ff011f00010500000000000515000000cbd1b67cd175e7f0a4848627e903000001020000000000052000000020020000010500000000000515000000cbd1b67cd175e7f0a4848627 (UID: 00000000-00004148) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000095e14f77ea151a00fefffffff5f65377634d5477c827160010151d7388081d00b2f453773ef3d17794ee980000001c7300001c73804d54775af3d177f0000000f0001c730000000000ee98005c00430094ef9800000000000100000064ee980040f55377000000000000000050ee9800 (UID: 00000000-00004148) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007100ee980001000000000000000000957500000000eced980000000000000000000000000000ee9800000000000000000000000000ca9b4596f4ed98000200000000000000880000000000957500ee9800459d8a7500003f0000000000800000000200000000009900dc1a1c7314ee9800 (UID: 00000000-00004148) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004148) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb017768ce320000f0fd7f9a5c547700e0fd7fe0bb160044f0fd7f00000000400000003f0000001d00000000f0fd7fd4bb1600c15c547760825b771d00000000f0fd7f9a5c547700e0fd7ff8bb16005789537780835b7713174275d8eb0177 (UID: 00000000-00001160) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100005c0048006e0063005500740069006c0073005c0048006e0063005500700064006100740065002e00650078006500000000000000ed7e7334000000807b00370043003500410034003000450046002d0041003000460042002d0034004200460043002d0038003700340041002d004300 (UID: 00000000-00001160) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000195e14f7711211a00fefffffff5f65377634d5477081b310010151d7388081d00b2f4537715c54f7644ed060100001c7300001c73804d5477f1c44f76f0000000f0001c7300000000b0ec06015c00430044ee0601000000000100000014ed060140f55377000000000000000000ed0601 (UID: 00000000-00001160) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310071b0ec0601010000000000000000009575000000009cec0601000000000000000000000000b0ec060100000000000000000000000029156867a4ec060102000000000000008800000000009575b0ec0601459d8a7500005b0000000000800000000200000000000701dc1a1c73c4ec0601 (UID: 00000000-00001160) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001160)3f:T4da,"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "svchost.com" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "svchost.com" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME")40:T1231,"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\3582-490\61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" at 00000000-00004028-0000010C-2298450 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00004148-0000010C-2259006 "powershell.exe" queries volume information of "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk" at 00000000-00004148-0000010C-2448277 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00004148-0000010C-2453250 "powershell.exe" queries volume information of "C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe" at 00000000-00004148-0000010C-2453897 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00004148-0000010C-2457339 "powershell.exe" queries volume information of "C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe" at 00000000-00004148-0000010C-2457974 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00004148-0000010C-9982627 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00004148-0000010C-10558691 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00004148-0000010C-13228381 "powershell.exe" queries volume information of "C:\share" at 00000000-00004148-0000010C-13230441 "powershell.exe" queries volume information of "C:\share" at 00000000-00004148-0000010C-13435803 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll" at 00000000-00004148-0000010C-16612824 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll" at 00000000-00004148-0000010C-16619978 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll" at 00000000-00004148-0000010C-16623869 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll" at 00000000-00004148-0000010C-16627650 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.dll" at 00000000-00004148-0000010C-16631350 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll" at 00000000-00004148-0000010C-17421221 "powershell.exe" queries volume information of "C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll" at 00000000-00004148-0000010C-17995043 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll" at 00000000-00004148-0000010C-21807231 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll" at 00000000-00004148-0000010C-21811076 "powershell.exe" queries volume information of "C:\Program Files\AutoIt3\AutoItX\AutoItX3.PowerShell.dll" at 00000000-00004148-0000010C-21961772 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00001160-0000010C-3428316 "powershell.exe" queries volume information of "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk" at 00000000-00001160-0000010C-3727335 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00001160-0000010C-373228741:T5ee,"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\61D0FA3933D0620B188C69CA85D91241E252AC419B46341AD1EAC5DFF7C9676E.EXE") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\61D0FA3933D0620B188C69CA85D91241E252AC419B46341AD1EAC5DFF7C9676E.EXE") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SVCHOST.COM") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SVCHOST.COM") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SCHTASKS.EXE") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SCHTASKS.EXE") "61D0FA~1.EXE" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SVCHOST.COM") "61D0FA~1.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SVCHOST.COM")42:T418,"powershell.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\FH8YCUY4Y857AKKF9M5J.temp" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF12a6d9.TMP" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\D2Q972V9L0DME0SRKDHU.temp" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF12b5b7.TMP"43:T5a7,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")44:T714,"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00004028) "powershell.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00004148) "powershell.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Recent\CustomDestinations (UID: 00000000-00004148) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00004148) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00004148) "powershell.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00001160) "powershell.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Recent\CustomDestinations (UID: 00000000-00001160) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00001160) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00001160) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00004296)45:T691,"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "CreateProcessW" with parameter ""%TEMP%\3582-490\61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe"" - (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "CreateProcessW" with parameter ""%WINDIR%\svchost.com" "%WINDIR%\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "%USERPROFILE%\AppD" - (UID: 00000000-00004028), "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "CreateProcessW" with parameter ""%WINDIR%\svchost.com" "%WINDIR%\System32\schtasks.exe" /Create /TN "Updates\eiVfWxqyEFoV" /XML "%USERPROFILE%\AppData\Loca" - (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "CreateProcessA" with parameter "%TEMP%\3582-490\61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" - (UID: 00000000-00004028) "svchost.com" called "CreateProcessA" with parameter "%WINDIR%\System32\WINDOW~1\v1.0\powershell.exe Add-MpPreference -ExclusionPath %APPDATA%\eiVfWxqyEFoV.exe" - (UID: 00000000-00001372) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "CreateProcessW" with parameter ""%WINDIR%\svchost.com" "%TEMP%\3582-490\61D0FA~1.EXE"" - (UID: 00000000-00004296) "svchost.com" called "CreateProcessA" with parameter "%TEMP%\3582-490\61D0FA~1.EXE" - (UID: 00000000-00001416) "61D0FA~1.EXE" called "CreateProcessW" with parameter ""%WINDIR%\svchost.com" "%WINDIR%\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "%USERPROFILE%\AppD" - (UID: 00000000-00002580)46:T11ac6,"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %PROGRAMFILES(X86)%\Adobe\ARM\S\27490\ADOBEA~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %PROGRAMFILES(X86)%\Adobe\Setup\{AC76B~1\setup.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %PROGRAMFILES(X86)%\KMSAutoS\bin\driver\x86TAP1\devcon.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %PROGRAMFILES(X86)%\KMSAutoS\bin\driver\x86TAP2\devcon.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %PROGRAMFILES(X86)%\KMSAutoS\bin\KMSSS.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %PROGRAMFILES(X86)%\KMSAutoS\KMSAUT~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %PROGRAMFILES(X86)%\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %PROGRAMFILES(X86)%\Oracle\Java\javapath\java.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %PROGRAMFILES(X86)%\Oracle\Java\javapath\javaw.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %PROGRAMFILES(X86)%\Oracle\Java\javapath\javaws.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %PROGRAMFILES(X86)%\PACKAG~1\{410C0~1\VC_RED~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter C:\TORSER~1\tor\PLUGGA~1\OBFS4P~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter C:\TORSER~1\tor\TOR-GE~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter C:\TORSER~1\tor\tor.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %APPDATA%\MACROM~1\FLASHP~1\WWWMAC~1.COM\bin\AIRAPP~1\AIRAPP~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\MICROS~1\OneDrive\173460~1.012\FILESY~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\MICROS~1\OneDrive\173460~1.012\ONEDRI~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\MICROS~1\OneDrive\OneDrive.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\MICROS~1\Windows\TEMPOR~1\Content.IE5\QQW0X29Y\CHROME~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\PACKAG~1\{1BB10~1\PYTHON~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\PACKAG~1\{85379~1\PYTHON~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~1\Lib\DISTUT~1\command\WININS~2.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~1\Lib\DISTUT~1\command\WININS~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~1\Lib\DISTUT~1\command\WININS~4.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~1\Lib\DISTUT~1\command\WININS~3.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~1\Lib\DISTUT~1\command\WI2335~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~1\Lib\DISTUT~1\command\WI5ED8~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~1\Lib\DISTUT~1\command\WIC467~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~1\Lib\DISTUT~1\command\WI5DE4~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~1\Lib\DISTUT~1\command\WI02EA~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~1\Lib\SITE-P~1\pip\_vendor\distlib\t32.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~1\Lib\SITE-P~1\pip\_vendor\distlib\t64.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~1\Lib\SITE-P~1\pip\_vendor\distlib\w32.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~1\Lib\SITE-P~1\pip\_vendor\distlib\w64.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~1\Lib\SITE-P~1\SETUPT~1\cli-32.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~1\Lib\SITE-P~1\SETUPT~1\cli-64.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~1\Lib\SITE-P~1\SETUPT~1\cli.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~1\Lib\SITE-P~1\SETUPT~1\gui-32.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~1\Lib\SITE-P~1\SETUPT~1\gui-64.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~1\Lib\SITE-P~1\SETUPT~1\gui.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~1\python.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~1\pythonw.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~1\Scripts\EASY_I~2.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~1\Scripts\EASY_I~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~1\Scripts\pip.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~1\Scripts\PIP36~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~1\Scripts\pip3.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\Lib\DISTUT~1\command\WININS~2.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\Lib\DISTUT~1\command\WININS~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\Lib\DISTUT~1\command\WININS~4.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\Lib\DISTUT~1\command\WININS~3.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\Lib\DISTUT~1\command\WI2335~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\Lib\DISTUT~1\command\WI5ED8~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\Lib\DISTUT~1\command\WIC467~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\Lib\DISTUT~1\command\WI5DE4~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\Lib\DISTUT~1\command\WI02EA~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\Lib\SITE-P~1\pip\_vendor\distlib\t32.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\Lib\SITE-P~1\pip\_vendor\distlib\t64.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\Lib\SITE-P~1\pip\_vendor\distlib\w32.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\Lib\SITE-P~1\pip\_vendor\distlib\w64.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\Lib\SITE-P~1\PYTHON~1\PYTHON~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\Lib\SITE-P~1\SETUPT~1\cli-32.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\Lib\SITE-P~1\SETUPT~1\cli-64.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\Lib\SITE-P~1\SETUPT~1\cli.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\Lib\SITE-P~1\SETUPT~1\gui-32.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\Lib\SITE-P~1\SETUPT~1\gui-64.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\Lib\SITE-P~1\SETUPT~1\gui.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\Lib\venv\scripts\nt\python.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\Lib\venv\scripts\nt\pythonw.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\python.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\pythonw.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\Scripts\pip.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\Scripts\PIP38~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\Scripts\pip3.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %APPDATA%\EIVFWX~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %USERPROFILE%\DOWNLO~1\0DZXAP~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %USERPROFILE%\DOWNLO~1\1LOWM7~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %USERPROFILE%\DOWNLO~1\LU234S~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %USERPROFILE%\DOWNLO~1\MGF1QB~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %USERPROFILE%\DOWNLO~1\NPPTEV~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %USERPROFILE%\DOWNLO~1\P7FFLJ~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %USERPROFILE%\DOWNLO~1\QHQSY0~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %USERPROFILE%\DOWNLO~1\QOLDJW~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %USERPROFILE%\DOWNLO~1\RKnV.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %USERPROFILE%\DOWNLO~1\S4HMOK~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %USERPROFILE%\DOWNLO~1\SQZAA8~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %USERPROFILE%\DOWNLO~1\VAY7QX~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %USERPROFILE%\DOWNLO~1\VjguKL.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %USERPROFILE%\DOWNLO~1\VSKESP~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %USERPROFILE%\DOWNLO~1\WbaQ7e.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %USERPROFILE%\DOWNLO~1\XUCCH6~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %USERPROFILE%\DOWNLO~1\Y17HAC~1.EXE (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %USERPROFILE%\DOWNLO~1\Z68C2t.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter WindowsCodecs.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00004028) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00004028) "svchost.com" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003280) "svchost.com" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\Lib\SITE-P~1\SETUPT~1\gui-64.exe (UID: 00000000-00003280) "svchost.com" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\Lib\SITE-P~1\SETUPT~1\gui.exe (UID: 00000000-00003280) "svchost.com" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\Lib\venv\scripts\nt\pythonw.exe (UID: 00000000-00003280) "svchost.com" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\python.exe (UID: 00000000-00003280) "svchost.com" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\pythonw.exe (UID: 00000000-00003280) "svchost.com" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\Scripts\NORMAL~1.EXE (UID: 00000000-00003280) "svchost.com" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\Scripts\pip.exe (UID: 00000000-00003280) "svchost.com" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\Scripts\PIP38~1.EXE (UID: 00000000-00003280) "svchost.com" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Programs\Python\PYTHON~2\Scripts\pip3.exe (UID: 00000000-00003280) "svchost.com" called "LoadLibrary" with a parameter %APPDATA%\EIVFWX~1.EXE (UID: 00000000-00003280) "svchost.com" called "LoadLibrary" with a parameter %APPDATA%\MACROM~1\FLASHP~1\WWWMAC~1.COM\bin\AIRAPP~1\AIRAPP~1.EXE (UID: 00000000-00003280) "svchost.com" called "LoadLibrary" with a parameter %USERPROFILE%\DOWNLO~1\0DZXAP~1.EXE (UID: 00000000-00003280) "svchost.com" called "LoadLibrary" with a parameter %USERPROFILE%\DOWNLO~1\1LOWM7~1.EXE (UID: 00000000-00003280) "svchost.com" called "LoadLibrary" with a parameter %USERPROFILE%\DOWNLO~1\g5pB3.exe (UID: 00000000-00003280) "svchost.com" called "LoadLibrary" with a parameter %USERPROFILE%\DOWNLO~1\NPPTEV~1.EXE (UID: 00000000-00003280) "svchost.com" called "LoadLibrary" with a parameter %USERPROFILE%\DOWNLO~1\P7FFLJ~1.EXE (UID: 00000000-00003280) "svchost.com" called "LoadLibrary" with a parameter %USERPROFILE%\DOWNLO~1\QOLDJW~1.EXE (UID: 00000000-00003280) "svchost.com" called "LoadLibrary" with a parameter %USERPROFILE%\DOWNLO~1\QZ0GLV~1.EXE (UID: 00000000-00003280) "svchost.com" called "LoadLibrary" with a parameter %USERPROFILE%\DOWNLO~1\S4HMOK~1.EXE (UID: 00000000-00003280) "svchost.com" called "LoadLibrary" with a parameter %USERPROFILE%\DOWNLO~1\SQZAA8~1.EXE (UID: 00000000-00003280) "svchost.com" called "LoadLibrary" with a parameter %USERPROFILE%\DOWNLO~1\uqmgQd.exe (UID: 00000000-00003280) "svchost.com" called "LoadLibrary" with a parameter %USERPROFILE%\DOWNLO~1\VAY7QX~1.EXE (UID: 00000000-00003280) "svchost.com" called "LoadLibrary" with a parameter %USERPROFILE%\DOWNLO~1\VSKESP~1.EXE (UID: 00000000-00003280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pb378ec07#\d254c63bedcb76c81c3125bd527b7d1a\Microsoft.PowerShell.ConsoleH (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\73a1a80aed03e789a49cec899b7505dd\System.Management.Automation. (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automatio (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter MSISIP.DLL (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WINDOW~1\v1.0\powershell.exe (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wshext.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WindowsPowerShell\v1.0\pwrshsip.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\df2dd09ed7c341842a104e1e668f184e\System.Data.ni.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Dired13b18a9#\2e76676fbd265f70be92c82bbf76b8e5\System.DirectoryServices.ni.d (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f792626#\05765f777020deeddc8ad54b48343b9c\Microsoft.PowerShell.Security (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\f0821980bfe2fc8375ccfc37dbe6e9d8\Microsoft.Management.Infrastr (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Numerics\e7d6ed984300c7212c6e682c4f730b1e\System.Numerics.ni.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\f73f48afb5512225dedaee9c88ac5050\Microsoft.CSharp.ni.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.M870d558a#\7ceb6b903321c16b12386a8df1be50f9\Microsoft.Management.Infrastr (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pae3498d9#\8dcf1daed985f481eed5cca9d2945c18\Microsoft.PowerShell.Commands (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Confe64a9051#\1561b93d6d25c4a9c3e2659ab29a5e73\System.Configuration.Install. (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.DLL (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter netutils.dll (UID: 00000000-00004148) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pb378ec07#\d254c63bedcb76c81c3125bd527b7d1a\Microsoft.PowerShell.ConsoleH (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\73a1a80aed03e789a49cec899b7505dd\System.Management.Automation. (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automatio (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter MSISIP.DLL (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wshext.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WindowsPowerShell\v1.0\pwrshsip.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WINDOW~1\v1.0\powershell.exe (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\df2dd09ed7c341842a104e1e668f184e\System.Data.ni.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Dired13b18a9#\2e76676fbd265f70be92c82bbf76b8e5\System.DirectoryServices.ni.d (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f792626#\05765f777020deeddc8ad54b48343b9c\Microsoft.PowerShell.Security (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\f0821980bfe2fc8375ccfc37dbe6e9d8\Microsoft.Management.Infrastr (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Numerics\e7d6ed984300c7212c6e682c4f730b1e\System.Numerics.ni.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\f73f48afb5512225dedaee9c88ac5050\Microsoft.CSharp.ni.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.M870d558a#\7ceb6b903321c16b12386a8df1be50f9\Microsoft.Management.Infrastr (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pae3498d9#\8dcf1daed985f481eed5cca9d2945c18\Microsoft.PowerShell.Commands (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Confe64a9051#\1561b93d6d25c4a9c3e2659ab29a5e73\System.Configuration.Install. (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.DLL (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter netutils.dll (UID: 00000000-00001160) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002724) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002724) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004296) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004296) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00004296) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004296) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004296) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00004296) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00004296) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00004296) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004296) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00004296) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00004296) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00004296) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00004296) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00004296) "61D0FA~1.EXE" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002580) "61D0FA~1.EXE" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002580) "61D0FA~1.EXE" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002580) "61D0FA~1.EXE" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002580) "61D0FA~1.EXE" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002580) "61D0FA~1.EXE" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00002580) "61D0FA~1.EXE" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002580) "61D0FA~1.EXE" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002580) "61D0FA~1.EXE" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00002580) "61D0FA~1.EXE" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002580) "61D0FA~1.EXE" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002580) "61D0FA~1.EXE" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002580) "61D0FA~1.EXE" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002580) "61D0FA~1.EXE" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002580) "61D0FA~1.EXE" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002580) "61D0FA~1.EXE" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00002580) "61D0FA~1.EXE" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002580) "61D0FA~1.EXE" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002580) "61D0FA~1.EXE" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00002580) "61D0FA~1.EXE" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00002580) "61D0FA~1.EXE" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002580) "61D0FA~1.EXE" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00002580) "61D0FA~1.EXE" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002580) "61D0FA~1.EXE" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002580) "61D0FA~1.EXE" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002580) "61D0FA~1.EXE" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002580) "61D0FA~1.EXE" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002580) "61D0FA~1.EXE" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002580) "61D0FA~1.EXE" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002580) "61D0FA~1.EXE" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002580)47:T15e4,"C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000468.00000000.87465.00130000.00000002.mdmp 00000000-00000468.00000000.87465.00500000.00000004.mdmp 00000000-00000468.00000001.87861.00500000.00000004.mdmp 00000000-00002332.00000001.88751.00280000.00000004.mdmp 00000000-00002332.00000002.89745.00280000.00000004.mdmp 00000000-00003560.00000000.86765.00320000.00000004.mdmp 00000000-00003560.00000001.88687.00320000.00000004.mdmp 00000000-00003560.00000002.90611.00320000.00000004.mdmp 00000000-00004068.00000000.90323.00200000.00000004.mdmp 00000000-00004604.00000000.81976.00560000.00000004.mdmp 00000000-00004604.00000001.82212.00560000.00000004.mdmp 00000000-00005300.00000000.84449.002A0000.00000004.mdmp 00000000-00005300.00000001.84746.002A0000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000468.00000000.87465.00130000.00000002.mdmp 00000000-00000468.00000000.87465.00500000.00000004.mdmp 00000000-00000468.00000001.87861.00500000.00000004.mdmp 00000000-00002332.00000001.88751.00280000.00000004.mdmp 00000000-00002332.00000002.89745.00280000.00000004.mdmp 00000000-00003560.00000000.86765.00320000.00000004.mdmp 00000000-00003560.00000001.88687.00320000.00000004.mdmp 00000000-00003560.00000002.90611.00320000.00000004.mdmp 00000000-00004068.00000000.90323.00200000.00000004.mdmp 00000000-00004604.00000000.81976.00560000.00000004.mdmp 00000000-00004604.00000001.82212.00560000.00000004.mdmp 00000000-00005300.00000000.84449.002A0000.00000004.mdmp 00000000-00005300.00000001.84746.002A0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000468.00000000.87465.00500000.00000004.mdmp 00000000-00000468.00000001.87861.00500000.00000004.mdmp 00000000-00002332.00000001.88751.00280000.00000004.mdmp 00000000-00002332.00000002.89745.00280000.00000004.mdmp 00000000-00002916.00000001.84169.049A0000.00000004.mdmp 00000000-00003064.00000001.90201.04AD0000.00000004.mdmp 00000000-00003560.00000000.86765.00320000.00000004.mdmp 00000000-00003560.00000001.88687.00320000.00000004.mdmp 00000000-00003560.00000002.90611.00320000.00000004.mdmp 00000000-00004068.00000000.90323.00200000.00000004.mdmp 00000000-00004604.00000000.81976.00560000.00000004.mdmp 00000000-00004604.00000001.82212.00560000.00000004.mdmp 00000000-00005300.00000000.84449.002A0000.00000004.mdmp 00000000-00005300.00000001.84746.002A0000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000468.00000000.87465.00500000.00000004.mdmp 00000000-00000468.00000001.87861.00500000.00000004.mdmp 00000000-00002332.00000001.88751.00280000.00000004.mdmp 00000000-00002332.00000002.89745.00280000.00000004.mdmp 00000000-00002916.00000001.84169.004F0000.00000004.mdmp 00000000-00002916.00000001.84169.049A0000.00000004.mdmp 00000000-00003064.00000001.90201.00610000.00000004.mdmp 00000000-00003064.00000001.90201.04AD0000.00000004.mdmp 00000000-00003560.00000000.86765.00320000.00000004.mdmp 00000000-00003560.00000001.88687.00320000.00000004.mdmp 00000000-00003560.00000002.90611.00320000.00000004.mdmp 00000000-00004068.00000000.90323.00200000.00000004.mdmp 00000000-00004604.00000000.81976.00560000.00000004.mdmp 00000000-00004604.00000001.82212.00560000.00000004.mdmp 00000000-00005300.00000000.84449.002A0000.00000004.mdmp 00000000-00005300.00000001.84746.002A0000.00000004.mdmp 00000000-00005568.00000001.87057.00420000.00000004.mdmp 00000000-00005568.00000002.87218.00420000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00002332.00000000.86829.00280000.00000004.mdmp 00000000-00002332.00000001.88751.00280000.00000004.mdmp 00000000-00002332.00000002.89745.00280000.00000004.mdmp 00000000-00003560.00000000.86765.00320000.00000004.mdmp 00000000-00003560.00000001.88687.00320000.00000004.mdmp 00000000-00003560.00000002.90611.00320000.00000004.mdmp 00000000-00004068.00000000.90323.00200000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00002332.00000000.86829.00280000.00000004.mdmp 00000000-00002332.00000001.88751.00280000.00000004.mdmp 00000000-00003560.00000000.86765.00320000.00000004.mdmp 00000000-00003560.00000001.88687.00320000.00000004.mdmp 00000000-00003560.00000002.90611.00320000.00000004.mdmp 00000000-00004068.00000000.90323.00200000.00000004.mdmp "sers\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "sers\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00002332.00000001.88751.00280000.00000004.mdmp 00000000-00002332.00000002.89745.00280000.00000004.mdmp 00000000-00003560.00000001.88687.00320000.00000004.mdmp 00000000-00003560.00000002.90611.00320000.00000004.mdmp 00000000-00004068.00000000.90323.00200000.00000004.mdmp48:T7ed,Process 61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process 61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process 61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe created mutex with name "\Sessions\1\BaseNamedObjects\MutexPolesskayaGlush*.*svchost.comexefile\shell\open\command‹À "%1" %*œ‘@" Process 61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\CLR_PerfMon_WrapMutex" Process 61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe created mutex with name "\Sessions\1\BaseNamedObjects\QkZIgqsFKSkmXvyECPLgu" Process svchost.com created mutex with name "\Sessions\1\BaseNamedObjects\MutexPolesskayaGlush*.*svchost.comµáÙnÊXý±.štÛNóÄžt“îâhî„‹À`ˆ²òTø5ýœ‘@" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\_SHuassist.mtx" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\CLR_PerfMon_WrapMutex" Process 61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe created mutex with name "\Sessions\1\BaseNamedObjects\MutexPolesskayaGlush*.*svchost.comµáÙnÊXý±.štÛNóÄžt“îâhî„‹À`ˆ²òTø5ýœ‘@" Process 61D0FA~1.EXE created mutex with name "\Sessions\1\BaseNamedObjects\Global\CLR_PerfMon_WrapMutex" Process 61D0FA~1.EXE created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process 61D0FA~1.EXE created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex"49:T1bbf,"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "61D0FA~1.EXE" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "61D0FA~1.EXE" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "61D0FA~1.EXE" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "61D0FA~1.EXE" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "61D0FA~1.EXE" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "61D0FA~1.EXE" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "61D0FA~1.EXE" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "61D0FA~1.EXE" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "61D0FA~1.EXE" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135]4a:T3942,"Y\MACHINE\SOFTWARE\Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}\InprocHandler" in Source: 00000000-00000468.00000000.87465.0027E000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00000468.00000000.87465.00400000.00000040.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00000468.00000001.87861.00400000.00000040.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00000940.00000000.88155.00409000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00000940.00000001.88759.00401000.00000020.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00000940.00000001.88759.00409000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00001372.00000000.78600.00409000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00001416.00000000.79896.00409000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00001416.00000001.80093.00409000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002332.00000001.88751.00280000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002332.00000001.88751.01C60000.00000004.mdmp "$script:SystemEnvironmentKey = 'HKLM:\System\CurrentControlSet\Control\Session Manager\Environment'" in Source: 00000000-00002332.00000001.88751.02D60000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002332.00000002.89745.00280000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002332.00000002.89745.01C60000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002332.00000002.89745.01C60000.00000004.mdmp "$script:SystemEnvironmentKey = 'HKLM:\System\CurrentControlSet\Control\Session Manager\Environment'" in Source: 00000000-00002332.00000002.89745.02D60000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002580.00000001.81697.00410000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002580.00000001.81697.00410000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002580.00000001.81697.00410000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00002580.00000001.81697.02C70000.00000004.mdmp "KEY_CURRENT_USER\Software\RimArts\B2\Settings" in Source: 00000000-00002580.00000001.81697.02C70000.00000004.mdmp "KEY_CURRENT_USER\Software\Aerofox\FoxmailPreview" in Source: 00000000-00002580.00000001.81697.02C70000.00000004.mdmp "KEY_CURRENT_USER\Software\Aerofox\Foxmail\V3.1" in Source: 00000000-00002580.00000001.81697.02C70000.00000004.mdmp "raveSoftware\Brave-Browser\User Data" in Source: 00000000-00002580.00000001.81697.02C70000.00000004.mdmp "pera Software\Opera Stable" in Source: 00000000-00002580.00000001.81697.02C70000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00002768.00000000.79048.00409000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002916.00000001.84169.004F0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002916.00000001.84169.004F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002916.00000001.84169.004F0000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00002916.00000001.84169.02B40000.00000004.mdmp "KEY_CURRENT_USER\Software\RimArts\B2\Settings" in Source: 00000000-00002916.00000001.84169.02B40000.00000004.mdmp "KEY_CURRENT_USER\Software\Aerofox\FoxmailPreview" in Source: 00000000-00002916.00000001.84169.02B40000.00000004.mdmp "KEY_CURRENT_USER\Software\Aerofox\Foxmail\V3.1" in Source: 00000000-00002916.00000001.84169.02B40000.00000004.mdmp "raveSoftware\Brave-Browser\User Data" in Source: 00000000-00002916.00000001.84169.02B40000.00000004.mdmp "pera Software\Opera Stable" in Source: 00000000-00002916.00000001.84169.02B40000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00002952.00000000.82517.00409000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00002952.00000001.82780.00409000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00002996.00000000.81537.00409000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003064.00000001.90201.00610000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003064.00000001.90201.00610000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003064.00000001.90201.00610000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003064.00000001.90201.00610000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00003280.00000000.78443.00409000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00003280.00000001.80367.00409000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00003280.00000002.82291.00409000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00003280.00000003.86440.00409000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00003440.00000000.90322.00409000.00000004.mdmp "^HKCU\Software" in Source: 00000000-00003556.00000000.77096.0011F000.00000004.mdmp "HKCU\Software\Policies" in Source: 00000000-00003556.00000000.77096.0011F000.00000004.mdmp "HKLM\Software" in Source: 00000000-00003556.00000000.77096.0011F000.00000004.mdmp "HKLM\Software\Policies" in Source: 00000000-00003556.00000000.77096.0011F000.00000004.mdmp ".Software\Microsoft\PCHealth\ErrorReporting\DW\Debug" in Source: 00000000-00003556.00000000.77096.0011F000.00000004.mdmp "Software\Microsoft\Office\14.0" in Source: 00000000-00003556.00000000.77096.0011F000.00000004.mdmp "Software\Policies\Microsoft\Office\14.0" in Source: 00000000-00003556.00000000.77096.0011F000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003556.00000000.77096.00220000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00003556.00000000.77096.00409000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003556.00000001.79018.00220000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00003556.00000001.79018.00409000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003556.00000002.80940.00220000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00003556.00000002.80940.00409000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003556.00000003.86440.00220000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00003556.00000003.86440.00409000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003560.00000001.88687.00320000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003560.00000001.88687.00320000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003560.00000002.90611.00320000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003560.00000002.90611.00320000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003560.00000002.90611.01DD0000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00003960.00000000.89905.00409000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00004008.00000000.81283.00409000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004028.00000001.79118.00400000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004028.00000001.79118.00400000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004028.00000001.79118.00400000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00004028.00000001.79118.02D30000.00000004.mdmp "KEY_CURRENT_USER\Software\RimArts\B2\Settings" in Source: 00000000-00004028.00000001.79118.02D30000.00000004.mdmp "KEY_CURRENT_USER\Software\Aerofox\FoxmailPreview" in Source: 00000000-00004028.00000001.79118.02D30000.00000004.mdmp "KEY_CURRENT_USER\Software\Aerofox\Foxmail\V3.1" in Source: 00000000-00004028.00000001.79118.02D30000.00000004.mdmp "raveSoftware\Brave-Browser\User Data" in Source: 00000000-00004028.00000001.79118.02D30000.00000004.mdmp "pera Software\Opera Stable" in Source: 00000000-00004028.00000001.79118.02D30000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004068.00000000.90323.00081000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004068.00000000.90323.00081000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004068.00000000.90323.00081000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004068.00000000.90323.00081000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004068.00000000.90323.00081000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004068.00000000.90323.00081000.00000020.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00004112.00000000.90111.00409000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00004296.00000000.79411.00400000.00000040.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00004296.00000001.79597.00400000.00000040.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00004420.00000000.90806.00409000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00004484.00000000.81162.00409000.00000004.mdmp "Y\MACHINE\SOFTWARE\Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}\InprocHandler" in Source: 00000000-00004604.00000000.81976.001DE000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00004604.00000000.81976.00400000.00000040.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00004604.00000001.82212.00400000.00000040.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00004604.00000001.82212.00560000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004604.00000001.82212.00560000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005004.00000000.84057.00409000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005052.00000000.83689.00409000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005088.00000000.83829.00409000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005300.00000000.84449.00400000.00000040.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005300.00000001.84746.002A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005300.00000001.84746.002A0000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005300.00000001.84746.00400000.00000040.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005424.00000000.85048.00409000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005424.00000001.85505.00409000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005568.00000001.87057.00420000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005568.00000001.87057.00420000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005568.00000001.87057.00420000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005568.00000001.87057.00420000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005568.00000001.87057.02B90000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005568.00000002.87218.00420000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005568.00000002.87218.00420000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005568.00000002.87218.00420000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005568.00000002.87218.02B90000.00000004.mdmp "KEY_CURRENT_USER\Software\RimArts\B2\Settings" in Source: 00000000-00005568.00000002.87218.02B90000.00000004.mdmp "KEY_CURRENT_USER\Software\Aerofox\FoxmailPreview" in Source: 00000000-00005568.00000002.87218.02B90000.00000004.mdmp "KEY_CURRENT_USER\Software\Aerofox\Foxmail\V3.1" in Source: 00000000-00005568.00000002.87218.02B90000.00000004.mdmp "raveSoftware\Brave-Browser\User Data" in Source: 00000000-00005568.00000002.87218.02B90000.00000004.mdmp "pera Software\Opera Stable" in Source: 00000000-00005568.00000002.87218.02B90000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005868.00000000.86686.00409000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005976.00000000.87012.00409000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00006120.00000000.86800.00409000.00000004.mdmp4b:T4e09,"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ec0000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "ADVAPI32.DLL" at base 76620000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "PROPSYS.DLL" at base 73fb0000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "OLE32.DLL" at base 76e60000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "COMCTL32.DLL" at base 742b0000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "OLEAUT32.DLL" at base 76bf0000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "SHELL32.DLL" at base 759d0000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "CLBCATQ.DLL" at base 76b60000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73fb0000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "NTMARTA.DLL" at base 74850000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76fc0000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "PROFAPI.DLL" at base 753f0000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "APPHELP.DLL" at base 75290000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6f990000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 759d0000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76d20000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "SETUPAPI.DLL" at base 77100000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75630000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "RPCRT4.DLL" at base 77680000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 75750000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "SECUR32.DLL" at base 75110000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75470000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 70a30000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75290000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "VERSION.DLL" at base 74880000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70d30000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "KERNEL32" at base 76d20000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 64480000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "USER32.DLL" at base 77030000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "MSCOREE.DLL" at base 6bad0000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "PSAPI.DLL" at base 76d10000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "KERNEL32.DLL" at base 76d20000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63070000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "CRYPTBASE.DLL" at base 752e0000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 73d10000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6b080000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62610000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 695c0000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 617a0000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "UXTHEME.DLL" at base 73ec0000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 60f80000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6af70000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 60800000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 73410000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "NTDLL.DLL" at base 774e0000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "BCRYPT.DLL" at base 74f00000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "CRYPTSP.DLL" at base 74df0000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74b80000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "IMM32.DLL" at base 75950000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "COMCTL32.DLL" at base 71c40000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "GDI32.DLL" at base 767b0000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "GDIPLUS.DLL" at base 73d20000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 73d20000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 76fc0000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "RPCRTREMOTE.DLL" at base 75380000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "URLMON.DLL" at base 75750000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "WINDOWSCODECS.DLL" at base 73800000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 69150000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "NTDLL" at base 774e0000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 69ae0000 "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" loaded module "SSPICLI.DLL" at base 75270000 "svchost.com" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75290000 "svchost.com" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ec0000 "svchost.com" loaded module "KERNEL32.DLL" at base 76d20000 "powershell.exe" loaded module "CRYPTBASE.DLL" at base 752e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ec0000 "powershell.exe" loaded module "CLBCATQ.DLL" at base 76b60000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 759d0000 "powershell.exe" loaded module "OLE32.DLL" at base 76e60000 "powershell.exe" loaded module "USERENV.DLL" at base 75610000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76fc0000 "powershell.exe" loaded module "COMCTL32.DLL" at base 742b0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 76620000 "powershell.exe" loaded module "KERNEL32.DLL" at base 76d20000 "powershell.exe" loaded module "SHELL32.DLL" at base 759d0000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 76bf0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73fb0000 "powershell.exe" loaded module "NTMARTA.DLL" at base 74850000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76d20000 "powershell.exe" loaded module "SETUPAPI.DLL" at base 77100000 "powershell.exe" loaded module "RPCRT4.DLL" at base 77680000 "powershell.exe" loaded module "APPHELP.DLL" at base 75290000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6f990000 "powershell.exe" loaded module "PROPSYS.DLL" at base 73fb0000 "powershell.exe" loaded module "LINKINFO.DLL" at base 6e400000 "powershell.exe" loaded module "PROFAPI.DLL" at base 753f0000 "powershell.exe" loaded module "USER32.DLL" at base 77030000 "powershell.exe" loaded module "NTSHRUI.DLL" at base 72170000 "powershell.exe" loaded module "SRVCLI.DLL" at base 74fe0000 "powershell.exe" loaded module "CSCAPI.DLL" at base 708d0000 "powershell.exe" loaded module "SLC.DLL" at base 73790000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 76e00000 "powershell.exe" loaded module "CRYPTSP.DLL" at base 74df0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74b80000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70d30000 "powershell.exe" loaded module "KERNEL32" at base 76d20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6ba40000 "powershell.exe" loaded module "VERSION.DLL" at base 74880000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 64480000 "powershell.exe" loaded module "MSCOREE.DLL" at base 6bad0000 "powershell.exe" loaded module "PSAPI.DLL" at base 76d10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 6bad0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63070000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62610000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 60f80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.PB378EC07#\D254C63BEDCB76C81C3125BD527B7D1A\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 69810000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAA57FC8CC#\73A1A80AED03E789A49CEC899B7505DD\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 5ed10000 "powershell.exe" loaded module "NTDLL.DLL" at base 774e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 73410000 "powershell.exe" loaded module "WINTRUST.DLL" at base 756f0000 "powershell.exe" loaded module "MSISIP.DLL" at base 73d00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 75490000 "powershell.exe" loaded module "IMM32.DLL" at base 75950000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 731c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 731b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DATA\DF2DD09ED7C341842A104E1E668F184E\SYSTEM.DATA.NI.DLL" at base 5e4f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 5e190000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 60800000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 69020000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DIRED13B18A9#\2E76676FBD265F70BE92C82BBF76B8E5\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 67c80000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 73d10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6b080000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.P6F792626#\05765F777020DEEDDC8AD54B48343B9C\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 6b540000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\F0821980BFE2FC8375CCFC37DBE6E9D8\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 6aef0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.NUMERICS\E7D6ED984300C7212C6E682C4F730B1E\SYSTEM.NUMERICS.NI.DLL" at base 6b990000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 69500000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 697c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6af70000 "powershell.exe" loaded module "SECUR32.DLL" at base 75110000 "powershell.exe" loaded module "SSPICLI.DLL" at base 75270000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.CSHARP\F73F48AFB5512225DEDAEE9C88AC5050\MICROSOFT.CSHARP.NI.DLL" at base 5de70000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 76fc0000 "powershell.exe" loaded module "RPCRTREMOTE.DLL" at base 75380000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.M870D558A#\7CEB6B903321C16B12386A8DF1BE50F9\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 5dde0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.PAE3498D9#\8DCF1DAED985F481EED5CCA9D2945C18\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 5dc00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFE64A9051#\1561B93D6D25C4A9C3E2659AB29A5E73\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 6b640000 "powershell.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75630000 "powershell.exe" loaded module "URLMON.DLL" at base 75750000 "powershell.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75470000 "powershell.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 70a30000 "powershell.exe" loaded module "NCRYPT.DLL" at base 74f20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74ac0000 "powershell.exe" loaded module "GPAPI.DLL" at base 749c0000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 76fc0000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 76fc0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 71500000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 71500000 "powershell.exe" loaded module "SENSAPI.DLL" at base 6c360000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 76fc0000 "powershell.exe" loaded module "CRYPT32.DLL" at base 75490000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 69230000 "powershell.exe" loaded module "GDI32.DLL" at base 767b0000 "powershell.exe" loaded module "BCRYPT.DLL" at base 74f00000 "powershell.exe" loaded module "NETUTILS.DLL" at base 73f40000 "powershell.exe" loaded module "SENSAPI.DLL" at base 72000000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 69660000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ec0000 "schtasks.exe" loaded module "RPCRT4.DLL" at base 77680000 "schtasks.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 76fc0000 "schtasks.exe" loaded module "ADVAPI32.DLL" at base 76620000 "schtasks.exe" loaded module "CLBCATQ.DLL" at base 76b60000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base 739f0000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 75270000 "61D0FA~1.EXE" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70d30000 "61D0FA~1.EXE" loaded module "KERNEL32" at base 76d20000 "61D0FA~1.EXE" loaded module "ADVAPI32.DLL" at base 76620000 "61D0FA~1.EXE" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6ba40000 "61D0FA~1.EXE" loaded module "SHLWAPI.DLL" at base 76e00000 "61D0FA~1.EXE" loaded module "VERSION.DLL" at base 74880000 "61D0FA~1.EXE" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 63cd0000 "61D0FA~1.EXE" loaded module "USER32.DLL" at base 77030000 "61D0FA~1.EXE" loaded module "PSAPI.DLL" at base 76d10000 "61D0FA~1.EXE" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 628c0000 "61D0FA~1.EXE" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 76fc0000 "61D0FA~1.EXE" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75630000 "61D0FA~1.EXE" loaded module "URLMON.DLL" at base 75750000 "61D0FA~1.EXE" loaded module "SHELL32.DLL" at base 759d0000 "61D0FA~1.EXE" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 70a30000 "61D0FA~1.EXE" loaded module "OLEAUT32.DLL" at base 76bf0000 "61D0FA~1.EXE" loaded module "NTDLL" at base 774e0000 "61D0FA~1.EXE" loaded module "APPHELP.DLL" at base 75290000 "61D0FA~1.EXE" loaded module "CLBCATQ.DLL" at base 76b60000 "61D0FA~1.EXE" loaded module "KERNEL32.DLL" at base 76d20000 "61D0FA~1.EXE" loaded module "COMCTL32.DLL" at base 742b0000 "61D0FA~1.EXE" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 69ae0000 "61D0FA~1.EXE" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76d20000 "61D0FA~1.EXE" loaded module "SETUPAPI.DLL" at base 77100000 "61D0FA~1.EXE" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 75750000 "61D0FA~1.EXE" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 752900004c:T926,"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e" was detected as "Borland Delphi" and name: "Compiler" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e" was detected as "Turbo Linker" and name: "Linker" "setup.exe" was detected as "Borland Delphi" and name: "Compiler" "setup.exe" was detected as "Turbo Linker" and name: "Linker" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" was detected as "Borland Delphi" and name: "Compiler" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" was detected as "Turbo Linker" and name: "Linker" "dwtrig20.exe" was detected as "Borland Delphi" and name: "Compiler" "dwtrig20.exe" was detected as "Turbo Linker" and name: "Linker" "python.exe" was detected as "Borland Delphi" and name: "Compiler" "python.exe" was detected as "Turbo Linker" and name: "Linker" "pythonw.exe" was detected as "Borland Delphi" and name: "Compiler" "pythonw.exe" was detected as "Turbo Linker" and name: "Linker" "KMSSS.exe" was detected as "Borland Delphi" and name: "Compiler" "KMSSS.exe" was detected as "Turbo Linker" and name: "Linker" "OneDrive.exe" was detected as "Borland Delphi" and name: "Compiler" "OneDrive.exe" was detected as "Turbo Linker" and name: "Linker" "javaws.exe" was detected as "Borland Delphi" and name: "Compiler" "javaws.exe" was detected as "Turbo Linker" and name: "Linker" "javaw.exe" was detected as "Borland Delphi" and name: "Compiler" "javaw.exe" was detected as "Turbo Linker" and name: "Linker" "java.exe" was detected as "Borland Delphi" and name: "Compiler" "java.exe" was detected as "Turbo Linker" and name: "Linker" "ose.exe" was detected as "Borland Delphi" and name: "Compiler" "ose.exe" was detected as "Turbo Linker" and name: "Linker" "gui-64.exe" was detected as "Borland Delphi" and name: "Compiler" "gui-64.exe" was detected as "Turbo Linker" and name: "Linker" "t64.exe" was detected as "Borland Delphi" and name: "Compiler" "t64.exe" was detected as "Turbo Linker" and name: "Linker" "w64.exe" was detected as "Borland Delphi" and name: "Compiler" "w64.exe" was detected as "Turbo Linker" and name: "Linker" "t32.exe" was detected as "Borland Delphi" and name: "Compiler" "t32.exe" was detected as "Turbo Linker" and name: "Linker"4d:T1737,file/memory contains long string with (Indicator: "Install-Script"; File: "WI5DE4~1.EXE") file/memory contains long string with (Indicator: "Install-Script"; File: "WININS~2.EXE") file/memory contains long string with (Indicator: "Install-Script"; File: "WI02EA~1.EXE") file/memory contains long string with (Indicator: "Install-Script"; File: "WININS~1.EXE") file/memory contains long string with (Indicator: "Install-Script"; File: "WI5ED8~1.EXE") file/memory contains long string with (Indicator: "Install-Script"; File: "WI2335~1.EXE") file/memory contains long string with (Indicator: "Install-Script"; File: "WIC467~1.EXE") file/memory contains long string with (Indicator: "powershell_ise.exe"; File: "JFVOR0YMUG8LZDC47TZY.temp") file/memory contains long string with (Indicator: "powershell_ise.exe"; File: "D2Q972V9L0DME0SRKDHU.temp") Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00002332.00000001.88751.00280000.00000004.mdmp, 00000000-00003560.00000001.88687.00320000.00000004.mdmp, 00000000-00003560.00000002.90611.00320000.00000004.mdmp, 00000000-00004068.00000000.90323.00200000.00000004.mdmp") Found string "$pathsToProcess += Resolve-Path -LiteralPath $LiteralPath | Foreach-Object ProviderPath" (Indicator: "Resolve-Path"; Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00002332.00000002.89745.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp") Found string "$pathsToProcess += Resolve-Path $Path | Foreach-Object ProviderPath" (Indicator: "Resolve-Path"; Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp, 00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found string "if(Test-Path -LiteralPath $filePath -PathType Container)" (Indicator: "Test-Path"; Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00002332.00000002.89745.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp, 00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ReadError -ErrorId "FileReadError" -TargetObject $FilePath" (Indicator: "Write-Error"; Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00002332.00000002.89745.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp, 00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found string "Write-Error -ErrorRecord $errorRecord" (Indicator: "Write-Error"; Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00002332.00000002.89745.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp, 00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found string "Write-Output -InputObject $byteCollectionObject" (Indicator: "Write-Output"; Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00002332.00000002.89745.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp, 00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found string "$resolvedPaths = Resolve-Path -LiteralPath $filePath" (Indicator: "Resolve-Path"; Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00002332.00000002.89745.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp") Found string "$resolvedPaths = Resolve-Path -Path $filePath" (Indicator: "Resolve-Path"; Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00002332.00000002.89745.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp, 00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ([System.Management.Automation.ErrorCategory]::InvalidData) -ErrorId "FormatHexResolvePathError"" (Indicator: "Write-Error"; Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp, 00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ([System.Management.Automation.ErrorCategory]::ParserError) -ErrorId "FormatHexFailureTypeNotSupported"" (Indicator: "Write-Error"; Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00002332.00000002.89745.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp, 00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found string "foreach($resolvedPath in (Resolve-Path @PSBoundParameters))" (Indicator: "Resolve-Path"; Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00002332.00000002.89745.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp, 00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found string "$pathsToProcess += Resolve-Path $Path | Foreach-Object Provi" (Indicator: "Resolve-Path"; Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00002332.00000002.89745.01680000.00000004.mdmp") Found string "$script:ProgramFilesPSPath = Microsoft.PowerShell.Management\Join-Path -Path $env:ProgramFiles -ChildPath "WindowsPowerShell"" (Indicator: "Join-Path"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Management\Join-Path -Path $script:MyDocumentsFolderPath -ChildPath "WindowsPowerShell"" (Indicator: "Join-Path"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Management\Join-Path -Path $env:USERPROFILE -ChildPath "Documents\WindowsPowerShell"" (Indicator: "Join-Path"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp")4e:T197c,"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "powershell.exe" touched "Custom Destination List" (Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}") "powershell.exe" touched "Start Menu Cache" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}") "powershell.exe" touched "Start Menu Pin" (Path: "HKCU\CLSID\{A2A9545D-A0C2-42B4-9708-A0B2BADD77C8}\TREATAS") "powershell.exe" touched "Taskband Pin" (Path: "HKCU\CLSID\{90AA3A4E-1CBA-4233-B8BB-535773D48449}\TREATAS") "powershell.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "Internet Shortcut" (Path: "HKCU\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "User Pinned" (Path: "HKCU\CLSID\{1F3427C8-5C10-4210-AA03-2EE45287D668}\SHELLFOLDER") "powershell.exe" touched "User Assist" (Path: "HKCU\CLSID\{DD313E04-FEFF-11D1-8ECD-0000F87A470C}\TREATAS") "powershell.exe" touched "Shared Task Scheduler" (Path: "HKCU\CLSID\{603D3801-BD81-11D0-A3A5-00C04FD706EC}\TREATAS") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32")4f:T511,"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e" has an writable section named "DATA" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e" has an writable section named "BSS" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e" has an writable section named ".idata" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e" has an writable section named ".tls" "setup.exe" has an writable section named "DATA" "setup.exe" has an writable section named "BSS" "setup.exe" has an writable section named ".idata" "setup.exe" has an writable section named ".tls" "dwtrig20.exe" has an writable section named "DATA" "dwtrig20.exe" has an writable section named "BSS" "dwtrig20.exe" has an writable section named ".idata" "dwtrig20.exe" has an writable section named ".tls" "python.exe" has an writable section named "DATA" "python.exe" has an writable section named "BSS" "python.exe" has an writable section named ".idata" "python.exe" has an writable section named ".tls" "pythonw.exe" has an writable section named "DATA" "pythonw.exe" has an writable section named "BSS" "pythonw.exe" has an writable section named ".idata" "pythonw.exe" has an writable section named ".tls" "KMSSS.exe" has an writable section named "DATA"50:T2282,"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x20,xor eax, eax,mov dword ptr [ebp - 0x20], eax,mov dword ptr [ebp - 0x18], eax,mov dword ptr [ebp - 0x1c], eax,mov dword ptr [ebp - 0x14], eax,mov eax, 0x4080e8,call 0x403f14,xor eax, eax,push ebp,push 0x4082b4,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,mov eax, 0x4091a8,mov ecx, 0xb,mov edx, 0xb,call 0x4070d0,mov eax, 0x4091b4,mov ecx, 9,mov edx, 9,call 0x4070d0,mov eax, 0x4091c0,mov ecx, 3,mov edx, 3," "setup.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x20,xor eax, eax,mov dword ptr [ebp - 0x20], eax,mov dword ptr [ebp - 0x18], eax,mov dword ptr [ebp - 0x1c], eax,mov dword ptr [ebp - 0x14], eax,mov eax, 0x4080e8,call 0x403f14,xor eax, eax,push ebp,push 0x4082b4,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,mov eax, 0x4091a8,mov ecx, 0xb,mov edx, 0xb,call 0x4070d0,mov eax, 0x4091b4,mov ecx, 9,mov edx, 9,call 0x4070d0,mov eax, 0x4091c0,mov ecx, 3,mov edx, 3," "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "dwtrig20.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x20,xor eax, eax,mov dword ptr [ebp - 0x20], eax,mov dword ptr [ebp - 0x18], eax,mov dword ptr [ebp - 0x1c], eax,mov dword ptr [ebp - 0x14], eax,mov eax, 0x4080e8,call 0x403f14,xor eax, eax,push ebp,push 0x4082b4,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,mov eax, 0x4091a8,mov ecx, 0xb,mov edx, 0xb,call 0x4070d0,mov eax, 0x4091b4,mov ecx, 9,mov edx, 9,call 0x4070d0,mov eax, 0x4091c0,mov ecx, 3,mov edx, 3," "python.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x20,xor eax, eax,mov dword ptr [ebp - 0x20], eax,mov dword ptr [ebp - 0x18], eax,mov dword ptr [ebp - 0x1c], eax,mov dword ptr [ebp - 0x14], eax,mov eax, 0x4080e8,call 0x403f14,xor eax, eax,push ebp,push 0x4082b4,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,mov eax, 0x4091a8,mov ecx, 0xb,mov edx, 0xb,call 0x4070d0,mov eax, 0x4091b4,mov ecx, 9,mov edx, 9,call 0x4070d0,mov eax, 0x4091c0,mov ecx, 3,mov edx, 3," "pythonw.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x20,xor eax, eax,mov dword ptr [ebp - 0x20], eax,mov dword ptr [ebp - 0x18], eax,mov dword ptr [ebp - 0x1c], eax,mov dword ptr [ebp - 0x14], eax,mov eax, 0x4080e8,call 0x403f14,xor eax, eax,push ebp,push 0x4082b4,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,mov eax, 0x4091a8,mov ecx, 0xb,mov edx, 0xb,call 0x4070d0,mov eax, 0x4091b4,mov ecx, 9,mov edx, 9,call 0x4070d0,mov eax, 0x4091c0,mov ecx, 3,mov edx, 3," "KMSSS.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x20,xor eax, eax,mov dword ptr [ebp - 0x20], eax,mov dword ptr [ebp - 0x18], eax,mov dword ptr [ebp - 0x1c], eax,mov dword ptr [ebp - 0x14], eax,mov eax, 0x4080e8,call 0x403f14,xor eax, eax,push ebp,push 0x4082b4,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,mov eax, 0x4091a8,mov ecx, 0xb,mov edx, 0xb,call 0x4070d0,mov eax, 0x4091b4,mov ecx, 9,mov edx, 9,call 0x4070d0,mov eax, 0x4091c0,mov ecx, 3,mov edx, 3," "OneDrive.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x20,xor eax, eax,mov dword ptr [ebp - 0x20], eax,mov dword ptr [ebp - 0x18], eax,mov dword ptr [ebp - 0x1c], eax,mov dword ptr [ebp - 0x14], eax,mov eax, 0x4080e8,call 0x403f14,xor eax, eax,push ebp,push 0x4082b4,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,mov eax, 0x4091a8,mov ecx, 0xb,mov edx, 0xb,call 0x4070d0,mov eax, 0x4091b4,mov ecx, 9,mov edx, 9,call 0x4070d0,mov eax, 0x4091c0,mov ecx, 3,mov edx, 3," "javaws.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x20,xor eax, eax,mov dword ptr [ebp - 0x20], eax,mov dword ptr [ebp - 0x18], eax,mov dword ptr [ebp - 0x1c], eax,mov dword ptr [ebp - 0x14], eax,mov eax, 0x4080e8,call 0x403f14,xor eax, eax,push ebp,push 0x4082b4,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,mov eax, 0x4091a8,mov ecx, 0xb,mov edx, 0xb,call 0x4070d0,mov eax, 0x4091b4,mov ecx, 9,mov edx, 9,call 0x4070d0,mov eax, 0x4091c0,mov ecx, 3,mov edx, 3," "javaw.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x20,xor eax, eax,mov dword ptr [ebp - 0x20], eax,mov dword ptr [ebp - 0x18], eax,mov dword ptr [ebp - 0x1c], eax,mov dword ptr [ebp - 0x14], eax,mov eax, 0x4080e8,call 0x403f14,xor eax, eax,push ebp,push 0x4082b4,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,mov eax, 0x4091a8,mov ecx, 0xb,mov edx, 0xb,call 0x4070d0,mov eax, 0x4091b4,mov ecx, 9,mov edx, 9,call 0x4070d0,mov eax, 0x4091c0,mov ecx, 3,mov edx, 3," "java.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x20,xor eax, eax,mov dword ptr [ebp - 0x20], eax,mov dword ptr [ebp - 0x18], eax,mov dword ptr [ebp - 0x1c], eax,mov dword ptr [ebp - 0x14], eax,mov eax, 0x4080e8,call 0x403f14,xor eax, eax,push ebp,push 0x4082b4,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,mov eax, 0x4091a8,mov ecx, 0xb,mov edx, 0xb,call 0x4070d0,mov eax, 0x4091b4,mov ecx, 9,mov edx, 9,call 0x4070d0,mov eax, 0x4091c0,mov ecx, 3,mov edx, 3," "ose.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x20,xor eax, eax,mov dword ptr [ebp - 0x20], eax,mov dword ptr [ebp - 0x18], eax,mov dword ptr [ebp - 0x1c], eax,mov dword ptr [ebp - 0x14], eax,mov eax, 0x4080e8,call 0x403f14,xor eax, eax,push ebp,push 0x4082b4,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,mov eax, 0x4091a8,mov ecx, 0xb,mov edx, 0xb,call 0x4070d0,mov eax, 0x4091b4,mov ecx, 9,mov edx, 9,call 0x4070d0,mov eax, 0x4091c0,mov ecx, 3,mov edx, 3," "gui-64.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x20,xor eax, eax,mov dword ptr [ebp - 0x20], eax,mov dword ptr [ebp - 0x18], eax,mov dword ptr [ebp - 0x1c], eax,mov dword ptr [ebp - 0x14], eax,mov eax, 0x4080e8,call 0x403f14,xor eax, eax,push ebp,push 0x4082b4,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,mov eax, 0x4091a8,mov ecx, 0xb,mov edx, 0xb,call 0x4070d0,mov eax, 0x4091b4,mov ecx, 9,mov edx, 9,call 0x4070d0,mov eax, 0x4091c0,mov ecx, 3,mov edx, 3," "t64.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x20,xor eax, eax,mov dword ptr [ebp - 0x20], eax,mov dword ptr [ebp - 0x18], eax,mov dword ptr [ebp - 0x1c], eax,mov dword ptr [ebp - 0x14], eax,mov eax, 0x4080e8,call 0x403f14,xor eax, eax,push ebp,push 0x4082b4,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,mov eax, 0x4091a8,mov ecx, 0xb,mov edx, 0xb,call 0x4070d0,mov eax, 0x4091b4,mov ecx, 9,mov edx, 9,call 0x4070d0,mov eax, 0x4091c0,mov ecx, 3,mov edx, 3," "w64.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x20,xor eax, eax,mov dword ptr [ebp - 0x20], eax,mov dword ptr [ebp - 0x18], eax,mov dword ptr [ebp - 0x1c], eax,mov dword ptr [ebp - 0x14], eax,mov eax, 0x4080e8,call 0x403f14,xor eax, eax,push ebp,push 0x4082b4,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,mov eax, 0x4091a8,mov ecx, 0xb,mov edx, 0xb,call 0x4070d0,mov eax, 0x4091b4,mov ecx, 9,mov edx, 9,call 0x4070d0,mov eax, 0x4091c0,mov ecx, 3,mov edx, 3," "t32.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x20,xor eax, eax,mov dword ptr [ebp - 0x20], eax,mov dword ptr [ebp - 0x18], eax,mov dword ptr [ebp - 0x1c], eax,mov dword ptr [ebp - 0x14], eax,mov eax, 0x4080e8,call 0x403f14,xor eax, eax,push ebp,push 0x4082b4,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,mov eax, 0x4091a8,mov ecx, 0xb,mov edx, 0xb,call 0x4070d0,mov eax, 0x4091b4,mov ecx, 9,mov edx, 9,call 0x4070d0,mov eax, 0x4091c0,mov ecx, 3,mov edx, 3,"51:Td66,Observed system executable string:"C:\Windows\System32\WINDOW~1\v1.0\powershell.exe" [Source: screen_1.png] Observed system executable string:"/C:\ PROGRA~2Vyd* MICROS~1VQt* WindowsSTARTM~1ProgramsXZn*ACCESS~1WINDOW~1WINDOW~1.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPShapubws-pcNP!8NP!8/C:\Windows]zn*System32WINDOW~1v1.0IXk powershell_ise.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exe1SPS1SPShapubws-pcNP!8NP!8/C:\Windows]zn*System32WINDOW~1v1.0IXk powershell_ise.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exe1SPS1SPShapubws-pcNP!8NP!8" [Source: JFVOR0YMUG8LZDC47TZY.temp] Observed system executable string:"/C:\ PROGRA~2Vyd* MICROS~1VQt* WindowsSTARTM~1ProgramsXZn*ACCESS~1WINDOW~1WINDOW~1.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPShapubws-pcNP!8NP!8/C:\Windows]zn*System32]Pl*WINDOW~1v1.0IXk powershell_ise.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exe1SPS1SPShapubws-pcNP!8NP!8/C:\Windows]zn*System32]Pl*WINDOW~1v1.0IXk powershell_ise.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exe1SPS1SPShapubws-pcNP!8NP!8" [Source: D2Q972V9L0DME0SRKDHU.temp] Observed system executable string:"C:\Users\HAPUBWS\AppData\Roaming\eiVfWxqyEFoV.exeC:\Users\HAPUBWS\AppData\Roaming\EIVFWX~1.EXEC:\Windows\System32\WINDOW~1\v1.0\powershell.exe5dff7c9676e.exe" [Source: directx.sys] Observed system executable string:""%WINDIR%\svchost.com" "%WINDIR%\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "%USERPROFILE%\AppD" [Source: 00000000-00004028-00000C47-41907881026], Observed system executable string:""%WINDIR%\svchost.com" "%WINDIR%\System32\schtasks.exe" /Create /TN "Updates\eiVfWxqyEFoV" /XML "%USERPROFILE%\AppData\Loca" [Source: 00000000-00004028-00000C47-64528132016] Observed system executable string:"%WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe" [Source: 00000000-00004148-00000C2E-4700562866] Observed system executable string:"%WINDIR%\System32\WINDOW~1\v1.0\powershell.exe Add-MpPreference -ExclusionPath %APPDATA%\eiVfWxqyEFoV.exe" [Source: 00000000-00001372-00000C46-1808442920] Observed system executable string:""%WINDIR%\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "%TEMP%\3582-490\61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe"" [Source: svchost.com] Observed system executable string:""%WINDIR%\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "%APPDATA%\eiVfWxqyEFoV.exe"" [Source: svchost.com] Observed system executable string:""%WINDIR%\System32\schtasks.exe" /Create /TN "Updates\eiVfWxqyEFoV" /XML "%TEMP%\tmpA312.tmp"" [Source: svchost.com] Observed system executable string:""%WINDIR%\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "%TEMP%\3582-490\61D0FA~1.EXE"" [Source: svchost.com]52:T898,"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR-SA") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR-SA") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG-BG") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG-BG") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA-ES") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA-ES") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HANS") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HANS")53:T401,Found string ":\Windows\system32\WLDAP32.dll" (Source: "00000000-00000468.00000000.87465.00500000.00000004.mdmp, 00000000-00000468.00000001.87861.00500000.00000004.mdmp, 00000000-00002332.00000000.86829.00280000.00000004.mdmp, 00000000-00002332.00000001.88751.00280000.00000004.mdmp, 00000000-00002332.00000002.89745.00280000.00000004.mdmp, 00000000-00002916.00000001.84169.004F0000.00000004.mdmp, 00000000-00003064.00000001.90201.00610000.00000004.mdmp, 00000000-00003560.00000000.86765.00320000.00000004.mdmp, 00000000-00003560.00000001.88687.00320000.00000004.mdmp, 00000000-00003560.00000002.90611.00320000.00000004.mdmp, 00000000-00004068.00000000.90323.00200000.00000004.mdmp, 00000000-00004604.00000000.81976.00560000.00000004.mdmp, 00000000-00004604.00000001.82212.00560000.00000004.mdmp, 00000000-00005300.00000000.84449.002A0000.00000004.mdmp, 00000000-00005300.00000001.84746.002A0000.00000004.mdmp, 00000000-00005568.00000001.87057.00420000.00000004.mdmp, 00000000-00005568.00000002.87218.00420000.00000004.mdmp")54:T104e,Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00003556-00000C2B-209326591] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00004028-00000C2B-212796832] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00004028-00000C2B-214041270] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004028-00000C2B-214196370] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00004028-00000C2B-214481381] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00004028-00000C2B-214559184] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00004028-00000C2B-215134448] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00004028-00000C2B-215229672] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00004028-00000C2B-215313400] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00004028-00000C2B-215617157] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00004028-00000C2B-215946188] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00004028-00000C2B-216626692] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00004028-00000C2B-216698749] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00004028-00000C2B-217030852] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00004028-00000C2B-217105522] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00004028-00000C2B-217677464] Observed system executable string:"%WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" [Source: 00000000-00004028-00000C2B-219164225] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00004028-00000C2B-220073857] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00004028-00000C2B-220157030] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00004028-00000C2B-220243010] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00004028-00000C2B-220352900] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" [Source: 00000000-00004028-00000C2B-221144597] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll" [Source: 00000000-00004028-00000C2B-223295033] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00004028-00000C2B-225602583] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00004028-00000C2B-225783856]55:T569,Spawned process "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (UID: 00000000-00004028) Spawned process "svchost.com" with commandline ""%WINDIR%\\System32\\WINDOW~1\\v1.0\\powershell.exe" Add-MpPrefe ..." (UID: 00000000-00003280) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath %TEMP%\\3582-490\\61d0fa3933d062 ..." (UID: 00000000-00004148) Spawned process "svchost.com" with commandline ""%WINDIR%\\System32\\WINDOW~1\\v1.0\\powershell.exe" Add-MpPrefe ..." (UID: 00000000-00001372) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath %APPDATA%\\eiVfWxqyEFoV.exe" (UID: 00000000-00001160) Spawned process "svchost.com" with commandline ""%WINDIR%\\System32\\schtasks.exe" /Create /TN "Updates\\eiVfWxq ..." (UID: 00000000-00002768), Spawned process "schtasks.exe" with commandline "/Create /TN Updates\\eiVfWxqyEFoV /XML %TEMP%\\tmpA312.tmp" (UID: 00000000-00002724), Spawned process "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (UID: 00000000-00004296), Spawned process "svchost.com" with commandline ""%TEMP%\\3582-490\\61D0FA~1.EXE"" (UID: 00000000-00001416), Spawned process "61D0FA~1.EXE" (UID: 00000000-00002580), Spawned process "svchost.com" with commandline ""%WINDIR%\\System32\\WINDOW~1\\v1.0\\powershell.exe" Add-MpPrefe ..." (UID: 00000000-00004484)56:T569,Spawned process "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (UID: 00000000-00004028) Spawned process "svchost.com" with commandline ""%WINDIR%\\System32\\WINDOW~1\\v1.0\\powershell.exe" Add-MpPrefe ..." (UID: 00000000-00003280) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath %TEMP%\\3582-490\\61d0fa3933d062 ..." (UID: 00000000-00004148) Spawned process "svchost.com" with commandline ""%WINDIR%\\System32\\WINDOW~1\\v1.0\\powershell.exe" Add-MpPrefe ..." (UID: 00000000-00001372) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath %APPDATA%\\eiVfWxqyEFoV.exe" (UID: 00000000-00001160) Spawned process "svchost.com" with commandline ""%WINDIR%\\System32\\schtasks.exe" /Create /TN "Updates\\eiVfWxq ..." (UID: 00000000-00002768), Spawned process "schtasks.exe" with commandline "/Create /TN Updates\\eiVfWxqyEFoV /XML %TEMP%\\tmpA312.tmp" (UID: 00000000-00002724), Spawned process "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (UID: 00000000-00004296), Spawned process "svchost.com" with commandline ""%TEMP%\\3582-490\\61D0FA~1.EXE"" (UID: 00000000-00001416), Spawned process "61D0FA~1.EXE" (UID: 00000000-00002580), Spawned process "svchost.com" with commandline ""%WINDIR%\\System32\\WINDOW~1\\v1.0\\powershell.exe" Add-MpPrefe ..." (UID: 00000000-00004484)57:T542,"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "setup.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "dwtrig20.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "python.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "pythonw.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "KMSSS.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "OneDrive.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "javaws.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "javaw.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "java.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "ose.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "gui-64.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "t64.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "w64.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "t32.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE58:T143d,Found string "function New-TemporaryFile" (Indicator: "New-TemporaryFile"; Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00002332.00000002.89745.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp, 00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found string "function New-Guid" (Indicator: "New-Guid"; Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00002332.00000002.89745.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp, 00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found string "function Import-PowerShellDataFile" (Indicator: "Import-PowerShellDataFile"; Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00002332.00000002.89745.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp, 00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Import-LocalizedData LocalizedData -filename PSGet.Resource.psd1" (Indicator: "Import-LocalizedData"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Add-Type -ReferencedAssemblies $requiredAssembly -TypeDefinition $source -Language CSharp -ErrorAction SilentlyContinue" (Indicator: "Add-Type"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "function Register-PSRepository" (Indicator: "Register-PSRepository"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$packageSources | Microsoft.PowerShell.Core\ForEach-Object { New-ModuleSourceFromPackageSource -PackageSource $_ }" (Indicator: "New-Module"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "function New-ScriptFileInfo" (Indicator: "New-ScriptFileInfo"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Add-Member -InputObject $script:PSGetModuleSources[$_] `" (Indicator: "Add-Member"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Add-Member -InputObject $PSGetItemInfo -MemberType NoteProperty -Name $script:InstalledLocation -Value $InstalledLocation" (Indicator: "Add-Member"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "# If Import-LocalizedData cmdlet was failed to read the .psd1 contents" (Indicator: "Import-LocalizedData"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Add-Member -InputObject $PSScriptInfo `" (Indicator: "Add-Member"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "# Persist the repositories only when Register-PSRepository cmdlet is used" (Indicator: "Register-PSRepository"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "function New-ModuleSourceFromPackageSource" (Indicator: "New-Module"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Add-Member -InputObject $psgetItemInfo `" (Indicator: "Add-Member"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "#Params to pass to New-ModuleManifest module" (Indicator: "New-Module"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "#Params to pass to New-ModuleManifest module" (Indicator: "New-ModuleManifest"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Core\New-ModuleManifest @params -Confirm:$false -WhatIf:$false" (Indicator: "New-ModuleManifest"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "#Manually update the section in PrivateData since New-ModuleManifest works differently on different PS version" (Indicator: "New-Module"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "#Manually update the section in PrivateData since New-ModuleManifest works differently on different PS version" (Indicator: "New-ModuleManifest"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp")59:T1de4,Found string "PackageManagement\Find-Package @PSBoundParameters | Microsoft.PowerShell.Core\ForEach-Object {" (Indicator: "Find-Package"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$null = PackageManagement\Save-Package @PSBoundParameters" (Indicator: "Save-Package"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$null = PackageManagement\Install-Package @PSBoundParameters" (Indicator: "Install-Package"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$installedPackages = PackageManagement\Get-Package @GetPackageParameters" (Indicator: "Get-Package"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$PSGetItemInfos = PackageManagement\Get-Package @GetPackageParameters |" (Indicator: "Get-Package"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$sid = PackageManagement\Install-Package @PSBoundParameters" (Indicator: "Install-Package"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$null = PackageManagement\Uninstall-Package @PSBoundParameters" (Indicator: "Uninstall-Package"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$null = PackageManagement\Uninstall-Package @PSBoundParameters" (Indicator: "Install-Package"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "PackageManagement\Get-Package @PSBoundParameters | Microsoft.PowerShell.Core\ForEach-Object {New-PSGetItemInfo -SoftwareIdentity $_ -Type $script:PSArtifactTypeModule}" (Indicator: "Get-Package"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "PackageManagement\Get-Package @PSBoundParameters | Microsoft.PowerShell.Core\ForEach-Object {New-PSGetItemInfo -SoftwareIdentity $_ -Type $script:PSArtifactTypeScript}" (Indicator: "Get-Package"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$providers = PackageManagement\Get-PackageProvider | Where-Object { $_.Name -ne $script:PSModuleProviderName -and $_.Features.ContainsKey($script:SupportsPSModulesFeatureName) }" (Indicator: "Get-PackageProvider"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$providerName = Get-PackageManagementProviderName -Location $SourceLocation" (Indicator: "Get-Package"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$null = PackageManagement\Register-PackageSource @PSBoundParameters" (Indicator: "Register-PackageSource"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$null = PackageManagement\Set-PackageSource @PSBoundParameters" (Indicator: "Set-PackageSource"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$null = PackageManagement\Unregister-PackageSource @PSBoundParameters" (Indicator: "Register-PackageSource"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$null = PackageManagement\Unregister-PackageSource @PSBoundParameters" (Indicator: "Unregister-PackageSource"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$packageSources = PackageManagement\Get-PackageSource @PSBoundParameters" (Indicator: "Get-PackageSource"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "function Get-PackageManagementProviderName" (Indicator: "Get-Package"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$providers = PackageManagement\Get-PackageProvider | Where-Object { $_.Features.ContainsKey($script:SupportsPSModulesFeatureName) }" (Indicator: "Get-PackageProvider"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$packageSource = Get-PackageSource -Location $loc -Provider $provider.ProviderName -ErrorAction SilentlyContinue" (Indicator: "Get-PackageSource"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$packageSource = Get-PackageSource -Location $loc -Provider $provider.ProviderName -ErrorAction SilentlyContinue" (Indicator: "Get-Package"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$res = Get-PackageSource -Location $loc -Provider $PackageManagementProvider.Value -ErrorAction SilentlyContinue" (Indicator: "Get-PackageSource"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$res = Get-PackageSource -Location $loc -Provider $PackageManagementProvider.Value -ErrorAction SilentlyContinue" (Indicator: "Get-Package"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$PackageManagementProvider.Value = Get-PackageManagementProviderName -Location $Location" (Indicator: "Get-Package"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$nugetProvider = PackageManagement\Get-PackageProvider -ErrorAction SilentlyContinue -WarningAction SilentlyContinue |" (Indicator: "Get-PackageProvider"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$availableNugetProviders = PackageManagement\Get-PackageProvider -Name $script:NuGetProviderName `" (Indicator: "Get-PackageProvider"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$null = PackageManagement\Import-PackageProvider -Name $script:NuGetProviderName `" (Indicator: "Import-PackageProvider"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$null = PackageManagement\Install-PackageProvider -Name $script:NuGetProviderName `" (Indicator: "Install-PackageProvider"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$nugetProvider = PackageManagement\Get-PackageProvider -Name $script:NuGetProviderName" (Indicator: "Get-PackageProvider"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp")5a:T242e,"setup.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\3582-490\61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe]- [targetUID: 00000000-00003556] "dwtrig20.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "python.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "pythonw.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [%LOCALAPPDATA%\Programs\Python\PYTHON~2\Lib\venv\scripts\nt\pythonw.exe]- [targetUID: 00000000-00003556] "KMSSS.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "OneDrive.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "javaws.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [%ALLUSERSPROFILE%\Oracle\Java\javapath_target_623756\javaws.exe]- [targetUID: 00000000-00003556] "javaw.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [%ALLUSERSPROFILE%\Oracle\Java\javapath_target_623756\javaw.exe]- [targetUID: 00000000-00003556] "java.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [%ALLUSERSPROFILE%\Oracle\Java\javapath_target_623756\java.exe]- [targetUID: 00000000-00003556] "ose.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "gui-64.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [%LOCALAPPDATA%\Programs\Python\PYTHON~2\Lib\SITE-P~1\SETUPT~1\gui-64.exe]- [targetUID: 00000000-00003556] "t64.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "w64.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "python.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [%LOCALAPPDATA%\Programs\Python\PYTHON~2\python.exe]- [targetUID: 00000000-00003556] "pythonw.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [%LOCALAPPDATA%\Programs\Python\PYTHON~2\pythonw.exe]- [targetUID: 00000000-00003556] "t32.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "pythonw.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "w32.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "pip.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "devcon.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "gui-64.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "cli-64.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "gui-32.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "cli.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "TOR-GE~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "CHROME~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "PYTHON~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "INTEGR~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "DW20.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "VC_RED~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "WININS~4.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "WININS~3.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "ADOBEA~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "AIRAPP~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "WI5DE4~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "WININS~2.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "WI02EA~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "WININS~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "FILESY~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "NORMAL~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "PIP38~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [%LOCALAPPDATA%\Programs\Python\PYTHON~2\Scripts\PIP38~1.EXE]- [targetUID: 00000000-00003280] "EASY_I~2.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "WI5ED8~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "WI2335~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "WIC467~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "SVCHOST.COM.6A8DE18A.bin" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "ModuleAnalysisCache" has type "Unknown"- [targetUID: N/A] "JFVOR0YMUG8LZDC47TZY.temp" has type "Unknown"- [targetUID: N/A] "tmp4691.tmp" has type "Unknown"- Location: [%TEMP%\tmp4691.tmp]- [targetUID: 00000000-00002580] "directx.sys" has type "Unknown"- Location: [%WINDIR%\directx.sys]- [targetUID: 00000000-00001416] "StartupProfileData-NonInteractive" has type "Unknown"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00001160] "tmp5023.tmp" has type "Unknown"- [targetUID: N/A] "eiVfWxqyEFoV.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%APPDATA%\eiVfWxqyEFoV.exe]- [targetUID: 00000000-00003556] "pip3.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [%LOCALAPPDATA%\Programs\Python\PYTHON~2\Scripts\pip3.exe]- [targetUID: 00000000-00003556] "pip.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [%LOCALAPPDATA%\Programs\Python\PYTHON~2\Scripts\pip.exe]- [targetUID: 00000000-00003556] "pip3.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "gui.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "gui.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [%LOCALAPPDATA%\Programs\Python\PYTHON~2\Lib\SITE-P~1\SETUPT~1\gui.exe]- [targetUID: 00000000-00003556] "cli-32.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "svchost.com" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [%WINDIR%\svchost.com]- [targetUID: 00000000-00003556] "EASY_I~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "PIP36~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "SVCHOST.COM.6A8DB95C.bin" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "SVCHOST.COM.6A8DDEC1.bin" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "4IXDSVXABUA7BR4HDZEZ.temp" has type "Unknown"- [targetUID: N/A] "RDWIGL7GBTPGI642SONE.temp" has type "Unknown"- [targetUID: N/A] "5789R8NTDIZOYZUG4TK7.temp" has type "Unknown"- [targetUID: N/A] "JH4GQO9W096WU7NKZ9AQ.temp" has type "Unknown"- [targetUID: N/A] "TYE6WP2MCU8MZUWAWXNP.temp" has type "Unknown"- [targetUID: N/A] "A5DHI54LK2B74ZE4Y0MQ.temp" has type "Unknown"- [targetUID: N/A] "GGE255HTY2X9T657V5YT.temp" has type "Unknown"- [targetUID: N/A] "tmp959A.tmp" has type "Unknown"- [targetUID: N/A] "tmp60F4.tmp" has type "Unknown"- [targetUID: N/A] "tmpA312.tmp" has type "Unknown"- Location: [%TEMP%\tmpA312.tmp]- [targetUID: 00000000-00004028] "tmpDFD3.tmp" has type "Unknown"- [targetUID: N/A]5b:Taa7,"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: ""; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: ""; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: ""; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC3-D863-11E7-B9FF-806E6F6E6963}\"; Key: ""; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC4-D863-11E7-B9FF-806E6F6E6963}\"; Key: ""; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "")5c:T1252,"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: "CEIPENABLE"; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC3-D863-11E7-B9FF-806E6F6E6963}"; Key: "DATA"; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC3-D863-11E7-B9FF-806E6F6E6963}"; Key: "GENERATION"; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC4-D863-11E7-B9FF-806E6F6E6963}"; Key: "DATA"; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC4-D863-11E7-B9FF-806E6F6E6963}"; Key: "GENERATION"; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "61D0FA3933D0620B188C69CA85D91241E252AC419B46341AD1EAC5DFF7C9676E"; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "")5d:T590,"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" reads file "c:\61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" reads file "c:\users\%osuser%\appdata\local\temp\3582-490\61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" reads file "c:\msocache\all users\{90140000-0011-0000-0000-0000000ff1ce}-c\ose.exe" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" reads file "c:\msocache\all users\{90140000-0011-0000-0000-0000000ff1ce}-c\setup.exe" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" reads file "c:\msocache\all users\{90140000-0115-0409-0000-0000000ff1ce}-c\dw20.exe" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" reads file "c:\msocache\all users\{90140000-0115-0409-0000-0000000ff1ce}-c\dwtrig20.exe" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" reads file "c:\programdata\adobe\arm\s\27490\adobearmhelper.exe" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" reads file "c:\programdata\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.exe" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" reads file "c:\programdata\kmsautos\bin\driver\x86tap1\devcon.exe"5e:T41d,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Able to identify virtual environment using user register activity Matched sigs: Able to identify virtual environment by using API string Matched sigs: Able to detect virtual machine (string) Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify sandbox environment running process Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Makes a code branch decision directly after an API that is environment aware5f:Tbb1,"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Temp\3582-490" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Temp" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to touch file "C:\" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to touch file "C:\Windows\system32\rpcss.dll" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to touch file "C:\CRYPTBASE.dll" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to touch file "C:\Windows\system32\CRYPTBASE.dll" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to touch file "\Device\KsecDD" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to touch file "C:\Windows\system32\uxtheme.dll" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Temp\3582-490\61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to touch file "C:\PROPSYS.dll" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to touch file "C:\Windows\system32\PROPSYS.dll" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to touch file "C:\61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe.Local\" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to touch file "C:\ntmarta.dll" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to touch file "C:\Windows\system32\ntmarta.dll" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to touch file "C:\apphelp.dll" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to touch file "C:\Windows\system32\apphelp.dll" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to touch file "C:\Windows\System32\shdocvw.dll"60:T5f6,"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" touched file "C:\Windows\svchost.com" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "svchost.com" touched file "C:\Windows\directx.sys" "svchost.com" touched file "C:\Windows\svchost.com" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\FH8YCUY4Y857AKKF9M5J.temp" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF12a6d9.TMP" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive" "powershell.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\FH8YCUY4Y857AKKF9M5J.temp" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF12a6d9.TMP"61:Tda5,"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\PROPSYS.dll" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\ntmarta.dll" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\apphelp.dll" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\version.DLL" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\Secur32.dll" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\api-ms-win-downlevel-advapi32-l2-1-0.dll" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\CRYPTBASE.DLL" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\PROPSYS.DLL" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\NTMARTA.DLL" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\APPHELP.DLL" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\VERSION.DLL" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\SECUR32.DLL" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\SSPICLI.DLL" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\3582-490\FLTLIB.DLL" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\3582-490\MSVCP140.dll" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\3582-490\VCRUNTIME140.dll" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\3582-490\api-ms-win-crt-runtime-l1-1-0.dll" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\3582-490\ucrtbase.DLL" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\3582-490\api-ms-win-core-timezone-l1-1-0.dll" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\3582-490\api-ms-win-core-file-l2-1-0.dll"62:Tf85,"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\3582-490" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe.Local\" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\3582-490\61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe:Zone.Identifier" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\Windows\directx.sys" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\Program Files\Common Files\VMware\" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\Program Files\VMware\" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VMware\" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\ProgramData\VMware\" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\VMware\" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\Users\All Users\VMware\" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\VBoxGuestAdditions\" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_4724fcf083c0266e\" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_5a6838e85c9947b0\" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\Windows\System32\DriverStore\FileRepository\vmci.inf_x86_neutral_0e3235498045d252\" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\Windows\Temp\vmware-SYSTEM\" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\61D0FA3933D0620B188C69CA85D91241E252AC419B46341AD1EAC5DFF7C9676E.EXE.LOCAL" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\3582-490\61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe:ZONE.IDENTIFIER" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\Windows\DIRECTX.SYS" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\TMP5023.TMP" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\3582-490\61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe.config"63:T4dc,"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" writes file "c:\users\%osuser%\appdata\local\temp\3582-490\61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" writes file "c:\windows\svchost.com" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" writes file "c:\msocache\all users\{90140000-0011-0000-0000-0000000ff1ce}-c\ose.exe" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" writes file "c:\msocache\all users\{90140000-0011-0000-0000-0000000ff1ce}-c\setup.exe" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" writes file "c:\msocache\all users\{90140000-0115-0409-0000-0000000ff1ce}-c\dw20.exe" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" writes file "c:\msocache\all users\{90140000-0115-0409-0000-0000000ff1ce}-c\dwtrig20.exe" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" writes file "c:\programdata\adobe\arm\s\27490\adobearmhelper.exe" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" writes file "c:\programdata\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.exe"64:Ta32,Found reference to API "System Bind Data" (Indicator: " bind "; Source: "00000000-00000468.00000000.87465.00500000.00000004.mdmp, 00000000-00000468.00000001.87861.00500000.00000004.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00000468.00000000.87465.00F90000.00000002.mdmp, 00000000-00000940.00000000.88155.00790000.00000002.mdmp, 00000000-00002332.00000000.86829.007B0000.00000002.mdmp, 00000000-00002332.00000001.88751.007B0000.00000002.mdmp, 00000000-00002416.00000000.90075.00840000.00000002.mdmp, 00000000-00002916.00000000.82579.00D20000.00000002.mdmp, 00000000-00002952.00000000.82517.007D0000.00000002.mdmp, 00000000-00003064.00000000.88277.00AF0000.00000002.mdmp, 00000000-00003064.00000001.90201.00AF0000.00000002.mdmp, 00000000-00003560.00000000.86765.00710000.00000002.mdmp, 00000000-00003560.00000001.88687.00710000.00000002.mdmp, 00000000-00003560.00000002.90611.00710000.00000002.mdmp, 00000000-00004068.00000000.90323.007A0000.00000002.mdmp, 00000000-00004420.00000000.90806.00800000.00000002.mdmp, 00000000-00004604.00000000.81976.00D20000.00000002.mdmp, 00000000-00005300.00000000.84449.00D20000.00000002.mdmp, 00000000-00005424.00000000.85048.00770000.00000002.mdmp, 00000000-00005568.00000000.85134.00F90000.00000002.mdmp, 00000000-00005568.00000001.87057.00F90000.00000002.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00002332.00000001.88751.00280000.00000004.mdmp, 00000000-00002332.00000002.89745.00280000.00000004.mdmp, 00000000-00002916.00000001.84169.004F0000.00000004.mdmp, 00000000-00003064.00000001.90201.00610000.00000004.mdmp, 00000000-00003560.00000001.88687.00320000.00000004.mdmp, 00000000-00003560.00000002.90611.00320000.00000004.mdmp, 00000000-00005568.00000001.87057.00420000.00000004.mdmp, 00000000-00005568.00000002.87218.00420000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00002332.00000001.88751.01C60000.00000004.mdmp, 00000000-00002332.00000002.89745.01C60000.00000004.mdmp, 00000000-00002916.00000001.84169.004F0000.00000004.mdmp, 00000000-00003064.00000001.90201.00610000.00000004.mdmp, 00000000-00003560.00000001.88687.00320000.00000004.mdmp, 00000000-00003560.00000002.90611.00320000.00000004.mdmp, 00000000-00005568.00000001.87057.00420000.00000004.mdmp, 00000000-00005568.00000002.87218.00420000.00000004.mdmp")65:Tacf0,Found URL "http://java.com/helphttp://java.com/helphttp://java.com/helpvisit" - Source: "00000000-00002332.00000000.86829.00280000.00000004.mdmp") Found URL "http://java.com/http://java.com/http://java.com/programs@shell32.dll,-21782java" - Source: "00000000-00002332.00000000.86829.00280000.00000004.mdmp") Found URL "http://docs.oracle.com/javase/8/docshttp://docs.oracle.com/javase/8/docshttp://docs.oracle.com/javase/8/docsprograms@shell32.dll,-21782maintenance@shell32.dll,-21811backup" - Source: "00000000-00002332.00000000.86829.00280000.00000004.mdmp") Found URL "http://www.winpcap.org/http://www.winpcap.org/http://www.winpcap.org/acrobat" - Source: "00000000-00002332.00000000.86829.00280000.00000004.mdmp") Found URL "http://:\users\hapubws\contacts\desktop.ini-c0f2e0b9fa8e" - Source: "00000000-00002332.00000001.88751.00280000.00000004.mdmp") Found URL "http://www.winpcap.org/are\claclsid\" - Source: "00000000-00002332.00000001.88751.00280000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=717973'guid=" - Source: "00000000-00002332.00000001.88751.00690000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=390785'aliasestoexport" - Source: "00000000-00002332.00000001.88751.00690000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=517145" - Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=623621" - Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=623636" - Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=397631&clcid=0x409'$script:psgallerypublishuri" - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=397527&clcid=0x409'$script:psgalleryscriptsourceuri" - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=622995&clcid=0x409'" - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=528403&clcid=0x409'$script:psgalleryv2apiavailable" - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=698608'$script:nugetprovidername" - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "https://nuget.org/nuget.exe'$script:nugetclientsourceurl" - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=690216&clcid=0x409'$script:nugetexename" - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=398575'," - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=398574')]" - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=531351'," - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=398573'," - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=398576')]" - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=526864')]" - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=526863')]" - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=517196')]" - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=733636')]" - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=718029')]" - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=619788')]" - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=619785')]" - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=619786'," - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=619784'," - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=619787')]" - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=619789')]" - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=619790')]" - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=517129')]" - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=517128')]" - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=517130')]" - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=517127')]" - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "https://contoso.com/license.projecturi" - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "https://contoso.com/.iconuri" - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "https://contoso.com/icon.externalmoduledependencies" - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=619791')]" - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "https://contoso.com/license" - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "https://contoso.com/" - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "https://contoso.com/icon" - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=619792')]" - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=619793')]" - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "http://nuget.org/nuget.exe" - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=619311')]" - Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp") Found URL "http://:\users\hapubws\contacts\desktop.ini-c0f2e0b9fa8e" - Source: "00000000-00002332.00000002.89745.00280000.00000004.mdmp") Found URL "http://www.winpcap.org/are\claclsid\" - Source: "00000000-00002332.00000002.89745.00280000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=216365" - Source: "00000000-00002332.00000002.89745.00690000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=623621" - Source: "00000000-00002332.00000002.89745.01680000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=623636" - Source: "00000000-00002332.00000002.89745.01680000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00002332.00000002.89745.01680000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00002332.00000002.89745.01680000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00002332.00000002.89745.01680000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/cspca.crl0h<0:08,http://www.microsoft.com/pki/certs/cspca.crt0@wosgytwo&" - Source: "00000000-00002332.00000002.89745.01680000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/tspca.crl0h<0:08,http://www.microsoft.com/pki/certs/tspca.crt0'(a*_s^)w>" - Source: "00000000-00002332.00000002.89745.01680000.00000004.mdmp") Found URL "http://www.microsoft.com/powershell" - Source: "00000000-00002332.00000002.89745.01680000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/cspca.crlystem" - Source: "00000000-00002332.00000002.89745.01C60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=397631&clcid=0x409'$script:psgallerypublishuri" - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=397527&clcid=0x409'$script:psgalleryscriptsourceuri" - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=622995&clcid=0x409'" - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=528403&clcid=0x409'$script:psgalleryv2apiavailable" - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=698608'$script:nugetprovidername" - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "https://nuget.org/nuget.exe'$script:nugetclientsourceurl" - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=690216&clcid=0x409'$script:nugetexename" - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=398575'," - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=398574')]" - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=531351'," - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=398573'," - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=398576')]" - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=526864')]" - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=526863')]" - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=517196')]" - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=733636')]" - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=718029')]" - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=619788')]" - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=619785')]" - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=619786'," - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=619784'," - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=619787')]" - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=619789')]" - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=619790')]" - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=517129')]" - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=517128')]" - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=517130')]" - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=517127')]" - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "https://contoso.com/license.projecturi" - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "https://contoso.com/.iconuri" - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "https://contoso.com/icon.externalmoduledependencies" - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=619791')]" - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "https://contoso.com/license" - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "https://contoso.com/" - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "https://contoso.com/icon" - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=619792')]" - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=619793')]" - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "http://nuget.org/nuget.exe" - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=619311')]" - Source: "00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l4n!0wxb" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/cspca.crl0h<0:08,http://www.microsoft.com/pki/certs/cspca.crt0@wosgytwo&" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/tspca.crl0h<0:08,http://www.microsoft.com/pki/certs/tspca.crt0'(a*_s^)w>" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/tspca.crl0h<0:08,http://www.microsoft.com/pkizca.crt0'(a*_s^)@=e2&hn" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://www.microsoft.com/powershell" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0[" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc0?1$0" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/jom5o" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5osalt" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynslentrust.net1;092www.entrust.net/cps" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,unizeto" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;npijlf04o0-%i1" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!entrust.net1;092www.entrust.net/cps" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?," - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!%2+jo9vh'-;8kbsp" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:9*cosalt" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0addtrust" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrus1xkc9washington1redmond1microsoft" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszys\1]f3bv:th6a[jdigicert" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00002332.00000002.89745.052B0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00002916.00000001.84169.004F0000.00000004.mdmp") Found URL "http://www.adobe.com/go/getair" - Source: "00000000-00003556.00000002.80940.0011F000.00000004.mdmp") Found URL "http://www.adobe.com/go/getair_tr" - Source: "00000000-00003556.00000002.80940.0011F000.00000004.mdmp") Found URL "http://www.adobe.com/go/getair_se" - Source: "00000000-00003556.00000002.80940.0011F000.00000004.mdmp") Found URL "http://www.adobe.com/go/getair_pl" - Source: "00000000-00003556.00000002.80940.0011F000.00000004.mdmp") Found URL "http://www.adobe.com/go/getair_nl" - Source: "00000000-00003556.00000002.80940.0011F000.00000004.mdmp") Found URL "http://www.adobe.com/go/getair_cz" - Source: "00000000-00003556.00000002.80940.0011F000.00000004.mdmp") Found URL "http://www.adobe.com/go/getair_tw)http://www.adobe.com/go/getair_cnadobe" - Source: "00000000-00003556.00000002.80940.0011F000.00000004.mdmp") Found URL "http://www.adobe.com/go/getair_ru" - Source: "00000000-00003556.00000002.80940.0011F000.00000004.mdmp") Found URL "http://www.adobe.m/go/getair_br" - Source: "00000000-00003556.00000002.80940.0011F000.00000004.mdmp") Found URL "http://www.adobcom/go/getair_kre" - Source: "00000000-00003556.00000002.80940.0011F000.00000004.mdmp") Found URL "http://w.adobe.com/go/getair_jp" - Source: "00000000-00003556.00000002.80940.0011F000.00000004.mdmp") Found URL "http://www.adobe.com/go/getair_it," - Source: "00000000-00003556.00000002.80940.0011F000.00000004.mdmp") Found URL "http://www.adobe.com/go/getair_fr," - Source: "00000000-00003556.00000002.80940.0011F000.00000004.mdmp") Found URL "http://www.adobe.com/go/getair_es" - Source: "00000000-00003556.00000002.80940.0011F000.00000004.mdmp") Found URL "http://www.adobe.com/go/getair_de" - Source: "00000000-00003556.00000002.80940.0011F000.00000004.mdmp") Found URL "http://www.adobe.com/go/getair" - Source: "00000000-00003556.00000003.86440.0011F000.00000004.mdmp") Found URL "http://www.adobe.com/go/getair_tr" - Source: "00000000-00003556.00000003.86440.0011F000.00000004.mdmp") Found URL "http://www.adobe.com/go/getair_se" - Source: "00000000-00003556.00000003.86440.0011F000.00000004.mdmp") Found URL "http://www.adobe.com/go/getair_pl" - Source: "00000000-00003556.00000003.86440.0011F000.00000004.mdmp") Found URL "http://www.adobe.com/go/getair_nl" - Source: "00000000-00003556.00000003.86440.0011F000.00000004.mdmp") Found URL "http://www.adobe.com/go/getair_cz" - Source: "00000000-00003556.00000003.86440.0011F000.00000004.mdmp") Found URL "http://www.adobe.com/go/getair_tw)http://www.adobe.com/go/getair_cnadobe" - Source: "00000000-00003556.00000003.86440.0011F000.00000004.mdmp") Found URL "http://www.adobe.com/go/getair_ru" - Source: "00000000-00003556.00000003.86440.0011F000.00000004.mdmp") Found URL "http://www.adobe.m/go/getair_br" - Source: "00000000-00003556.00000003.86440.0011F000.00000004.mdmp") Found URL "http://www.adobcom/go/getair_kre" - Source: "00000000-00003556.00000003.86440.0011F000.00000004.mdmp") Found URL "http://w.adobe.com/go/getair_jp" - Source: "00000000-00003556.00000003.86440.0011F000.00000004.mdmp") Found URL "http://www.adobe.com/go/getair_it," - Source: "00000000-00003556.00000003.86440.0011F000.00000004.mdmp") Found URL "http://www.adobe.com/go/getair_fr," - Source: "00000000-00003556.00000003.86440.0011F000.00000004.mdmp") Found URL "http://www.adobe.com/go/getair_es" - Source: "00000000-00003556.00000003.86440.0011F000.00000004.mdmp") Found URL "http://www.adobe.com/go/getair_de" - Source: "00000000-00003556.00000003.86440.0011F000.00000004.mdmp") Found URL "http://www.winpcap.org/http://www.winpcap.org/http://www.winpcap.org/hancom" - Source: "00000000-00003560.00000000.86765.00320000.00000004.mdmp") Found URL "http://java.com/helphttp://java.com/helphttp://java.com/help.exkacrobat" - Source: "00000000-00003560.00000000.86765.00320000.00000004.mdmp") Found URL "http://java.com/http://java.com/http://java.com/taskbarinternet" - Source: "00000000-00003560.00000000.86765.00320000.00000004.mdmp") Found URL "http://docs.oracle.com/javase/8/docshttp://docs.oracle.com/javase/8/docshttp://docs.oracle.com/javase/8/docsextras:\users\hapubws\appdata\roaming\microsoft\internet" - Source: "00000000-00003560.00000000.86765.00320000.00000004.mdmp") Found URL "http://java.com/helphttp://java.com/helphttp://java.com/help.exaacrobat" - Source: "00000000-00003560.00000001.88687.00320000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=517145" - Source: "00000000-00003560.00000001.88687.015E0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00003560.00000001.88687.015E0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00003560.00000001.88687.015E0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00003560.00000001.88687.015E0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=623621" - Source: "00000000-00003560.00000001.88687.015E0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=623636" - Source: "00000000-00003560.00000001.88687.015E0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=216365" - Source: "00000000-00003560.00000002.90611.00300000.00000004.mdmp") Found URL "http://java.com/helphttp://java.com/helphttp://java.com/help.exaacrobat" - Source: "00000000-00003560.00000002.90611.00320000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=623621" - Source: "00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=623636" - Source: "00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/cspca.crl0h<0:08,http://www.microsoft.com/pki/certs/cspca.crt0@wosgytwo&" - Source: "00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/tspca.crl0h<0:08,http://www.microsoft.com/pki/certs/tspca.crt0'(a*_s^)w>" - Source: "00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found URL "http://www.microsoft.com/powershell" - Source: "00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/cspca.crl0000000000a072e501c0cbc56874812705ddcbc568a072e5014500370044003600450044007e0031000000336500000000a4822705780,4092,9,$name,2,0,," - Source: "00000000-00003560.00000002.90611.01DD0000.00000004.mdmp") Found URL "http://go.microsoft.c_kwl?linkid=42127" - Source: "00000000-00003560.00000002.90611.01DD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/cspca.crl0h<0:08,http://www.microsoft.com/pki/certs/cspca.crt0@wosgytwo&" - Source: "00000000-00003560.00000002.90611.01DD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/tspca.crl0h<0:08,http://www.microsoft.com/pki/certs/tspca.crt0'(a*_s^)w>" - Source: "00000000-00003560.00000002.90611.01DD0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/cspca.crl0h<0:[,http://www.microsoft.com/pki/certs/cspca.c@wosg&" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/'ts/tspca.crl0h,http://www.microsoft.com/pki/certs/tspca.crt0'(a*_s^)@=e2&hn" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc0?1$0" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9nql" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0i8v" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o,zsh" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/m:" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynslentrust.net1;092www.entrust.net/cps" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,microsoft" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa00i;v" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;n9*cosalt" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0unizeto" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!entrust.net1;092www.entrust.net/cps" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?," - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:i8v" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrusi;v" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszyszvoni;v" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00003560.00000002.90611.052E0000.00000004.mdmp") Found URL "http://www.winpcap.org/http://www.winpcap.org/http://www.winpcap.org/emp\hncdownload\prepareinstalltemp\hncupdate\hncselfupdate.exeusers@shell32.dll,-21813hapubwsappdataroamingmicrosoftwindowsstart" - Source: "00000000-00004068.00000000.90323.00200000.00000004.mdmp") Found URL "http://docs.oracle.com/javase/8/docshttp://docs.oracle.com/javase/8/docshttp://docs.oracle.com/javase/8/docsusers@shell32.dll,-21813public@shell32.dll,-21816desktop@shell32.dll,-21799users@shell32.dll,-21813public@shell32.dll,-21816desktop@shell32.dll,-21799users@shell32.dll,-21813hapubwsappdataroamingusers@shell32.dll,-21813hapubwsappdataroamingmicrosoftwindowsstart" - Source: "00000000-00004068.00000000.90323.00200000.00000004.mdmp") Found URL "http://java.com/http://java.com/http://java.com/a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e" - Source: "00000000-00004068.00000000.90323.00200000.00000004.mdmp") Found URL "http://java.com/helphttp://java.com/helphttp://java.com/helpautoitxspeech" - Source: "00000000-00004068.00000000.90323.00200000.00000004.mdmp")66:T7b7,Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: 61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: setup.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: dwtrig20.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: python.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: pythonw.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: KMSSS.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: OneDrive.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: javaws.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: javaw.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: java.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: ose.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: gui-64.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: t64.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: w64.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: t32.exe]67:Tde4,Found reference to API "GetDriveTypeA" (Indicator: "GetDriveType"; File: "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e") Found reference to API "GetLogicalDriveStringsA" (Indicator: "GetLogicalDriveStrings"; File: "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e") Found reference to API "GetLogicalDriveStringsA" (Indicator: "GetLogicalDriveStrings"; Source: "00000000-00000468.00000000.87465.00400000.00000040.mdmp, 00000000-00000468.00000001.87861.00400000.00000040.mdmp, 00000000-00000940.00000000.88155.00409000.00000004.mdmp, 00000000-00000940.00000001.88759.00409000.00000004.mdmp, 00000000-00002916.00000001.84169.02B40000.00000004.mdmp, 00000000-00002952.00000000.82517.00409000.00000004.mdmp, 00000000-00002952.00000001.82780.00409000.00000004.mdmp, 00000000-00002996.00000000.81537.00409000.00000004.mdmp, 00000000-00003440.00000000.90322.00409000.00000004.mdmp, 00000000-00003960.00000000.89905.00409000.00000004.mdmp, 00000000-00004008.00000000.81283.00409000.00000004.mdmp, 00000000-00004112.00000000.90111.00409000.00000004.mdmp, 00000000-00004420.00000000.90806.00409000.00000004.mdmp, 00000000-00004604.00000000.81976.00400000.00000040.mdmp, 00000000-00004604.00000001.82212.00400000.00000040.mdmp, 00000000-00005004.00000000.84057.00409000.00000004.mdmp, 00000000-00005052.00000000.83689.00409000.00000004.mdmp, 00000000-00005088.00000000.83829.00409000.00000004.mdmp, 00000000-00005300.00000000.84449.00400000.00000040.mdmp, 00000000-00005300.00000001.84746.00400000.00000040.mdmp, 00000000-00005424.00000000.85048.00409000.00000004.mdmp, 00000000-00005424.00000001.85505.00409000.00000004.mdmp, 00000000-00005568.00000001.87057.02B90000.00000004.mdmp, 00000000-00005568.00000002.87218.02B90000.00000004.mdmp, 00000000-00005868.00000000.86686.00409000.00000004.mdmp, 00000000-00005976.00000000.87012.00409000.00000004.mdmp, 00000000-00006120.00000000.86800.00409000.00000004.mdmp") Found reference to API "GetDriveTypeA" (Indicator: "GetDriveType"; Source: "00000000-00000468.00000000.87465.00400000.00000040.mdmp, 00000000-00000468.00000001.87861.00400000.00000040.mdmp, 00000000-00000940.00000000.88155.00409000.00000004.mdmp, 00000000-00000940.00000001.88759.00409000.00000004.mdmp, 00000000-00002916.00000001.84169.02B40000.00000004.mdmp, 00000000-00002952.00000000.82517.00409000.00000004.mdmp, 00000000-00002952.00000001.82780.00409000.00000004.mdmp, 00000000-00002996.00000000.81537.00409000.00000004.mdmp, 00000000-00003440.00000000.90322.00409000.00000004.mdmp, 00000000-00003960.00000000.89905.00409000.00000004.mdmp, 00000000-00004008.00000000.81283.00409000.00000004.mdmp, 00000000-00004112.00000000.90111.00409000.00000004.mdmp, 00000000-00004420.00000000.90806.00409000.00000004.mdmp, 00000000-00004604.00000000.81976.00400000.00000040.mdmp, 00000000-00004604.00000001.82212.00400000.00000040.mdmp, 00000000-00005004.00000000.84057.00409000.00000004.mdmp, 00000000-00005052.00000000.83689.00409000.00000004.mdmp, 00000000-00005088.00000000.83829.00409000.00000004.mdmp, 00000000-00005300.00000000.84449.00400000.00000040.mdmp, 00000000-00005300.00000001.84746.00400000.00000040.mdmp, 00000000-00005424.00000000.85048.00409000.00000004.mdmp, 00000000-00005424.00000001.85505.00409000.00000004.mdmp, 00000000-00005568.00000001.87057.02B90000.00000004.mdmp, 00000000-00005568.00000002.87218.02B90000.00000004.mdmp, 00000000-00005868.00000000.86686.00409000.00000004.mdmp, 00000000-00005976.00000000.87012.00409000.00000004.mdmp, 00000000-00006120.00000000.86800.00409000.00000004.mdmp")68:T96a,Observed import api "GetLogicalDriveStringsA" which can be "used to retrieve a list of available drives (logical drives) in the system" [Source: 61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e] Observed import api "GetLogicalDriveStringsA" which can be "used to retrieve a list of available drives (logical drives) in the system" [Source: setup.exe] Observed import api "GetLogicalDriveStringsA" which can be "used to retrieve a list of available drives (logical drives) in the system" [Source: dwtrig20.exe] Observed import api "GetLogicalDriveStringsA" which can be "used to retrieve a list of available drives (logical drives) in the system" [Source: python.exe] Observed import api "GetLogicalDriveStringsA" which can be "used to retrieve a list of available drives (logical drives) in the system" [Source: pythonw.exe] Observed import api "GetLogicalDriveStringsA" which can be "used to retrieve a list of available drives (logical drives) in the system" [Source: KMSSS.exe] Observed import api "GetLogicalDriveStringsA" which can be "used to retrieve a list of available drives (logical drives) in the system" [Source: OneDrive.exe] Observed import api "GetLogicalDriveStringsA" which can be "used to retrieve a list of available drives (logical drives) in the system" [Source: javaws.exe] Observed import api "GetLogicalDriveStringsA" which can be "used to retrieve a list of available drives (logical drives) in the system" [Source: javaw.exe] Observed import api "GetLogicalDriveStringsA" which can be "used to retrieve a list of available drives (logical drives) in the system" [Source: java.exe] Observed import api "GetLogicalDriveStringsA" which can be "used to retrieve a list of available drives (logical drives) in the system" [Source: ose.exe] Observed import api "GetLogicalDriveStringsA" which can be "used to retrieve a list of available drives (logical drives) in the system" [Source: gui-64.exe] Observed import api "GetLogicalDriveStringsA" which can be "used to retrieve a list of available drives (logical drives) in the system" [Source: t64.exe] Observed import api "GetLogicalDriveStringsA" which can be "used to retrieve a list of available drives (logical drives) in the system" [Source: w64.exe] Observed import api "GetLogicalDriveStringsA" which can be "used to retrieve a list of available drives (logical drives) in the system" [Source: t32.exe]69:Teeb,"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindFirstFileW" with parameter %TEMP%\3582-490\*.* (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindNextFileW" with parameter 61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindFirstFileA" with parameter C:\*.* (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindNextFileA" with parameter $Recycle.Bin (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindNextFileA" with parameter 61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindNextFileA" with parameter autoexec.bat (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindNextFileA" with parameter config.sys (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindNextFileA" with parameter Documents and Settings (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindNextFileA" with parameter dotnet.au3 (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindNextFileA" with parameter dotnet48.exe (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindNextFileA" with parameter MSOCache (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindNextFileA" with parameter pagefile.sys (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindNextFileA" with parameter PerfLogs (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindNextFileA" with parameter Program Files (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindNextFileA" with parameter ProgramData (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindNextFileA" with parameter Recovery (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindNextFileA" with parameter System Volume Information (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindNextFileA" with parameter Temp (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindNextFileA" with parameter TorService (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindNextFileA" with parameter Users (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindNextFileA" with parameter Windows (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindFirstFileA" with parameter C:\$Recycle.Bin\*.* (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00003556) "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" called "FindNextFileA" with parameter S-1-5-21-2092356043-4041700817-663127204-1001 (UID: 00000000-00003556)6a:T1b82,Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00002332.00000001.88751.00280000.00000004.mdmp, 00000000-00002332.00000002.89745.00280000.00000004.mdmp, 00000000-00002916.00000001.84169.004F0000.00000004.mdmp, 00000000-00003064.00000001.90201.00610000.00000004.mdmp, 00000000-00003560.00000002.90611.00320000.00000004.mdmp, 00000000-00005568.00000001.87057.00420000.00000004.mdmp, 00000000-00005568.00000002.87218.00420000.00000004.mdmp") Found string "system.security.cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002332.00000001.88751.01414000.00000004.mdmp, 00000000-00002332.00000001.88751.01B00000.00000004.mdmp, 00000000-00002332.00000001.88751.01B20000.00000004.mdmp, 00000000-00002332.00000001.88751.01B70000.00000004.mdmp, 00000000-00002332.00000002.89745.01414000.00000004.mdmp, 00000000-00002332.00000002.89745.017A0000.00000004.mdmp, 00000000-00003560.00000001.88687.013F4000.00000004.mdmp, 00000000-00003560.00000001.88687.017F0000.00000004.mdmp, 00000000-00003560.00000001.88687.018D0000.00000004.mdmp, 00000000-00003560.00000002.90611.013F4000.00000004.mdmp, 00000000-00003560.00000002.90611.017E0000.00000004.mdmp, 00000000-00003560.00000002.90611.018C0000.00000004.mdmp") Found string "system.security.cryptography.x509certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002332.00000001.88751.01414000.00000004.mdmp, 00000000-00002332.00000001.88751.01B00000.00000004.mdmp, 00000000-00002332.00000001.88751.01B20000.00000004.mdmp, 00000000-00002332.00000001.88751.01B70000.00000004.mdmp, 00000000-00002332.00000002.89745.01414000.00000004.mdmp, 00000000-00002332.00000002.89745.017A0000.00000004.mdmp, 00000000-00003560.00000001.88687.013F4000.00000004.mdmp, 00000000-00003560.00000001.88687.017F0000.00000004.mdmp, 00000000-00003560.00000001.88687.018D0000.00000004.mdmp, 00000000-00003560.00000002.90611.013F4000.00000004.mdmp, 00000000-00003560.00000002.90611.017E0000.00000004.mdmp, 00000000-00003560.00000002.90611.018C0000.00000004.mdmp") Found string "md5cryptoserviceprovider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00002332.00000001.88751.01414000.00000004.mdmp, 00000000-00002332.00000002.89745.01414000.00000004.mdmp, 00000000-00003560.00000001.88687.013F4000.00000004.mdmp, 00000000-00003560.00000002.90611.013F4000.00000004.mdmp") Found string "rngcryptoserviceprovider" (Indicator: "rngcryptoserviceprovider"; Source: "00000000-00002332.00000001.88751.01414000.00000004.mdmp, 00000000-00002332.00000002.89745.01414000.00000004.mdmp, 00000000-00003560.00000001.88687.013F4000.00000004.mdmp, 00000000-00003560.00000002.90611.013F4000.00000004.mdmp") Found string "$hasherType = "System.Security.Cryptography.${Algorithm}CryptoServiceProvider" -as [Type]" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp") Found string "$algorithmType = "System.Security.Cryptography.${Algorithm}" -as [Type]" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp") Found string "[System.Security.Cryptography.HashAlgorithm]" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp, 00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found string "cryptostreammode" (Indicator: "cryptostream"; Source: "00000000-00002332.00000001.88751.01B00000.00000004.mdmp, 00000000-00003560.00000001.88687.017F0000.00000004.mdmp") Found string "cryptostreammode" (Indicator: "cryptostreammode"; Source: "00000000-00002332.00000001.88751.01B00000.00000004.mdmp, 00000000-00003560.00000001.88687.017F0000.00000004.mdmp") Found string "tripledescryptoserviceprovider" (Indicator: "tripledescryptoserviceprovider"; Source: "00000000-00002332.00000001.88751.01B00000.00000004.mdmp, 00000000-00003560.00000001.88687.017F0000.00000004.mdmp") Found string "frombase64transform" (Indicator: "base64"; Source: "00000000-00002332.00000001.88751.01B00000.00000004.mdmp, 00000000-00003560.00000001.88687.017F0000.00000004.mdmp") Found string "frombase64transformmode" (Indicator: "base64"; Source: "00000000-00002332.00000001.88751.01B00000.00000004.mdmp, 00000000-00003560.00000001.88687.017F0000.00000004.mdmp") Found string "gzipstream" (Indicator: "GzipStream"; Source: "00000000-00002332.00000001.88751.01B00000.00000004.mdmp, 00000000-00003560.00000001.88687.017F0000.00000004.mdmp") Found string "base64stream" (Indicator: "base64"; Source: "00000000-00002332.00000001.88751.01B20000.00000004.mdmp, 00000000-00003560.00000002.90611.018C0000.00000004.mdmp") Found string "base64writestateinfo" (Indicator: "base64"; Source: "00000000-00002332.00000001.88751.01B20000.00000004.mdmp, 00000000-00003560.00000002.90611.018C0000.00000004.mdmp") Found string "aescng" (Indicator: "aes"; Source: "00000000-00002332.00000001.88751.01B70000.00000004.mdmp, 00000000-00003560.00000001.88687.018D0000.00000004.mdmp") Found string "aesbcryptmodes" (Indicator: "aes"; Source: "00000000-00002332.00000001.88751.01B70000.00000004.mdmp, 00000000-00003560.00000001.88687.018D0000.00000004.mdmp") Found string "system.security.cryptography.xml" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002332.00000001.88751.01B70000.00000004.mdmp, 00000000-00003560.00000001.88687.018D0000.00000004.mdmp") Found string "ecdsacertificateextensions" (Indicator: "ecdsa"; Source: "00000000-00002332.00000001.88751.01B70000.00000004.mdmp, 00000000-00003560.00000001.88687.018D0000.00000004.mdmp") Found string "ecdsax509signaturegenerator" (Indicator: "ecdsa"; Source: "00000000-00002332.00000001.88751.01B70000.00000004.mdmp, 00000000-00003560.00000001.88687.018D0000.00000004.mdmp") Found string "aescryptoserviceprovider" (Indicator: "aes"; Source: "00000000-00002332.00000001.88751.01B70000.00000004.mdmp, 00000000-00003560.00000001.88687.018D0000.00000004.mdmp") Found string "aescryptoserviceprovider" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00002332.00000001.88751.01B70000.00000004.mdmp, 00000000-00003560.00000001.88687.018D0000.00000004.mdmp") Found string "ecdsa" (Indicator: "ecdsa"; Source: "00000000-00002332.00000001.88751.01B70000.00000004.mdmp, 00000000-00003560.00000001.88687.018D0000.00000004.mdmp") Found string "aesmanaged" (Indicator: "aes"; Source: "00000000-00002332.00000001.88751.01B70000.00000004.mdmp, 00000000-00003560.00000001.88687.018D0000.00000004.mdmp") Found string "ecdsacng" (Indicator: "ecdsa"; Source: "00000000-00002332.00000001.88751.01B70000.00000004.mdmp, 00000000-00003560.00000001.88687.018D0000.00000004.mdmp") Found string "stringtobase64converter" (Indicator: "base64"; Source: "00000000-00002332.00000001.88751.01B70000.00000004.mdmp, 00000000-00003560.00000001.88687.018D0000.00000004.mdmp")6b:T19ac,Found string "$pathsToProcess += Resolve-Path -LiteralPath $LiteralPath | Foreach-Object ProviderPath" (Indicator: "ForEach-Object"; Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00002332.00000002.89745.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp") Found string "$pathsToProcess += Resolve-Path $Path | Foreach-Object ProviderPath" (Indicator: "ForEach-Object"; Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp, 00000000-00003560.00000002.90611.015E0000.00000004.mdmp") Found string "$foundAccess | Sort-Object" (Indicator: "Sort-Object"; Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp") Found string "$pathsToProcess += Resolve-Path $Path | Foreach-Object Provi" (Indicator: "ForEach-Object"; Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00002332.00000002.89745.01680000.00000004.mdmp") Found string "Microsoft.PowerShell.Core\Where-Object {-not $RequiredVersion -or ($RequiredVersion -eq $_.Version)}" (Indicator: "Where-Object"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$resolvedPath = Resolve-PathHelper -Path $Path -CallerPSCmdlet $PSCmdlet | Microsoft.PowerShell.Utility\Select-Object -First 1" (Indicator: "Select-Object"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Core\Where-Object {$_.Name -eq $moduleName} |" (Indicator: "Where-Object"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Select-Object -Last 1" (Indicator: "Select-Object"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Core\Where-Object {$_.Name -eq $moduleInfo.Name} |" (Indicator: "Where-Object"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "PackageManagement\Find-Package @PSBoundParameters | Microsoft.PowerShell.Core\ForEach-Object {" (Indicator: "ForEach-Object"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$destinationPath = Resolve-PathHelper -Path $Path -CallerPSCmdlet $PSCmdlet | Microsoft.PowerShell.Utility\Select-Object -First 1" (Indicator: "Select-Object"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$destinationPath = Resolve-PathHelper -Path $LiteralPath -IsLiteralPath -CallerPSCmdlet $PSCmdlet | Microsoft.PowerShell.Utility\Select-Object -First 1" (Indicator: "Select-Object"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$availableModules = Get-Module -ListAvailable $moduleName -Verbose:$false | Microsoft.PowerShell.Utility\Select-Object -Unique" (Indicator: "Select-Object"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Core\ForEach-Object {New-PSGetItemInfo -SoftwareIdentity $_ -Type $script:PSArtifactTypeModule} |" (Indicator: "ForEach-Object"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Core\ForEach-Object {" (Indicator: "ForEach-Object"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Core\Where-Object {" (Indicator: "Where-Object"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "PackageManagement\Get-Package @PSBoundParameters | Microsoft.PowerShell.Core\ForEach-Object {New-PSGetItemInfo -SoftwareIdentity $_ -Type $script:PSArtifactTypeModule}" (Indicator: "ForEach-Object"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$psgetModuleInfo.Includes.DscResource | Microsoft.PowerShell.Core\ForEach-Object {" (Indicator: "ForEach-Object"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$psgetModuleInfo.Includes.Command | Microsoft.PowerShell.Core\ForEach-Object {" (Indicator: "ForEach-Object"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$psgetModuleInfo.Includes.RoleCapability | Microsoft.PowerShell.Core\ForEach-Object {" (Indicator: "ForEach-Object"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Select-Object -First 1" (Indicator: "Select-Object"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Core\Where-Object {$_.Name -eq $scriptName} |" (Indicator: "Where-Object"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Core\Where-Object {$_ -eq $scriptFilePath }" (Indicator: "Where-Object"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$scriptFilePathsToUpdate = $installedScriptFilePaths | Microsoft.PowerShell.Core\Where-Object {" (Indicator: "Where-Object"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "PackageManagement\Get-Package @PSBoundParameters | Microsoft.PowerShell.Core\ForEach-Object {New-PSGetItemInfo -SoftwareIdentity $_ -Type $script:PSArtifactTypeScript}" (Indicator: "ForEach-Object"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp")6c:T1688,Found string "tion Get-FileHash" (Indicator: "Get-FileHash"; Source: "00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp") Found string "$telemetryMethods = ([Microsoft.PowerShell.Commands.PowerShellGet.Telemetry] | Get-Member -Static).Name" (Indicator: "Get-Member"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$moduleSource = Get-PSRepository -Name $Repository -ErrorAction SilentlyContinue -WarningAction SilentlyContinue" (Indicator: "Get-PSRepository"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$moduleSource = Get-PSRepository -Name $Repository -ErrorVariable ev" (Indicator: "Get-PSRepository"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$module = Microsoft.PowerShell.Core\Get-Module -ListAvailable -Name $Name -Verbose:$false |" (Indicator: "Get-Module"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$module = Microsoft.PowerShell.Core\Get-Module -Name $resolvedPath -ListAvailable -ErrorAction SilentlyContinue -Verbose:$false" (Indicator: "Get-Module"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "# Use Find-Script to check if that name is already used as scriptname" (Indicator: "Find-Script"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$scriptPSGetItemInfo = Find-Script @FindParameters |" (Indicator: "Find-Script"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$currentPSGetItemInfo = Find-Module @FindParameters |" (Indicator: "Find-Module"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "function Find-Module" (Indicator: "Find-Module"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$null = Get-PSRepository -Name $Repository -ErrorVariable ev -verbose:$false" (Indicator: "Get-PSRepository"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$psgalleryRepo = Get-PSRepository -Name $Script:PSGalleryModuleSource `" (Indicator: "Get-PSRepository"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$installationPolicy = (Get-PSRepository -Name $source).InstallationPolicy" (Indicator: "Get-PSRepository"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$availableModules = Get-Module -ListAvailable $moduleName -Verbose:$false | Microsoft.PowerShell.Utility\Select-Object -Unique" (Indicator: "Get-Module"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "function Get-InstalledModule" (Indicator: "Get-InstalledModule"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "function Find-DscResource" (Indicator: "Find-DscResource"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "PowerShellGet\Find-Module @PSBoundParameters |" (Indicator: "Find-Module"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "#region Find-Command cmdlet" (Indicator: "Find-Command"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "function Find-Command" (Indicator: "Find-Command"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "#endregion Find-Command cmdlet" (Indicator: "Find-Command"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "#region Find-RoleCapability cmdlet" (Indicator: "Find-RoleCapability"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "function Find-RoleCapability" (Indicator: "Find-RoleCapability"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "#endregion Find-RoleCapability cmdlet" (Indicator: "Find-RoleCapability"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$repo = Get-PSRepository -Name $Repository -ErrorAction SilentlyContinue -WarningAction SilentlyContinue" (Indicator: "Get-PSRepository"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "$repo = Get-PSRepository -Name $Repository -ErrorVariable ev" (Indicator: "Get-PSRepository"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp")6d:T199d,Found string "%PROGRAMFILES(X86)%\KMSAutoS\bin\driver\x86TAP1\devcon.exe" (Indicator: "\driver\"; Source: "00000000-00003556-00000C2B-219571759") Found string "%PROGRAMFILES(X86)%\KMSAutoS\bin\driver\x86TAP2\devcon.exe" (Indicator: "\driver\"; Source: "00000000-00003556-00000C2B-219683853") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00000468.00000001.87861.00500000.00000004.mdmp, 00000000-00002332.00000000.86829.00280000.00000004.mdmp, 00000000-00002332.00000001.88751.00280000.00000004.mdmp, 00000000-00002332.00000002.89745.00280000.00000004.mdmp, 00000000-00003064.00000001.90201.00610000.00000004.mdmp, 00000000-00003560.00000000.86765.00320000.00000004.mdmp, 00000000-00003560.00000001.88687.00320000.00000004.mdmp, 00000000-00003560.00000002.90611.00320000.00000004.mdmp, 00000000-00004068.00000000.90323.00200000.00000004.mdmp, 00000000-00004604.00000000.81976.00560000.00000004.mdmp, 00000000-00004604.00000001.82212.00560000.00000004.mdmp, 00000000-00005300.00000001.84746.002A0000.00000004.mdmp, 00000000-00005568.00000001.87057.00420000.00000004.mdmp") Found string "\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00000468.00000001.87861.00500000.00000004.mdmp, 00000000-00004604.00000001.82212.00560000.00000004.mdmp, 00000000-00005300.00000001.84746.002A0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\WINDOW~1\v1.0\powershell.exe" (Indicator: "\Device\"; Source: "00000000-00002332.00000000.86829.00280000.00000004.mdmp, 00000000-00003560.00000000.86765.00320000.00000004.mdmp, 00000000-00004068.00000000.90323.00200000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00002332.00000000.86829.00280000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00002332.00000000.86829.00280000.00000004.mdmp, 00000000-00002332.00000001.88751.00280000.00000004.mdmp, 00000000-00002916.00000001.84169.004F0000.00000004.mdmp, 00000000-00003064.00000001.90201.00610000.00000004.mdmp, 00000000-00003560.00000000.86765.00320000.00000004.mdmp, 00000000-00003560.00000001.88687.00320000.00000004.mdmp, 00000000-00003560.00000002.90611.00320000.00000004.mdmp, 00000000-00004068.00000000.90323.00200000.00000004.mdmp, 00000000-00004604.00000000.81976.00560000.00000004.mdmp, 00000000-00005568.00000001.87057.00420000.00000004.mdmp, 00000000-00005568.00000002.87218.00420000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00002332.00000000.86829.00280000.00000004.mdmp, 00000000-00002332.00000001.88751.00280000.00000004.mdmp, 00000000-00002332.00000002.89745.00280000.00000004.mdmp, 00000000-00002916.00000001.84169.004F0000.00000004.mdmp, 00000000-00003064.00000001.90201.00610000.00000004.mdmp, 00000000-00003560.00000000.86765.00320000.00000004.mdmp, 00000000-00003560.00000001.88687.00320000.00000004.mdmp, 00000000-00003560.00000002.90611.00320000.00000004.mdmp, 00000000-00004068.00000000.90323.00200000.00000004.mdmp, 00000000-00004604.00000000.81976.00560000.00000004.mdmp, 00000000-00005300.00000001.84746.002A0000.00000004.mdmp, 00000000-00005568.00000001.87057.00420000.00000004.mdmp, 00000000-00005568.00000002.87218.00420000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00002332.00000000.86829.00280000.00000004.mdmp, 00000000-00002332.00000001.88751.00280000.00000004.mdmp, 00000000-00002332.00000002.89745.00280000.00000004.mdmp, 00000000-00002916.00000001.84169.004F0000.00000004.mdmp, 00000000-00003064.00000001.90201.00610000.00000004.mdmp, 00000000-00003560.00000000.86765.00320000.00000004.mdmp, 00000000-00003560.00000001.88687.00320000.00000004.mdmp, 00000000-00003560.00000002.90611.00320000.00000004.mdmp, 00000000-00004068.00000000.90323.00200000.00000004.mdmp, 00000000-00004604.00000000.81976.00560000.00000004.mdmp, 00000000-00004604.00000001.82212.00560000.00000004.mdmp, 00000000-00005300.00000001.84746.002A0000.00000004.mdmp, 00000000-00005568.00000001.87057.00420000.00000004.mdmp, 00000000-00005568.00000002.87218.00420000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00002332.00000000.86829.00280000.00000004.mdmp, 00000000-00002332.00000001.88751.00280000.00000004.mdmp, 00000000-00002916.00000001.84169.004F0000.00000004.mdmp, 00000000-00003064.00000001.90201.00610000.00000004.mdmp, 00000000-00003560.00000000.86765.00320000.00000004.mdmp, 00000000-00003560.00000001.88687.00320000.00000004.mdmp, 00000000-00003560.00000002.90611.00320000.00000004.mdmp, 00000000-00004068.00000000.90323.00200000.00000004.mdmp, 00000000-00004604.00000000.81976.00560000.00000004.mdmp, 00000000-00004604.00000001.82212.00560000.00000004.mdmp, 00000000-00005300.00000001.84746.002A0000.00000004.mdmp, 00000000-00005568.00000001.87057.00420000.00000004.mdmp, 00000000-00005568.00000002.87218.00420000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002332.00000000.86829.00280000.00000004.mdmp, 00000000-00002332.00000001.88751.00280000.00000004.mdmp, 00000000-00002916.00000001.84169.004F0000.00000004.mdmp, 00000000-00003064.00000001.90201.00610000.00000004.mdmp, 00000000-00003560.00000000.86765.00320000.00000004.mdmp, 00000000-00003560.00000001.88687.00320000.00000004.mdmp, 00000000-00003560.00000002.90611.00320000.00000004.mdmp, 00000000-00004068.00000000.90323.00200000.00000004.mdmp, 00000000-00004604.00000000.81976.00560000.00000004.mdmp, 00000000-00005300.00000001.84746.002A0000.00000004.mdmp, 00000000-00005568.00000001.87057.00420000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00002332.00000001.88751.00280000.00000004.mdmp, 00000000-00002332.00000002.89745.00280000.00000004.mdmp, 00000000-00002916.00000000.82579.004F0000.00000004.mdmp, 00000000-00002916.00000001.84169.004F0000.00000004.mdmp, 00000000-00003064.00000001.90201.00610000.00000004.mdmp, 00000000-00003560.00000001.88687.00320000.00000004.mdmp, 00000000-00003560.00000002.90611.00320000.00000004.mdmp, 00000000-00005568.00000000.85134.00420000.00000004.mdmp, 00000000-00005568.00000001.87057.00420000.00000004.mdmp, 00000000-00005568.00000002.87218.00420000.00000004.mdmp")6e:T7a1,"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGHEAPFLAGS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGFLAGS"; Value: "")6f:T59c,"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0000000000") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0100000000") "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELL\OPEN\COMMAND"; Key: "(DEFAULT)"; Value: "%WINDIR%\svchost.com "%1" %*"), "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\137\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US"), "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0000000000"), "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0100000000"), "61D0FA~1.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0000000000"), "61D0FA~1.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0100000000")70:T483,Found string "Microsoft.PowerShell.Utility\Out-File -FilePath $script:PSGetSettingsFilePath -Force `" (Indicator: "Out-File"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Out-File -FilePath $script:PSGetModuleSourcesFilePath -Force -InputObject ([System.Management.Automation.PSSerializer]::Serialize($script:PSGetModuleSources))" (Indicator: "Out-File"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Out-File -FilePath $scriptInfopath `" (Indicator: "Out-File"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Out-File -FilePath $psgetItemInfopath -Force -InputObject ([System.Management.Automation.PSSerializer]::Serialize($PSGetItemInfo))" (Indicator: "Out-File"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp")71:Td46,Found string "Microsoft.PowerShell.Core\Set-StrictMode -Version Latest" (Indicator: "Set-StrictMode"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "function Update-Module" (Indicator: "Update-Module"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "function Update-Script" (Indicator: "Update-Script"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Set-Variable -Name selctedProviderName -value $null -Scope 1" (Indicator: "Set-Variable"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "Set-Variable -Name PackageManagementProvider -Value $selctedProviderName -Scope 1" (Indicator: "Set-Variable"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "function Set-PSRepository" (Indicator: "Set-PSRepository"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "function Update-ScriptFileInfo" (Indicator: "Update-Script"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "function Update-ScriptFileInfo" (Indicator: "Update-ScriptFileInfo"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "# Use existing values if any of the parameters are not specified during Update-ScriptFileInfo" (Indicator: "Update-Script"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "# Use existing values if any of the parameters are not specified during Update-ScriptFileInfo" (Indicator: "Update-ScriptFileInfo"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "# Keep the existing provider options if not specified in Set-PSRepository" (Indicator: "Set-PSRepository"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "function Update-ModuleManifest" (Indicator: "Update-Module"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "function Update-ModuleManifest" (Indicator: "Update-ModuleManifest"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "# This enables the users to use Update-ModuleManifest cmdlet to update the metadata." (Indicator: "Update-Module"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp") Found string "# This enables the users to use Update-ModuleManifest cmdlet to update the metadata." (Indicator: "Update-ModuleManifest"; Source: "00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp")72:T6ac,Dropped file: "pythonw.exe" - Location: [%LOCALAPPDATA%\Programs\Python\PYTHON~2\Lib\venv\scripts\nt\pythonw.exe]- [targetUID: 00000000-00003556] Dropped file: "gui-64.exe" - Location: [%LOCALAPPDATA%\Programs\Python\PYTHON~2\Lib\SITE-P~1\SETUPT~1\gui-64.exe]- [targetUID: 00000000-00003556] Dropped file: "python.exe" - Location: [%LOCALAPPDATA%\Programs\Python\PYTHON~2\python.exe]- [targetUID: 00000000-00003556] Dropped file: "pythonw.exe" - Location: [%LOCALAPPDATA%\Programs\Python\PYTHON~2\pythonw.exe]- [targetUID: 00000000-00003556] Dropped file: "PIP38~1.EXE" - Location: [%LOCALAPPDATA%\Programs\Python\PYTHON~2\Scripts\PIP38~1.EXE]- [targetUID: 00000000-00003280] Dropped file: "D2Q972V9L0DME0SRKDHU.temp" - Location: [%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\D2Q972V9L0DME0SRKDHU.temp]- [targetUID: 00000000-00001160] Dropped file: "StartupProfileData-NonInteractive" - Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00001160] Dropped file: "eiVfWxqyEFoV.exe" - Location: [%APPDATA%\eiVfWxqyEFoV.exe]- [targetUID: 00000000-00003556] Dropped file: "pip3.exe" - Location: [%LOCALAPPDATA%\Programs\Python\PYTHON~2\Scripts\pip3.exe]- [targetUID: 00000000-00003556] Dropped file: "pip.exe" - Location: [%LOCALAPPDATA%\Programs\Python\PYTHON~2\Scripts\pip.exe]- [targetUID: 00000000-00003556] Dropped file: "gui.exe" - Location: [%LOCALAPPDATA%\Programs\Python\PYTHON~2\Lib\SITE-P~1\SETUPT~1\gui.exe]- [targetUID: 00000000-00003556] Dropped file: "FH8YCUY4Y857AKKF9M5J.temp" - Location: [%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\FH8YCUY4Y857AKKF9M5J.temp]- [targetUID: 00000000-00004148]73:T81d,"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e" has a PE timestamp using the buggy magic timestamp 0x2A425E19. "setup.exe" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Fri May 9 21:17:17 1997 "dwtrig20.exe" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Thu Jan 1 00:00:00 1970 "python.exe" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Fri May 9 21:17:17 1997 "pythonw.exe" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Fri May 9 21:17:17 1997 "KMSSS.exe" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Fri May 9 21:17:17 1997 "OneDrive.exe" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Fri May 9 21:17:17 1997 "javaws.exe" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Fri May 9 21:17:17 1997 "javaw.exe" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Fri May 9 21:17:17 1997 "java.exe" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Fri May 9 21:17:17 1997 "ose.exe" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Fri May 9 21:17:17 1997 "gui-64.exe" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Fri May 9 21:17:17 1997 "t64.exe" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Fri May 9 21:17:17 1997 "w64.exe" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Fri May 9 21:17:17 1997 "t32.exe" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Fri May 9 21:17:17 199774:T457,"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini"75:T1f37,"setup.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\3582-490\61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe]- [targetUID: 00000000-00003556] "dwtrig20.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "python.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "pythonw.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [%LOCALAPPDATA%\Programs\Python\PYTHON~2\Lib\venv\scripts\nt\pythonw.exe]- [targetUID: 00000000-00003556] "KMSSS.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "OneDrive.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "javaws.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [%ALLUSERSPROFILE%\Oracle\Java\javapath_target_623756\javaws.exe]- [targetUID: 00000000-00003556] "javaw.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [%ALLUSERSPROFILE%\Oracle\Java\javapath_target_623756\javaw.exe]- [targetUID: 00000000-00003556] "java.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [%ALLUSERSPROFILE%\Oracle\Java\javapath_target_623756\java.exe]- [targetUID: 00000000-00003556] "ose.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "gui-64.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [%LOCALAPPDATA%\Programs\Python\PYTHON~2\Lib\SITE-P~1\SETUPT~1\gui-64.exe]- [targetUID: 00000000-00003556] "t64.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "w64.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "python.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [%LOCALAPPDATA%\Programs\Python\PYTHON~2\python.exe]- [targetUID: 00000000-00003556] "pythonw.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [%LOCALAPPDATA%\Programs\Python\PYTHON~2\pythonw.exe]- [targetUID: 00000000-00003556] "t32.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "pythonw.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "w32.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "pip.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "devcon.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "gui-64.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "cli-64.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "gui-32.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "cli.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "TOR-GE~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "CHROME~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "PYTHON~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "INTEGR~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "DW20.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "VC_RED~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "WININS~4.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "WININS~3.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "ADOBEA~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "AIRAPP~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "WI5DE4~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "WININS~2.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "WI02EA~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "WININS~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "FILESY~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "NORMAL~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "PIP38~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [%LOCALAPPDATA%\Programs\Python\PYTHON~2\Scripts\PIP38~1.EXE]- [targetUID: 00000000-00003280] "EASY_I~2.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "WI5ED8~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "WI2335~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "WIC467~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "SVCHOST.COM.6A8DE18A.bin" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "eiVfWxqyEFoV.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%APPDATA%\eiVfWxqyEFoV.exe]- [targetUID: 00000000-00003556] "pip3.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [%LOCALAPPDATA%\Programs\Python\PYTHON~2\Scripts\pip3.exe]- [targetUID: 00000000-00003556] "pip.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [%LOCALAPPDATA%\Programs\Python\PYTHON~2\Scripts\pip.exe]- [targetUID: 00000000-00003556] "pip3.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "gui.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "gui.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [%LOCALAPPDATA%\Programs\Python\PYTHON~2\Lib\SITE-P~1\SETUPT~1\gui.exe]- [targetUID: 00000000-00003556] "cli-32.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: 00000000-00003556] "svchost.com" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [%WINDIR%\svchost.com]- [targetUID: 00000000-00003556] "EASY_I~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "PIP36~1.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "SVCHOST.COM.6A8DB95C.bin" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "SVCHOST.COM.6A8DDEC1.bin" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A]76:T99f7,"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\3582-490\61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Windows\svchost.com": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\ProgramData\Adobe\ARM\S\27490\AdobeARMHelper.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\ProgramData\KMSAutoS\bin\driver\x86TAP1\devcon.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\ProgramData\KMSAutoS\bin\driver\x86TAP2\devcon.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\ProgramData\KMSAutoS\bin\KMSSS.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\ProgramData\KMSAutoS\KMSAuto Net.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\ProgramData\Oracle\Java\javapath_target_623756\java.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\ProgramData\Oracle\Java\javapath_target_623756\javaw.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\ProgramData\Oracle\Java\javapath_target_623756\javaws.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\ProgramData\Package Cache\{410c0ee1-00bb-41b6-9772-e12c2828b02f}\VC_redist.x86.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\TorService\tor\pluggable_transports\obfs4proxy.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\TorService\tor\tor-gencert.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\TorService\tor\tor.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncConfig.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\OneDriveSetup.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Microsoft\OneDrive\OneDrive.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QQW0X29Y\ChromeSetup.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Package Cache\{1bb10b8c-6e63-4897-9fb2-3873ce30d7e1}\python-3.6.3.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Package Cache\{85379532-0003-4517-8fc4-6227b410c30c}\python-3.8.10.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python36-32\Lib\distutils\command\wininst-10.0-amd64.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python36-32\Lib\distutils\command\wininst-10.0.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python36-32\Lib\distutils\command\wininst-14.0-amd64.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python36-32\Lib\distutils\command\wininst-14.0.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python36-32\Lib\distutils\command\wininst-6.0.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python36-32\Lib\distutils\command\wininst-7.1.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python36-32\Lib\distutils\command\wininst-8.0.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python36-32\Lib\distutils\command\wininst-9.0-amd64.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python36-32\Lib\distutils\command\wininst-9.0.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python36-32\Lib\site-packages\pip\_vendor\distlib\t32.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python36-32\Lib\site-packages\pip\_vendor\distlib\t64.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python36-32\Lib\site-packages\pip\_vendor\distlib\w32.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python36-32\Lib\site-packages\pip\_vendor\distlib\w64.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python36-32\Lib\site-packages\setuptools\cli-32.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python36-32\Lib\site-packages\setuptools\cli-64.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python36-32\Lib\site-packages\setuptools\cli.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python36-32\Lib\site-packages\setuptools\gui-32.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python36-32\Lib\site-packages\setuptools\gui-64.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python36-32\Lib\site-packages\setuptools\gui.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python36-32\python.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python36-32\pythonw.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python36-32\Scripts\easy_install-3.6.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python36-32\Scripts\easy_install.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python36-32\Scripts\pip.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python36-32\Scripts\pip3.6.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python36-32\Scripts\pip3.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python38-32\Lib\distutils\command\wininst-10.0-amd64.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python38-32\Lib\distutils\command\wininst-10.0.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python38-32\Lib\distutils\command\wininst-14.0-amd64.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python38-32\Lib\distutils\command\wininst-14.0.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python38-32\Lib\distutils\command\wininst-6.0.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python38-32\Lib\distutils\command\wininst-7.1.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python38-32\Lib\distutils\command\wininst-8.0.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python38-32\Lib\distutils\command\wininst-9.0-amd64.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python38-32\Lib\distutils\command\wininst-9.0.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python38-32\Lib\site-packages\pip\_vendor\distlib\t32.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python38-32\Lib\site-packages\pip\_vendor\distlib\t64.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python38-32\Lib\site-packages\pip\_vendor\distlib\w32.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python38-32\Lib\site-packages\pip\_vendor\distlib\w64.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python38-32\Lib\site-packages\pythonwin\Pythonwin.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python38-32\Lib\site-packages\setuptools\cli-32.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python38-32\Lib\site-packages\setuptools\cli-64.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python38-32\Lib\site-packages\setuptools\cli.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python38-32\Lib\site-packages\setuptools\gui-32.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python38-32\Lib\site-packages\setuptools\gui-64.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python38-32\Lib\site-packages\setuptools\gui.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python38-32\Lib\venv\scripts\nt\python.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python38-32\Lib\venv\scripts\nt\pythonw.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python38-32\pythonw.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python38-32\Scripts\pip.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python38-32\Scripts\pip3.8.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python38-32\Scripts\pip3.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "svchost.com" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python38-32\Lib\site-packages\setuptools\gui-64.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "svchost.com" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python38-32\python.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "svchost.com" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python38-32\Scripts\normalizer.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ...77:T42c,"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tmpA312.tmp" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF12a6d9.TMP" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\jyjf524l.1yu.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\aer2aixr.kmk.psm1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF12b5b7.TMP" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\wgnjlu2q.acp.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\vrf030o2.c5x.psm1" for deletion "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\3582-490\61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" for deletion78:T458,Wrote 126 instructions to a remote process Wrote 22 instructions to a remote process Wrote 14 instructions to a remote process Wrote 30 instructions to a remote process Wrote 3 instructions to a remote process Wrote 71 instructions to a remote process Wrote 1 instructions to a remote process Wrote 39 instructions to a remote process Wrote 37 instructions to a remote process Wrote 38 instructions to a remote process Wrote 21 instructions to a remote process Wrote 4 instructions to a remote process Wrote 95 instructions to a remote process Wrote 16 instructions to a remote process Wrote 9 instructions to a remote process Wrote 7 instructions to a remote process Wrote 10 instructions to a remote process Wrote 2 instructions to a remote process Wrote 409 instructions to a remote process Wrote 201 instructions to a remote process Wrote 27 instructions to a remote process Wrote 6 instructions to a remote process Wrote 13 instructions to a remote process Wrote 35 instructions to a remote process Wrote 17 instructions to a remote process Wrote 56 instructions to a remote process79:T751,26/27 Antivirus vendors marked dropped file "dwtrig20.exe" as malicious (classified as "Virus.Neshta" with 96% detection rate) 21/23 Antivirus vendors marked dropped file "setup.exe" as malicious (classified as "Virus.Neshta" with 91% detection rate) 22/23 Antivirus vendors marked dropped file "python.exe" as malicious (classified as "Virus.Neshta" with 95% detection rate) 20/23 Antivirus vendors marked dropped file "pythonw.exe" as malicious (classified as "Virus.Neshta" with 86% detection rate) 22/24 Antivirus vendors marked dropped file "KMSSS.exe" as malicious (classified as "Virus.Neshta" with 91% detection rate) 24/27 Antivirus vendors marked dropped file "OneDrive.exe" as malicious (classified as "Virus.Neshta" with 88% detection rate) 25/28 Antivirus vendors marked dropped file "javaws.exe" as malicious (classified as "Virus.Neshta" with 89% detection rate) 22/23 Antivirus vendors marked dropped file "javaw.exe" as malicious (classified as "Virus.Neshta" with 95% detection rate) 20/23 Antivirus vendors marked dropped file "java.exe" as malicious (classified as "Virus.Neshta" with 86% detection rate) 26/27 Antivirus vendors marked dropped file "ose.exe" as malicious (classified as "Virus.Neshta" with 96% detection rate) 25/27 Antivirus vendors marked dropped file "t64.exe" as malicious (classified as "Virus.Neshta" with 92% detection rate) 20/27 Antivirus vendors marked dropped file "w64.exe" as malicious (classified as "Virus.Neshta" with 74% detection rate) 24/27 Antivirus vendors marked dropped file "t64.exe" as malicious (classified as "Virus.Neshta" with 88% detection rate) 22/23 Antivirus vendors marked dropped file "pip.exe" as malicious (classified as "Virus.Neshta" with 95% detection rate) 25/27 Antivirus vendors marked dropped file "gui-32.exe" as malicious (classified as "Virus.Neshta" with 92% detection rate)7a:T6f1,Spawned process "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (UID: 00000000-00003556) Spawned process "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (UID: 00000000-00004028) Spawned process "svchost.com" with commandline ""%WINDIR%\\System32\\WINDOW~1\\v1.0\\powershell.exe" Add-MpPreference -ExclusionPath "%TEMP%\\3582-490\\61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe"" (UID: 00000000-00003280) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath %TEMP%\\3582-490\\61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (UID: 00000000-00004148) Spawned process "svchost.com" with commandline ""%WINDIR%\\System32\\WINDOW~1\\v1.0\\powershell.exe" Add-MpPreference -ExclusionPath "%APPDATA%\\eiVfWxqyEFoV.exe"" (UID: 00000000-00001372) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath %APPDATA%\\eiVfWxqyEFoV.exe" (UID: 00000000-00001160) Spawned process "svchost.com" with commandline ""%WINDIR%\\System32\\schtasks.exe" /Create /TN "Updates\\eiVfWxqyEFoV" /XML "%TEMP%\\tmpA312.tmp"" (UID: 00000000-00002768) Spawned process "schtasks.exe" with commandline "/Create /TN Updates\\eiVfWxqyEFoV /XML %TEMP%\\tmpA312.tmp" (UID: 00000000-00002724) Spawned process "61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe" (UID: 00000000-00004296) Spawned process "svchost.com" with commandline ""%TEMP%\\3582-490\\61D0FA~1.EXE"" (UID: 00000000-00001416) Spawned process "61D0FA~1.EXE" (UID: 00000000-00002580) Spawned process "svchost.com" with commandline ""%WINDIR%\\System32\\WINDOW~1\\v1.0\\powershell.exe" Add-MpPreference -ExclusionPath "%TEMP%\\3582-490\\61D0FA~1.EXE"" (UID: 00000000-00004484)7b:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790908760746,"unified_at":"2026-10-02T02:39:20.746Z","metadata":{"hashes":{"sha256":"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","sha1":"c6a8abd742fe2cd2eeefe2a0ee5d55b28120684c","md5":"23e6c75cd60aae58526c9bd734324ddf","sha512":"3746d9803a01c5701f944a3197c57f96a56e9b6f4ea2c0da20f5be4a8f4a6e89f86214110baea3762b29c43af8b64331d5c3ebf6583aa949f8ce9db07c27ce31","ssdeep":"24576:Z3tCNVECr4YOprbXj64us/OboCCk8C0CaV2j:Z9CNZyprbXG4ujo5k8C0bVI","ssdeep_chunks":["24576:Z3tCNVE","24576:3tCNVEC","24576:tCNVECr","24576:CNVECr4","24576:NVECr4Y","24576:VECr4YO","24576:ECr4YOp","24576:Cr4YOpr","24576:r4YOprb","24576:4YOprbX","24576:YOprbXj","24576:OprbXj6","24576:prbXj64","24576:rbXj64u","24576:bXj64us","24576:Xj64us/","24576:j64us/O","24576:64us/Ob","24576:4us/Obo","24576:us/OboC","24576:s/OboCC","24576:/OboCCk","24576:OboCCk8","24576:boCCk8C","24576:oCCk8C0","24576:CCk8C0C","24576:Ck8C0Ca","24576:k8C0CaV","24576:8C0CaV2","24576:C0CaV2j","49152:Z3tCNVE","49152:3tCNVEC","49152:tCNVECr","49152:CNVECr4","49152:NVECr4Y","49152:VECr4YO","49152:ECr4YOp","49152:Cr4YOpr","49152:r4YOprb","49152:4YOprbX","49152:YOprbXj","49152:OprbXj6","49152:prbXj64","49152:rbXj64u","49152:bXj64us","49152:Xj64us/","49152:j64us/O","49152:64us/Ob","49152:4us/Obo","49152:us/OboC","49152:s/OboCC","49152:/OboCCk","49152:OboCCk8","49152:boCCk8C","49152:oCCk8C0","49152:CCk8C0C","49152:Ck8C0Ca","49152:k8C0CaV","49152:8C0CaV2","49152:C0CaV2j","24576:Z9CNZyp","24576:9CNZypr","24576:CNZyprb","24576:NZyprbX","24576:ZyprbXG","24576:yprbXG4","24576:prbXG4u","24576:rbXG4uj","24576:bXG4ujo","24576:XG4ujo5","24576:G4ujo5k","24576:4ujo5k8","24576:ujo5k8C","24576:jo5k8C0","24576:o5k8C0b","24576:5k8C0bV","24576:k8C0bVI"],"imphash":"9f4693fc0c511135129493f2161d1e86","pehash":"ecd805fb2a9d0e75887cd92359d8b4942b3a1fc9"},"file_info":{"file_name":"bounty-55440007270979826","file_type":["peexe","executable"],"file_type_id":"exe","file_size":837632,"entropy":7.84,"compile_timestamp":"1992-06-19T22:22:17","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1720904862000,"last_seen":1788075735000,"last_multi_scan":1788075735000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":8,"import_count":0,"export_count":0,"embedded_file_count":5,"sections":[{"name":"CODE","virtual_address":"0x1000","virtual_size":29376,"raw_size":29696},{"name":"DATA","virtual_address":"0x9000","virtual_size":536,"raw_size":1024},{"name":"BSS","virtual_address":"0xa000","virtual_size":43161},{"name":".idata","virtual_address":"0x15000","virtual_size":2148,"raw_size":2560},{"name":".tls","virtual_address":"0x16000","virtual_size":8},{"name":".rdata","virtual_address":"0x17000","virtual_size":24,"raw_size":512},{"name":".reloc","virtual_address":"0x18000","virtual_size":1484,"raw_size":1536},{"name":".rsrc","virtual_address":"0x19000","virtual_size":5120,"raw_size":5120}],"section_names":["CODE","DATA","BSS",".idata",".tls",".rdata",".reloc",".rsrc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":90},"sandbox_signatures":{"informative_count":239,"suspicious_count":13,"malicious_count":14,"total":266},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win32/Neshta","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.IRCBot","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"W32/Delf.L","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Win32.Nestha.C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packed.Pwsx-10033231-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Win32.Nestha.C (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Neshta.B virus","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"W32.Neshta.b.auq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Virus.Win32.Neshta.zv!s1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Virus/Neshta.b","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Virus ( 00556e571 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"malicious","threat_name":"Virus.Win32.Neshta.tntj","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"W32/Neshta-D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"W32/HLLP.41472","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/HLLP.EPJG-6217","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Win32.Delf.FF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Win32.Neshta.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Virus.Neshta.Win32.2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Virus.Neshta","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language"},{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Able to retrieve default system language settings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to create/modify item values (Powershell command string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Defense Evasion","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"},{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Able to delete items (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"malicious","value":"Calls an API typically used to run the specified application"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to start a process (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to retrieve file and directory information"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access recent files"},{"type":"informative","value":"Creates file in AppData directory"},{"type":"informative","value":"Able to retrieve the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Defense Evasion","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Writes shellcode to a remote process"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to download and install modules (Powershell command string)"},{"type":"informative","value":"Contains ability to get content from a webpage (Powershell command string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Writes a PE file header to disc"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Reconnaissance","technique":"Vulnerability Scanning","attack_id":"T1595.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1595/002","identifiers":[{"type":"informative","value":"Able to use vulnerability or port scanning tools"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"YARA signature match - PowerShell file content"},{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Command line contains PowerShell"},{"type":"informative","value":"Able to build PowerShell events through modules contained in the .NET code"},{"type":"informative","value":"Able to write/modify file content (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"},{"type":"malicious","value":"Schedules a task to be executed from task XML file"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Able to obtain instances of WMI classes using PowerShell"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Execution","technique":"Software Deployment Tools","attack_id":"T1072","attack_id_wiki":"https://attack.mitre.org/techniques/T1072","identifiers":[{"type":"informative","value":"Contains reference to software packages activity (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"},{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"},{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Contains reference to Hijacked CLSID(s)"},{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Persistence","technique":"Path Interception by PATH Environment Variable","attack_id":"T1574.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/007","identifiers":[{"type":"informative","value":"References PATH environment registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Persistence","technique":"BITS Jobs","attack_id":"T1197","attack_id_wiki":"https://attack.mitre.org/techniques/T1197","identifiers":[{"type":"informative","value":"Contains reference to background jobs (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Persistence","technique":"Change Default File Association","attack_id":"T1546.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/001","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Modifies windows command shell related registry path (UAC Bypass)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decompress files using PowerShell"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Tries to map intranet network resources to internet zone"},{"type":"informative","value":"Able to modify Windows Defender exclusions (Powershell command string)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Contains ability to delete a property and its value from an item (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to load content from resource"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"YARA signature match – high entropy image embedded in .NET resource"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Able to detect virtual machine (string)"},{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Defense Evasion","technique":"Clear Windows Event Logs","attack_id":"T1070.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/001","identifiers":[{"type":"informative","value":"Able to remove event log (PowerShell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the application program directory (%ProgramData%)"},{"type":"malicious","value":"Drops executable files to the Windows system directory"},{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Defense Evasion","technique":"Masquerade Task or Service","attack_id":"T1036.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/004","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"},{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate logical drives on the computer"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve security identifier (.NET)"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user names for specified SIDs"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to test network connectivity (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Lateral Movement","technique":"Cloud Services","attack_id":"T1021.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/007","identifiers":[{"type":"informative","value":"Able to connect to a cloud service"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move items (Powershell command string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$25","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\"), Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\Borland\\Delphi\\RTL\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"WinExec\" (Indicator: \"WinExec\"; Source: \"sample.bin\"), Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1222","id":"string-426","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesA\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"sample.bin\"), Found reference to API \"GetTempPathA\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-80","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExA\" in \"sample.bin\", Found registry query API: \"RegOpenKeyExA\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDIBits\" (Indicator: \"GetDIBits\"; Source: \"sample.bin\"), Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"sample.bin\"), Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; Source: \"sample.bin\"), Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"sample.bin\"), Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-730","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-84","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"password\" (Indicator: \"password\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-201","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardType\" (Indicator: \"GetKeyboardType\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614.001","id":"string-143","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-312","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-304","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"sample.bin\"), Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"www.inkscape.org\", Heuristic match: \"q>.tz\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"16.10.0.0\" found in string \"KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator\t16.10.0.0\", \"16.0.0.0\", \"1.0.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"sample.bin\"), Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-354","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to build PowerShell events through modules contained in the .NET code","description":"$26","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-942","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"$27","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to delete items (Powershell command string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-333","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify Windows Defender exclusions (Powershell command string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-980","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to remove event log (PowerShell command string)","description":"Found string \"\"Remove-EventLog\",\" (Source: \"00000000-00002332.00000001.88751.00690000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.001","relevance":1,"id":"string-687","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to write/modify file content (Powershell command string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-331","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"$2b","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"$2c","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00002332.00000001.88751.00090000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002332.00000001.88751.00090000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load content from resource","description":"Observed function \"ResourceManager.GetObject\" in \"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-112","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00000468.00000000.87465.0027E000.00000004.mdmp\n 00000000-00000468.00000001.87861.0027E000.00000004.mdmp\n 00000000-00004604.00000000.81976.001DE000.00000004.mdmp\n 00000000-00004604.00000001.82212.001DE000.00000004.mdmp\n 00000000-00005300.00000000.84449.0017E000.00000004.mdmp\n 00000000-00005300.00000001.84746.0017E000.00000004.mdmp\n 00000000-00005568.00000001.87057.00267000.00000004.mdmp\n 00000000-00005568.00000002.87218.00267000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"System\" and MemberReference \"GetMethods\" in \"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe has big resource with name: \"nu\" size: \"50176\" and abnormal entropy:\"7.99634064510137\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"$2f","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$30","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$31","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"\"powershell.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms\" to \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RF12a6d9.TMP\"\n \"powershell.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\FH8YCUY4Y857AKKF9M5J.temp\" to \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms\"\n \"powershell.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms\" to \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RF12b5b7.TMP\"\n \"powershell.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\D2Q972V9L0DME0SRKDHU.temp\" to \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Tries to map intranet network resources to internet zone","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")\n \"61D0FA~1.EXE\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"powershell.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \"BSS\" is zero\n Raw size of \".tls\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00002332.00000001.88751.01B00000.00000004.mdmp, 00000000-00003560.00000001.88687.017F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$32","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00004148-00000C2C-251034379\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$33","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor esi\n FFFFFFFFh in Stream UID: 00000000-00003556-50057-77-0040FCB0\n Assembly shows XOR instruction xor esi\n FFFFFFFFh in Stream UID: 00000000-00004296-56387-42-00406218\n Assembly shows XOR instruction xor edx\n dword ptr [ecx] in Stream UID: 00000000-00004296-56387-149-00401A3C\n Assembly shows XOR instruction xor ah\n byte ptr [ecx] in Stream UID: 00000000-00004296-56387-255-0040483C\n Assembly shows XOR instruction xor byte ptr [esi]\n al in Stream UID: 00000000-00004296-56387-291-004070D0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00002332.00000001.88751.01C10000.00000004.mdmp, 00000000-00003560.00000001.88687.018F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"$34","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"\" (Indicator: \"public key\"; Source: \"00000000-00002332.00000001.88751.01C60000.00000004.mdmp, 00000000-00002332.00000002.89745.01C60000.00000004.mdmp\")\n Found string \"// Microsoft root public key. If it doesn't contain a Microsoft root\" (Indicator: \"public key\"; Source: \"00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp\")\n Found string \"// public key, dwError is set to CERT_E_UNTRUSTEDROOT.\" (Indicator: \"public key\"; Source: \"00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.80916","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$35","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$36","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Able to detect virtual machine (string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-989","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004028-00000C2C-217270270\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004028-00000C2C-225893794\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"xeVGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp, 00000000-00002916.00000001.84169.02B40000.00000004.mdmp, 00000000-00003064.00000001.90201.02AB0000.00000004.mdmp, 00000000-00003560.00000001.88687.03120000.00000004.mdmp, 00000000-00003560.00000002.90611.03120000.00000004.mdmp, 00000000-00005568.00000001.87057.02B90000.00000004.mdmp, 00000000-00005568.00000002.87218.02B90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004028-00000C2C-217270270\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004028-00000C2C-225893794\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"file/memory contains long string with (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"WI5ED8~1.EXE\")\n file/memory contains long string with (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"WI2335~1.EXE\")\n file/memory contains long string with (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"WIC467~1.EXE\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"file/memory contains long string with (Indicator: \"WTSFreeMemory\"; File: \"javaws.exe\")\n Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00004028-00000C2C-218622816\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Able to obtain instances of WMI classes using PowerShell","description":"Found string \"\"Get-WmiObject\",\" (Source: \"00000000-00002332.00000001.88751.00690000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-696","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"file/memory contains long string with (Indicator: \"CheckTokenMembership\"; File: \"ose.exe\")\n file/memory contains long string with (Indicator: \"CheckTokenMembership\"; File: \"ADOBEA~1.EXE\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00003556-00000C2C-211027870\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003556-00000C2C-211028073\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00003556-00000C2C-211028426\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004028-00000C2C-225782310\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve default system language settings","description":"Found string \"$script:TextInfo = (Get-Culture).TextInfo\" (Source: \"00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-655","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve file and directory information","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-726","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00002332.00000001.88751.00090000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"file/memory contains long string with (Indicator: \"postmessage\"; File: \"pythonw.exe\")\n file/memory contains long string with (Indicator: \"findwindow\"; File: \"ADOBEA~1.EXE\")\n file/memory contains long string with (Indicator: \"sendmessage\"; File: \"WININS~1.EXE\")\n file/memory contains long string with (Indicator: \"sendmessage\"; File: \"WI5ED8~1.EXE\")\n file/memory contains long string with (Indicator: \"sendmessage\"; File: \"WI2335~1.EXE\")\n file/memory contains long string with (Indicator: \"sendmessage\"; File: \"WIC467~1.EXE\")\n Found reference to API \"PostMessage\" (Indicator: \"postmessage\"; Source: \"00000000-00004028-00000C2C-245117518\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00004028-00000C2C-245117591\")\n Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00004148-00000C2C-237091268\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00004148-00000C2C-237091348\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" called \"GetWriteWatch\" with parameters (UID: 00000000-00004028)\n \"61D0FA~1.EXE\" called \"GetWriteWatch\" with parameters (UID: 00000000-00002580)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00003556)\n \"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00003556)\n \"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00003556)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003556)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003556)\n \"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" called \"GetForegroundWindow\" (UID: 00000000-00004028)\n \"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" called \"GetForegroundWindow\" (UID: 00000000-00004296)\n \"61D0FA~1.EXE\" called \"GetForegroundWindow\" (UID: 00000000-00002580)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" called \"IsWow64Process\" with parameter \"3556\" - (UID: 00000000-00003556)\n \"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" called \"IsWow64Process\" with parameter \"4028\" - (UID: 00000000-00004028)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"4148\" - (UID: 00000000-00004148)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00004148)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00001160)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003556)\n \"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004028)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$3d","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" called \"OpenMutexW\" with parameter \"QkZIgqsFKSkmXvyECPLgu\" - (UID: 00000000-00004028)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$3e","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00004028)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00004148)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00001160)\n \"schtasks.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00002724)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004028)\n \"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00004028)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00004148)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00001160)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002332.00000001.88751.00090000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileA@KERNEL32.DLL at 00000000-00003556-50057-279-0040EB18\n FindFirstFileA@KERNEL32.DLL at 00000000-00003556-50057-298-0040F0CC\n FindFirstFileA@KERNEL32.DLL at 00000000-00003556-50057-337-0040EA04","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetLogicalDriveStringsA@KERNEL32.DLL at 00000000-00003556-50057-308-004107D8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.DLL at 00000000-00003556-50057-311-0040F270","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00000000-00003556-50057-397-0040D849","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoA@KERNEL32.DLL at 00000000-00003556-50057-228-0040D74C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002332.00000001.88751.00090000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00002332.00000001.88751.00280000.00000004.mdmp\n 00000000-00002332.00000002.89745.00280000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetKeyboardType@USER32.DLL at 00000000-00003556-50057-400-0040C2A0\n GetKeyboardType@USER32.DLL at 00000000-00003556-50057-470-0040C296","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Creates file in AppData directory","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" writes to a file \"%APPDATA%\\eiVfWxqyEFoV.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-322","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp eax, 80000000h\" and \"je 0040D8CDh\" at 00000000-00003556-50057-397-0040D849","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$40","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$41","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to access recent files","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-169","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Able to decompress files using PowerShell","description":"file/memory contains long string(File: \"ModuleAnalysisCache\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":3,"id":"string-825","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"Found string \"processstartinfo\" (Source: \"00000000-00002332.00000001.88751.01B00000.00000004.mdmp, 00000000-00003560.00000001.88687.017F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"ose.exe\")\n file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"ADOBEA~1.EXE\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"setup.exe\")\n file/memory contains long string(File: \"python.exe\")\n file/memory contains long string(File: \"pythonw.exe\")\n file/memory contains long string(File: \"javaws.exe\")\n file/memory contains long string(File: \"javaw.exe\")\n file/memory contains long string(File: \"java.exe\")\n file/memory contains long string(File: \"ose.exe\")\n file/memory contains long string(File: \"gui-64.exe\")\n file/memory contains long string(File: \"t64.exe\")\n file/memory contains long string(File: \"w64.exe\")\n file/memory contains long string(File: \"t32.exe\")\n file/memory contains long string(File: \"w32.exe\")\n file/memory contains long string(File: \"pip.exe\")\n file/memory contains long string(File: \"devcon.exe\")\n file/memory contains long string(File: \"cli-64.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$43","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" called \"CopyFileW\" to copy %TEMP%\\3582-490\\61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe to new location %APPDATA%\\eiVfWxqyEFoV.exe (UID: 00000000-00004028)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$44","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$45","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134321395101304689.4148.DefaultAppDomain.powershell\" - (UID: 00000000-00004148)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134321400633016730.1160.DefaultAppDomain.powershell\" - (UID: 00000000-00001160)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$46","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"vpLX.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00002332.00000001.88751.00090000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00002332.00000001.88751.00090000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Powershell command string)","description":"Found string \"Microsoft.PowerShell.Management\\Start-Process -FilePath \"$script:NuGetExePath\" `\" (Indicator: \"Start-Process\"; Source: \"00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-250","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$47","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$48","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$49","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134321395101304689.4148.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134321400633016730.1160.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$4a","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 76FE0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 76FE0000\n \"61D0FA~1.EXE\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 76FE0000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$4b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 63070000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 63070000\n \"61D0FA~1.EXE\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 628C0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74F00000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74F00000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 74AC0000\n \"61D0FA~1.EXE\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74F00000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 63CD0000\n \"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64480000\n \"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64480000\n \"61D0FA~1.EXE\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64480000\n \"61D0FA~1.EXE\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 63CD0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 77680000\n \"svchost.com\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 77680000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 77680000\n \"schtasks.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 77680000\n \"61D0FA~1.EXE\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 77680000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"1800190068e8a16b@api-ms-win-core-synch-l1-2-0.dll\"\n \"1800190088e8a16b@api-ms-win-core-synch-l1-2-0.dll\"\n \"0d000e00cc5fa16b@ntdll.dll\"\n \"1500160020734371@advapi32.dll\"\n \"0e000f00e4734371@advapi32.dll\"\n \"0e000f0050744371@advapi32.dll\"\n \"11001200d47d4371@advapi32.dll\"\n \"110012007c7e4371@advapi32.dll\"\n \"12001300cc7e4371@advapi32.dll\"\n \"12001300387f4371@advapi32.dll\"\n \"14001500e4b74371@advapi32.dll\"\n \"1400150000b84371@advapi32.dll\"\n \"140015001cb84371@advapi32.dll\"\n \"1700180038b84371@advapi32.dll\"\n \"0d000e0054b84371@advapi32.dll\"\n \"1100120064b84371@advapi32.dll\"\n \"110012007cb84371@advapi32.dll\"\n \"0d000e009c7f4371@shell32.dll\"\n \"0d000e0028804371@shell32.dll\"\n \"0f001000ecb94371@advapi32.dll\"\n \"1400150038ba4371@advapi32.dll\"\n \"1400150054ba4371@advapi32.dll\"\n \"0c000d00a8ba4371@advapi32.dll\"\n \"0c000d00b8ba4371@advapi32.dll\"\n \"0e000f00c8ba4371@advapi32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$4c","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$4e","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e\" has an executable section named \"CODE\"\n \"setup.exe\" has an executable section named \"CODE\"\n \"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" has an executable section named \".text\"\n \"dwtrig20.exe\" has an executable section named \"CODE\"\n \"python.exe\" has an executable section named \"CODE\"\n \"pythonw.exe\" has an executable section named \"CODE\"\n \"KMSSS.exe\" has an executable section named \"CODE\"\n \"OneDrive.exe\" has an executable section named \"CODE\"\n \"javaws.exe\" has an executable section named \"CODE\"\n \"javaw.exe\" has an executable section named \"CODE\"\n \"java.exe\" has an executable section named \"CODE\"\n \"ose.exe\" has an executable section named \"CODE\"\n \"gui-64.exe\" has an executable section named \"CODE\"\n \"t64.exe\" has an executable section named \"CODE\"\n \"w64.exe\" has an executable section named \"CODE\"\n \"t32.exe\" has an executable section named \"CODE\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$4f","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$50","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$51","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" (UID: 00000000-00004028) was launched with new environment variables: \"USERDNSDOMAIN=\"%OSUSER%-PC\"\"\n Process \"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" (UID: 00000000-00004028) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$52","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"$53","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$55","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$56","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"$57","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\3582-490\\61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\"\n \"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmpA312.tmp\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\jyjf524l.1yu.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\aer2aixr.kmk.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\wgnjlu2q.acp.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\vrf030o2.c5x.psm1\"\n \"61D0FA~1.EXE\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmp4691.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" connecting to \"\\ThemeApiPort\"\n \"powershell.exe\" connecting to \"\\ThemeApiPort\"\n \"schtasks.exe\" connecting to \"\\ThemeApiPort\"\n \"61D0FA~1.EXE\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/modify Windows services (Powershell command string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-396","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to download and install modules (Powershell command string)","description":"Found string \"function Install-Module\" (Indicator: \"Install-Module\"; Source: \"00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp\")\n Found string \"# Throw an error when Install-Module is used as a non-admin user and '-Scope CurrentUser' is not specified\" (Indicator: \"Install-Module\"; Source: \"00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp\")\n Found string \"# Throw an error when Install-Module/Script is used as a non-admin user and '-Scope CurrentUser' is not specified\" (Indicator: \"Install-Module\"; Source: \"00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-256","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002332.00000001.88751.00090000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains reference to background jobs (Powershell command string)","description":"Found string \"$dependentModulesJob = Microsoft.PowerShell.Core\\Start-Job -ScriptBlock $dependentModuleScript -ArgumentList $moduleName\" (Indicator: \"Start-Job\"; Source: \"00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp\")\n Found string \"Microsoft.PowerShell.Core\\Wait-Job -job $dependentModulesJob\" (Indicator: \"Wait-Job\"; Source: \"00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp\")\n Found string \"$dependentModules = Microsoft.PowerShell.Core\\Receive-Job -job $dependentModulesJob\" (Indicator: \"Receive-Job\"; Source: \"00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1197","relevance":1,"id":"string-375","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains reference to software packages activity (Powershell command string)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1072","relevance":1,"id":"string-387","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$5a","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"JFVOR0YMUG8LZDC47TZY.temp\" has type \"Unknown\"\n \"tmp4691.tmp\" has type \"Unknown\" - Location: [%TEMP%\\tmp4691.tmp]\n \"tmp5023.tmp\" has type \"Unknown\"\n \"4IXDSVXABUA7BR4HDZEZ.temp\" has type \"Unknown\"\n \"RDWIGL7GBTPGI642SONE.temp\" has type \"Unknown\"\n \"5789R8NTDIZOYZUG4TK7.temp\" has type \"Unknown\"\n \"JH4GQO9W096WU7NKZ9AQ.temp\" has type \"Unknown\"\n \"TYE6WP2MCU8MZUWAWXNP.temp\" has type \"Unknown\"\n \"A5DHI54LK2B74ZE4Y0MQ.temp\" has type \"Unknown\"\n \"GGE255HTY2X9T657V5YT.temp\" has type \"Unknown\"\n \"tmp959A.tmp\" has type \"Unknown\"\n \"tmp60F4.tmp\" has type \"Unknown\"\n \"tmpA312.tmp\" has type \"Unknown\" - Location: [%TEMP%\\tmpA312.tmp]\n \"tmpDFD3.tmp\" has type \"Unknown\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$5b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"svchost.com\" queries basic process information of the \"C:\\Windows\\System32\\uxtheme.dll\" (UID: 3280)\n \"powershell.exe\" queries basic process information of the \"C:\\Windows\\System32\\netutils.dll\" (UID: 4148)\n \"powershell.exe\" queries basic process information of the \"C:\\Windows\\System32\\netutils.dll\" (UID: 1160)\n \"powershell.exe\" queries basic process information of the \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\AppLocker.psd1\" (UID: 1160)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$5c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$5d","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Installation/Persistence","name":"References PATH environment registry keys","description":"Found string \"$script:SystemEnvironmentKey = 'HKLM:\\System\\CurrentControlSet\\Control\\Session Manager\\Environment'\"; Source: \"00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1574.007","relevance":1,"id":"string-530","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$5e","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$5f","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$60","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"powershell.exe\" trying to access LNK file \"C:\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$61","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$62","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$63","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00002332.00000001.88751.01B20000.00000004.mdmp, 00000000-00003560.00000002.90611.018C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Network Related","name":"Able to use vulnerability or port scanning tools","description":"file/memory contains long string with (Indicator: \"nmap -sc\"; File: \"WI5ED8~1.EXE\")\n file/memory contains long string with (Indicator: \"nmap -sc\"; File: \"WI2335~1.EXE\")\n file/memory contains long string with (Indicator: \"nmap -sc\"; File: \"WIC467~1.EXE\")","origin":"File/Memory","mitre_attack_id":"T1595.002","relevance":1,"id":"string-996","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00004028)\n \"powershell.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00004148)\n \"powershell.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00001160)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Network Related","name":"Contains ability to get content from a webpage (Powershell command string)","description":"Found string \"$null = Microsoft.PowerShell.Utility\\Invoke-WebRequest -Uri $script:NuGetClientSourceURL `\" (Indicator: \"Invoke-WebRequest\"; Source: \"00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-282","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Network Related","name":"Contains ability to move items (Powershell command string)","description":"Found string \"Microsoft.PowerShell.Management\\Remove-ItemProperty $Path -Name $Name -ErrorAction SilentlyContinue\" (Indicator: \"Move-ItemProperty\"; Source: \"00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-378","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Network Related","name":"Contains ability to test network connectivity (Powershell command string)","description":"Found string \"if(Get-Command Microsoft.PowerShell.Management\\Test-Connection -ErrorAction SilentlyContinue)\" (Indicator: \"Test-Connection\"; Source: \"00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp\")\n Found string \"$connected = Microsoft.PowerShell.Management\\Test-Connection -ComputerName $microsoftDomain -Count 1 -Quiet\" (Indicator: \"Test-Connection\"; Source: \"00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-372","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$64","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"mx.r\" [Source: 61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$65","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"TOR-GE~1.EXE\"\n YARA signature for AES encryption matched on file \"KMSSS.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on file \"00000000-00002332.00000001.88751.00690000.00000004.mdmp\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in process \"00000000-00004296\"\n YARA signature matched on embedded PE in file \"00000000-00004604.00000000.81976.00400000.00000040.mdmp\"\n YARA signature matched on embedded PE in file \"00000000-00005300.00000000.84449.00400000.00000040.mdmp\"\n YARA signature matched on embedded PE in file \"00000000-00005300.00000001.84746.00400000.00000040.mdmp\"\n YARA signature matched on embedded PE in file \"00000000-00000468.00000000.87465.00400000.00000040.mdmp\"\n YARA signature matched on embedded PE in file \"00000000-00004604.00000001.82212.00400000.00000040.mdmp\"\n YARA signature matched on embedded PE in file \"00000000-00000468.00000001.87861.00400000.00000040.mdmp\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm file \"00000000-00002916.00000001.84169.02B40000.00000004.mdmp\"\n YARA signature for encryption algorithm file \"00000000-00005568.00000002.87218.02B90000.00000004.mdmp\"\n YARA signature for encryption algorithm process \"00000000-00002580\"\n YARA signature for encryption algorithm process \"00000000-00004028\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – high entropy image embedded in .NET resource","description":"YARA signature for high entropy images embedded in resource file \"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\"\n YARA signature for high entropy images embedded in resource file \"eiVfWxqyEFoV.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-214","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Remote Access Related","name":"Able to connect to a cloud service","description":"file/memory contains long string with (Indicator: \"gcloud\"; File: \"ModuleAnalysisCache\")","origin":"File/Memory","mitre_attack_id":"T1021.007","relevance":1,"id":"string-767","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"ncacn_np\" (Indicator: \"ncacn_np\"; Source: \"00000000-00002332.00000001.88751.00280000.00000004.mdmp, 00000000-00002332.00000002.89745.00280000.00000004.mdmp, 00000000-00003560.00000001.88687.00320000.00000004.mdmp, 00000000-00003560.00000002.90611.00320000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE1759BFD25B904326ADF60F6910F8]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002332.00000001.88751.01C60000.00000004.mdmp, 00000000-00002332.00000002.89745.01C60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"kerberosclient\" (Indicator: \"kerberos\"; Source: \"00000000-00002332.00000001.88751.01B00000.00000004.mdmp, 00000000-00003560.00000001.88687.017F0000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002332.00000001.88751.01C60000.00000004.mdmp, 00000000-00002332.00000002.89745.01C60000.00000004.mdmp, 00000000-00002916.00000001.84169.004F0000.00000004.mdmp, 00000000-00003064.00000001.90201.00610000.00000004.mdmp, 00000000-00003560.00000002.90611.01DD0000.00000004.mdmp, 00000000-00005568.00000001.87057.00420000.00000004.mdmp, 00000000-00005568.00000002.87218.00420000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"$66","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"$67","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve the valid logical drives on the computer","description":"$68","origin":"Static Parser","mitre_attack_id":"T1083","relevance":5,"id":"static-192","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" tries to directly access volume data \"C:\"\n \"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" tries to directly access volume data \"Z:\"\n \"61D0FA~1.EXE\" tries to directly access volume data \"C:\"\n \"61D0FA~1.EXE\" tries to directly access volume data \"Z:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$69","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"61D0FA~1.EXE\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate logical drives on the computer","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" called \"GetLogicalDriveStringsA\" with parameters {\"nBufferLength\": \"151\"\n \"lpBuffer\": \"C:\\\\\"}\n \"svchost.com\" called \"GetLogicalDriveStringsA\" with parameters {\"nBufferLength\": \"151\"\n \"lpBuffer\": \"C:\\\\\"}","origin":"API Call","mitre_attack_id":"T1680","relevance":6,"id":"api-326","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}\n \"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}\n \"61D0FA~1.EXE\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user names for specified SIDs","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"4fd770\"\n \"Count\": \"1\"}\n \"61D0FA~1.EXE\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"4efc08\"\n \"Count\": \"1\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":1,"id":"api-255","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002332.00000001.88751.00090000.00000002.mdmp, 00000000-00002916.00000001.84169.00860000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"return [System.Environment]::GetEnvironmentVariable($Name)\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002332.00000001.88751.00090000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"return $prp.IsInRole($adm)\" (Indicator: \"IsInRole\"; Source: \"00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00002332.00000001.88751.01B20000.00000004.mdmp, 00000000-00003560.00000002.90611.018C0000.00000004.mdmp\")\n Found string \"# Ping and resolve the specified location\" (Indicator: \"ping\"; Source: \"00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp\")\n Found string \"# ping V2\" (Indicator: \"ping\"; Source: \"00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp\")\n Found string \"# ping V3\" (Indicator: \"ping\"; Source: \"00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"System Security","name":"Able to retrieve security identifier (.NET)","description":"Found string \"$securityIdentifier = [System.Security.Principal.SecurityIdentifier] $Sid\" (Source: \"00000000-00002332.00000001.88751.01680000.00000004.mdmp, 00000000-00003560.00000001.88687.015E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-945","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004028)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004148)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001160)\n \"61D0FA~1.EXE\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002580)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"System Security","name":"Contains ability to create/modify item values (Powershell command string)","description":"Found string \"Microsoft.PowerShell.Management\\Set-ItemProperty $Path -Name $Name -Value $Value\" (Indicator: \"Set-ItemProperty\"; Source: \"00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-367","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete a property and its value from an item (Powershell command string)","description":"Found string \"function Uninstall-Module\" (Indicator: \"Uninstall-Module\"; Source: \"00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp\")\n Found string \"function Uninstall-Script\" (Indicator: \"Uninstall-Script\"; Source: \"00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp\")\n Found string \"function Unregister-PSRepository\" (Indicator: \"Unregister-PSRepository\"; Source: \"00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp\")\n Found string \"Microsoft.PowerShell.Management\\Remove-ItemProperty $Path -Name $Name -ErrorAction SilentlyContinue\" (Indicator: \"Remove-ItemProperty\"; Source: \"00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-369","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"System Security","name":"Contains reference to Hijacked CLSID(s)","description":"Observed string: \"CLSID\\{603D3801-BD81-11D0-A3A5-00C04FD706EC}\" (Indicator: \"{603D3801-BD81-11D0-A3A5-00C04FD706EC}\") in Source: 00000000-00002332.00000001.88751.00280000.00000004.mdmp\n 00000000-00002332.00000002.89745.00280000.00000004.mdmp\n 00000000-00003560.00000001.88687.00320000.00000004.mdmp\n 00000000-00003560.00000002.90611.00320000.00000004.mdmp\n 00000000-00004068.00000000.90323.00200000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1546.015","relevance":1,"id":"string-342","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"System Security","name":"Modifies windows command shell related registry path (UAC Bypass)","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\EXEFILE\\SHELL\\OPEN\\COMMAND\"; Key: \"(DEFAULT)\"; Value: \"%WINDIR%\\svchost.com \"%1\" %*\")","origin":"Registry Access","mitre_attack_id":"T1548.002","relevance":1,"id":"registry-159","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" opened \"\\Device\\KsecDD\"\n \"powershell.exe\" opened \"\\Device\\KsecDD\"\n \"schtasks.exe\" opened \"\\Device\\KsecDD\"\n \"61D0FA~1.EXE\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$6e","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$6f","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Unusual Characteristics","name":"Command line contains PowerShell","description":"Commandline contains PowerShell string \"\"%WINDIR%\\System32\\WINDOW~1\\v1.0\\powershell.exe\" Add-MpPreference -ExclusionPath \"%TEMP%\\3582-490\\61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\".......\" in [Source : svchost.com]\n Commandline contains PowerShell string \"\"%WINDIR%\\System32\\WINDOW~1\\v1.0\\powershell.exe\" Add-MpPreference -ExclusionPath \"%APPDATA%\\eiVfWxqyEFoV.exe\".......\" in [Source : svchost.com]\n Commandline contains PowerShell string \"\"%WINDIR%\\System32\\WINDOW~1\\v1.0\\powershell.exe\" Add-MpPreference -ExclusionPath \"%TEMP%\\3582-490\\61D0FA~1.EXE\".......\" in [Source : svchost.com]","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-510","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to redirect output to specified device/utility (Powershell command string)","description":"$70","origin":"File/Memory","relevance":1,"id":"string-373","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"$71","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"rundll32.exe,update.exe,smss.exe,csrss.exe,wininit.exe\" (Source: \"00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%TEMP%\\3582-490\\61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe]- [targetUID: 00000000-00003556]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$72","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Unusual Characteristics","name":"Found Delphi 4 - Delphi 2006 artifact","description":"$73","origin":"Static Parser","relevance":10,"id":"static-19","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e\" was detected as \"Borland Delphi 4.0\"\n \"setup.exe\" was detected as \"Borland Delphi 4.0\"\n \"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"\n \"dwtrig20.exe\" was detected as \"Borland Delphi 4.0\"\n \"python.exe\" was detected as \"Borland Delphi 4.0\"\n \"pythonw.exe\" was detected as \"Borland Delphi 4.0\"\n \"KMSSS.exe\" was detected as \"Borland Delphi 4.0\"\n \"OneDrive.exe\" was detected as \"Borland Delphi 4.0\"\n \"javaws.exe\" was detected as \"Borland Delphi 4.0\"\n \"javaw.exe\" was detected as \"Borland Delphi 4.0\"\n \"java.exe\" was detected as \"Borland Delphi 4.0\"\n \"ose.exe\" was detected as \"Borland Delphi 4.0\"\n \"gui-64.exe\" was detected as \"Borland Delphi 4.0\"\n \"t64.exe\" was detected as \"Borland Delphi 4.0\"\n \"w64.exe\" was detected as \"Borland Delphi 4.0\"\n \"t32.exe\" was detected as \"Borland Delphi 4.0\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" has section name .text with entropy \"7.856353607417457\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleA@KERNEL32.DLL at 00000000-00003556-50057-378-0040D9AC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoA@KERNEL32.DLL at 00000000-00003556-50057-398-0040AB30","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"20/26 Antivirus vendors marked sample as malicious (76% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$74","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$75","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$76","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00002332.00000001.88751.02D60000.00000004.mdmp, 00000000-00002332.00000002.89745.02D60000.00000004.mdmp, 00000000-00002916.00000001.84169.02B40000.00000004.mdmp, 00000000-00003064.00000001.90201.02AB0000.00000004.mdmp, 00000000-00003560.00000001.88687.03120000.00000004.mdmp, 00000000-00003560.00000002.90611.03120000.00000004.mdmp, 00000000-00005568.00000001.87057.02B90000.00000004.mdmp, 00000000-00005568.00000002.87218.02B90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$77","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmpA312.tmp\" with delete access\n \"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\3582-490\\61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"powershell.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"powershell.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"61D0FA~1.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"61D0FA~1.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegOpenKeyExA\n RegCloseKey\n WriteFile\n GetTempPathA\n GetModuleFileNameA\n GetFileAttributesA\n GetCommandLineA\n CreateFileA\n GetStartupInfoA\n GetFileSize\n UnhandledExceptionFilter\n FindNextFileA\n GetDriveTypeA\n DeleteFileA\n WinExec\n FindFirstFileA\n VirtualAlloc\n GetModuleHandleA\n CreateDirectoryA\n ShellExecuteA","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" claims program is from Mon Feb 6 13:03:29 2090","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" called \"CreateProcessA\" with parameter \"%TEMP%\\3582-490\\61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\" - (UID: 00000000-00004028)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"$78","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"20/26 Antivirus vendors marked sample as malicious (76% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to run the specified application","description":"\"svchost.com\" called \"WinExec\" with parameter %WINDIR%\\System32\\WINDOW~1\\v1.0\\powershell.exe Add-MpPreference -ExclusionPath %APPDATA%\\eiVfWxqyEFoV.exe (UID: 00000000-00001372)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-120","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"$79","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the Windows system directory","description":"File type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections\" was dropped at \"%WINDIR%\\svchost.com\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-7","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the application program directory (%ProgramData%)","description":"File type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections\" was dropped at \"%ALLUSERSPROFILE%\\Oracle\\Java\\javapath_target_623756\\javaws.exe\"\n File type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections\" was dropped at \"%ALLUSERSPROFILE%\\Oracle\\Java\\javapath_target_623756\\javaw.exe\"\n File type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections\" was dropped at \"%ALLUSERSPROFILE%\\Oracle\\Java\\javapath_target_623756\\java.exe\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-27","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"/Create /TN Updates\\\\eiVfWxqyEFoV /XML %TEMP%\\\\tmpA312.tmp\" (UID: 00000000-00002724)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed from task XML file","description":"Process \"schtasks.exe\" with commandline \"/Create /TN Updates\\\\eiVfWxqyEFoV /XML %TEMP%\\\\tmpA312.tmp\" (UID: 00000000-00002724)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":5,"id":"target-414","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$7a","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Creates new processes"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns many processes"},{"detail":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]}],"intel_graph":{"map":{"File:00f88025be1ab2aeee3c7d3871f5c2bb6b4b8892732aec0413e40a503f1668e3":{"type":"File","value":"00f88025be1ab2aeee3c7d3871f5c2bb6b4b8892732aec0413e40a503f1668e3"},"File:05230d05b6659408918d1a09834a6e72fe749167f2abc461d1cd9e87121a9db9":{"type":"File","value":"05230d05b6659408918d1a09834a6e72fe749167f2abc461d1cd9e87121a9db9"},"File:0da7cfe08a4981bc09728671b30a88d6fb2ff6a6b143269927dde9b88ae24d71":{"type":"File","value":"0da7cfe08a4981bc09728671b30a88d6fb2ff6a6b143269927dde9b88ae24d71"},"File:214f478e94658fa2bd7f0bc17022831baee707756798addb41d9c5bee050e70b":{"type":"File","value":"214f478e94658fa2bd7f0bc17022831baee707756798addb41d9c5bee050e70b"},"File:23f9f6840b0ae42e5c9ef90c3c6b42382bcb409dbbd4ce2142bdcc0e8d83df97":{"type":"File","value":"23f9f6840b0ae42e5c9ef90c3c6b42382bcb409dbbd4ce2142bdcc0e8d83df97"},"File:28ad43d2b4c8f36b8cafee610087ccb1495b8811514d3ce200d04f645179213b":{"type":"File","value":"28ad43d2b4c8f36b8cafee610087ccb1495b8811514d3ce200d04f645179213b"},"File:2ffa2ed7e3cbf119525111322aa894f21a328e806a63fa8952bee40736c9d501":{"type":"File","value":"2ffa2ed7e3cbf119525111322aa894f21a328e806a63fa8952bee40736c9d501"},"File:3155f0e4db95a7954cc78cef56e83d10f80a377afcdba643bf70cdfb0f511309":{"type":"File","value":"3155f0e4db95a7954cc78cef56e83d10f80a377afcdba643bf70cdfb0f511309"},"File:3719381482e62035cf69ee29e9151e838e1ccc024e31225aff5455060bd046f9":{"type":"File","value":"3719381482e62035cf69ee29e9151e838e1ccc024e31225aff5455060bd046f9"},"File:3b90315db375e4c0ef00f4971a64848edba8a3ea8a0950a619c774f7141a418a":{"type":"File","value":"3b90315db375e4c0ef00f4971a64848edba8a3ea8a0950a619c774f7141a418a"},"File:4f87fc73c05ed363d45ad8ff9a3bf852512c4d651fe4a58d5421f5aa53c040b4":{"type":"File","value":"4f87fc73c05ed363d45ad8ff9a3bf852512c4d651fe4a58d5421f5aa53c040b4"},"File:50ccfe4f51fc519bc09cddb174166fee2c4ee6e3fca46f8c71a8501605196acf":{"type":"File","value":"50ccfe4f51fc519bc09cddb174166fee2c4ee6e3fca46f8c71a8501605196acf"},"File:50f223ac045b967d2daa59633cb9a1f484743e809e52413ca6b555c0ae42f4e2":{"type":"File","value":"50f223ac045b967d2daa59633cb9a1f484743e809e52413ca6b555c0ae42f4e2"},"File:51442b4cf564625e631bf7d86bf8d9aa1e928d4339ada4373130b1c53cce16f0":{"type":"File","value":"51442b4cf564625e631bf7d86bf8d9aa1e928d4339ada4373130b1c53cce16f0"},"File:5ab0870b9943134535bcd6b9253faf85c7dffe1e2905d5105d69a0fce5b9ce89":{"type":"File","value":"5ab0870b9943134535bcd6b9253faf85c7dffe1e2905d5105d69a0fce5b9ce89"},"File:5b38f1165321cf22ce4a1e84356179a8252bf1b73b448aab6039b4cc5808ae56":{"type":"File","value":"5b38f1165321cf22ce4a1e84356179a8252bf1b73b448aab6039b4cc5808ae56"},"File:5bf92be67136c0fc968e1892189a76849a8681590860e78275d6a31261410fd6":{"type":"File","value":"5bf92be67136c0fc968e1892189a76849a8681590860e78275d6a31261410fd6"},"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e":{"type":"File","value":"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","verdict":{"verdict":"suspicious","verdict_source":"static analysis","reasons":["File reported as packed by ClamAV antivirus"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:6389684b4c4ad12dc53c8cbbce4cf65f283c8fb4d8b98d90df7485a9424873fa":{"type":"File","value":"6389684b4c4ad12dc53c8cbbce4cf65f283c8fb4d8b98d90df7485a9424873fa","filetype":"data (from peinfo)","filetype_short":"DATA","mime_type":"application/x-iso9660-image"},"File:6495ebfdfc37563c4803ece5af68fb6704dad330e04864c29588c41edff84ccc":{"type":"File","value":"6495ebfdfc37563c4803ece5af68fb6704dad330e04864c29588c41edff84ccc"},"File:65f127863feb1b07b418f9bc6fae54f548a8e7aa5ea2b31636d3a09efbc28dc3":{"type":"File","value":"65f127863feb1b07b418f9bc6fae54f548a8e7aa5ea2b31636d3a09efbc28dc3"},"File:67f2c180657c5e3cb4bb53e79cba47494520d9ba81a1a73cc4363e79340eea33":{"type":"File","value":"67f2c180657c5e3cb4bb53e79cba47494520d9ba81a1a73cc4363e79340eea33"},"File:6b5e5f1b9f6fad201b9d9372ec57f1d775dbabd9e9b2e63cd515587df376c815":{"type":"File","value":"6b5e5f1b9f6fad201b9d9372ec57f1d775dbabd9e9b2e63cd515587df376c815"},"File:6c7abeebd50487ca33315f5e507c9a5346e6e7a4b732103b35b8006ed58d7bb2":{"type":"File","value":"6c7abeebd50487ca33315f5e507c9a5346e6e7a4b732103b35b8006ed58d7bb2"},"File:7f304369366e30b330586b7f3a0f6f0d89a446b708c672bb5d53634ca1989f2e":{"type":"File","value":"7f304369366e30b330586b7f3a0f6f0d89a446b708c672bb5d53634ca1989f2e"},"File:8075b65b9a6f0d6a9259b29f2c6868520fb4df49a71680fd5f9c3bed32c07cea":{"type":"File","value":"8075b65b9a6f0d6a9259b29f2c6868520fb4df49a71680fd5f9c3bed32c07cea"},"File:8f7e99eada89fa54c4eac5ec9b3dd0569b997869703518e7c560eef6ae8c4d83":{"type":"File","value":"8f7e99eada89fa54c4eac5ec9b3dd0569b997869703518e7c560eef6ae8c4d83"},"File:9516ba18fb9dbbed96fa49d941a7bc9f799983f6f94f928bf4c6b063fe2fda44":{"type":"File","value":"9516ba18fb9dbbed96fa49d941a7bc9f799983f6f94f928bf4c6b063fe2fda44"},"File:96e1943a64ace6b1ac7280c4f9788f78f770b69124f02d3849c12c67028925a3":{"type":"File","value":"96e1943a64ace6b1ac7280c4f9788f78f770b69124f02d3849c12c67028925a3"},"File:a0973da1564f14a93a9ef72af3f32721eb53b0d551905236fdb6f1eeb45ff6ab":{"type":"File","value":"a0973da1564f14a93a9ef72af3f32721eb53b0d551905236fdb6f1eeb45ff6ab"},"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf":{"type":"File","value":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"},"File:acd32dd903e5464b0ecd153fb3f71da520d2e59a63d4c355d9c1874c919d04e6":{"type":"File","value":"acd32dd903e5464b0ecd153fb3f71da520d2e59a63d4c355d9c1874c919d04e6"},"File:b42005f3b473a5a2493e46c3d115c4fe2c2936c269daa73f662a99988dd6ee43":{"type":"File","value":"b42005f3b473a5a2493e46c3d115c4fe2c2936c269daa73f662a99988dd6ee43"},"File:bc984064d01424dfd6a7c530a1927fe5e3fd3c659988ccd503c3fbfd99462a3f":{"type":"File","value":"bc984064d01424dfd6a7c530a1927fe5e3fd3c659988ccd503c3fbfd99462a3f"},"File:bea4a3d0f05f90995441438a8b1646c354f2514e1310167ea60f494677fed479":{"type":"File","value":"bea4a3d0f05f90995441438a8b1646c354f2514e1310167ea60f494677fed479"},"File:bf5f0809143d865417434ad1f7320416028ad042d61136a3ab048ec468744d01":{"type":"File","value":"bf5f0809143d865417434ad1f7320416028ad042d61136a3ab048ec468744d01"},"File:c2e93830491669db35613f97ba1bc4bd2f54f4c2094136110ea1407e0d9baf5e":{"type":"File","value":"c2e93830491669db35613f97ba1bc4bd2f54f4c2094136110ea1407e0d9baf5e"},"File:cdfb8e974645b87948552bc7658bcee8d64120ef8eb10096c32a9da4edbc58df":{"type":"File","value":"cdfb8e974645b87948552bc7658bcee8d64120ef8eb10096c32a9da4edbc58df"},"File:d01e8f852dfcea8f4532743cfa639d3c47a7562f596f9a4ca9589d9e651f2541":{"type":"File","value":"d01e8f852dfcea8f4532743cfa639d3c47a7562f596f9a4ca9589d9e651f2541"},"File:d0256bf00a0d4663c45698d56cab6979911f95afd765f9ebbbffeb945642660e":{"type":"File","value":"d0256bf00a0d4663c45698d56cab6979911f95afd765f9ebbbffeb945642660e"},"File:d416a825fc01a791ed50338480ef4c4e330e7f5e0c632b48a847a8cd3e25f787":{"type":"File","value":"d416a825fc01a791ed50338480ef4c4e330e7f5e0c632b48a847a8cd3e25f787"},"File:d4951544857c917ab4a83592d8ab9a503b315d3b2ff086d96432de15ea7b6a33":{"type":"File","value":"d4951544857c917ab4a83592d8ab9a503b315d3b2ff086d96432de15ea7b6a33"},"File:d49cf5a1050c1ffc3ed8abf77e427212ebac09f8694cd1b612cde7de68f9ec5b":{"type":"File","value":"d49cf5a1050c1ffc3ed8abf77e427212ebac09f8694cd1b612cde7de68f9ec5b"},"File:d60208f3894f4556caae5ed2297c0ef1593a4a66f5af8f3f2e44a8f2896bbf8e":{"type":"File","value":"d60208f3894f4556caae5ed2297c0ef1593a4a66f5af8f3f2e44a8f2896bbf8e"},"File:d6d3c7aa1c716dd5a6eb530c9af1b1e367b030c831aeaae025a69453c9f0366d":{"type":"File","value":"d6d3c7aa1c716dd5a6eb530c9af1b1e367b030c831aeaae025a69453c9f0366d"},"File:dc5818104cc7c1161a8e5e6da75571ce960310bdf602931d8b5c4b462eb1b8be":{"type":"File","value":"dc5818104cc7c1161a8e5e6da75571ce960310bdf602931d8b5c4b462eb1b8be"},"File:e4eb2afd0a7af27a183f9b777cc0af52616fe4ac4b980e46dd4c8716dba854de":{"type":"File","value":"e4eb2afd0a7af27a183f9b777cc0af52616fe4ac4b980e46dd4c8716dba854de"},"File:f10bf3daedcbfee1c3c7fe8f7b78d962487f6fabcd4cb31309167f53360b0b5a":{"type":"File","value":"f10bf3daedcbfee1c3c7fe8f7b78d962487f6fabcd4cb31309167f53360b0b5a"},"File:f45d0c843387d5a23e11607ee739042122a8119579055547b50af48d53933368":{"type":"File","value":"f45d0c843387d5a23e11607ee739042122a8119579055547b50af48d53933368"}},"chains":[{"id":"1543526259238827664","root":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","edges":[],"verdict":{"verdict":"suspicious","verdict_source":"static analysis","reasons":["File reported as packed by ClamAV antivirus"]}},{"id":"1543526267520904463","root":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:6389684b4c4ad12dc53c8cbbce4cf65f283c8fb4d8b98d90df7485a9424873fa"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_files","root":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","edges":[{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:6389684b4c4ad12dc53c8cbbce4cf65f283c8fb4d8b98d90df7485a9424873fa"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:65f127863feb1b07b418f9bc6fae54f548a8e7aa5ea2b31636d3a09efbc28dc3"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:23f9f6840b0ae42e5c9ef90c3c6b42382bcb409dbbd4ce2142bdcc0e8d83df97"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:cdfb8e974645b87948552bc7658bcee8d64120ef8eb10096c32a9da4edbc58df"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:dc5818104cc7c1161a8e5e6da75571ce960310bdf602931d8b5c4b462eb1b8be"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:d01e8f852dfcea8f4532743cfa639d3c47a7562f596f9a4ca9589d9e651f2541"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:bc984064d01424dfd6a7c530a1927fe5e3fd3c659988ccd503c3fbfd99462a3f"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:214f478e94658fa2bd7f0bc17022831baee707756798addb41d9c5bee050e70b"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:2ffa2ed7e3cbf119525111322aa894f21a328e806a63fa8952bee40736c9d501"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:d416a825fc01a791ed50338480ef4c4e330e7f5e0c632b48a847a8cd3e25f787"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:4f87fc73c05ed363d45ad8ff9a3bf852512c4d651fe4a58d5421f5aa53c040b4"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:05230d05b6659408918d1a09834a6e72fe749167f2abc461d1cd9e87121a9db9"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:6c7abeebd50487ca33315f5e507c9a5346e6e7a4b732103b35b8006ed58d7bb2"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:9516ba18fb9dbbed96fa49d941a7bc9f799983f6f94f928bf4c6b063fe2fda44"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:5bf92be67136c0fc968e1892189a76849a8681590860e78275d6a31261410fd6"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:50f223ac045b967d2daa59633cb9a1f484743e809e52413ca6b555c0ae42f4e2"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:bc984064d01424dfd6a7c530a1927fe5e3fd3c659988ccd503c3fbfd99462a3f"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:b42005f3b473a5a2493e46c3d115c4fe2c2936c269daa73f662a99988dd6ee43"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:50f223ac045b967d2daa59633cb9a1f484743e809e52413ca6b555c0ae42f4e2"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:d01e8f852dfcea8f4532743cfa639d3c47a7562f596f9a4ca9589d9e651f2541"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:d01e8f852dfcea8f4532743cfa639d3c47a7562f596f9a4ca9589d9e651f2541"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:3155f0e4db95a7954cc78cef56e83d10f80a377afcdba643bf70cdfb0f511309"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:d60208f3894f4556caae5ed2297c0ef1593a4a66f5af8f3f2e44a8f2896bbf8e"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:e4eb2afd0a7af27a183f9b777cc0af52616fe4ac4b980e46dd4c8716dba854de"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:d0256bf00a0d4663c45698d56cab6979911f95afd765f9ebbbffeb945642660e"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:7f304369366e30b330586b7f3a0f6f0d89a446b708c672bb5d53634ca1989f2e"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:96e1943a64ace6b1ac7280c4f9788f78f770b69124f02d3849c12c67028925a3"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:50ccfe4f51fc519bc09cddb174166fee2c4ee6e3fca46f8c71a8501605196acf"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:f10bf3daedcbfee1c3c7fe8f7b78d962487f6fabcd4cb31309167f53360b0b5a"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:6b5e5f1b9f6fad201b9d9372ec57f1d775dbabd9e9b2e63cd515587df376c815"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:67f2c180657c5e3cb4bb53e79cba47494520d9ba81a1a73cc4363e79340eea33"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:6495ebfdfc37563c4803ece5af68fb6704dad330e04864c29588c41edff84ccc"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:acd32dd903e5464b0ecd153fb3f71da520d2e59a63d4c355d9c1874c919d04e6"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:5b38f1165321cf22ce4a1e84356179a8252bf1b73b448aab6039b4cc5808ae56"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:8f7e99eada89fa54c4eac5ec9b3dd0569b997869703518e7c560eef6ae8c4d83"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:bf5f0809143d865417434ad1f7320416028ad042d61136a3ab048ec468744d01"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:f45d0c843387d5a23e11607ee739042122a8119579055547b50af48d53933368"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:3719381482e62035cf69ee29e9151e838e1ccc024e31225aff5455060bd046f9"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:d4951544857c917ab4a83592d8ab9a503b315d3b2ff086d96432de15ea7b6a33"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:d49cf5a1050c1ffc3ed8abf77e427212ebac09f8694cd1b612cde7de68f9ec5b"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:28ad43d2b4c8f36b8cafee610087ccb1495b8811514d3ce200d04f645179213b"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:0da7cfe08a4981bc09728671b30a88d6fb2ff6a6b143269927dde9b88ae24d71"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:51442b4cf564625e631bf7d86bf8d9aa1e928d4339ada4373130b1c53cce16f0"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:00f88025be1ab2aeee3c7d3871f5c2bb6b4b8892732aec0413e40a503f1668e3"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:5ab0870b9943134535bcd6b9253faf85c7dffe1e2905d5105d69a0fce5b9ce89"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:3b90315db375e4c0ef00f4971a64848edba8a3ea8a0950a619c774f7141a418a"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:a0973da1564f14a93a9ef72af3f32721eb53b0d551905236fdb6f1eeb45ff6ab"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:bea4a3d0f05f90995441438a8b1646c354f2514e1310167ea60f494677fed479"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:d60208f3894f4556caae5ed2297c0ef1593a4a66f5af8f3f2e44a8f2896bbf8e"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:50ccfe4f51fc519bc09cddb174166fee2c4ee6e3fca46f8c71a8501605196acf"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:5ab0870b9943134535bcd6b9253faf85c7dffe1e2905d5105d69a0fce5b9ce89"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:8075b65b9a6f0d6a9259b29f2c6868520fb4df49a71680fd5f9c3bed32c07cea"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:d60208f3894f4556caae5ed2297c0ef1593a4a66f5af8f3f2e44a8f2896bbf8e"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:d60208f3894f4556caae5ed2297c0ef1593a4a66f5af8f3f2e44a8f2896bbf8e"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:d6d3c7aa1c716dd5a6eb530c9af1b1e367b030c831aeaae025a69453c9f0366d"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:d6d3c7aa1c716dd5a6eb530c9af1b1e367b030c831aeaae025a69453c9f0366d"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:3155f0e4db95a7954cc78cef56e83d10f80a377afcdba643bf70cdfb0f511309"},{"edge_kind":"extracted","from_key":"File:61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","to_key":"File:c2e93830491669db35613f97ba1bc4bd2f54f4c2094136110ea1407e0d9baf5e"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":12,"spawned_processes_count":12,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":7,"imported_dlls_count":144,"dropped_files_count":0,"extracted_files_count":59,"files_written_count":18,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":7,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"6a8d9a55fa04dd721101b432","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Virus.Neshta","submit_name":"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","analysis_start_time":"2026-08-25T13:36:23+00:00","indicators_count":{"informative":235,"suspicious":61,"malicious":12},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}],"processes":[{"pid":3556,"ppid":0,"name":"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe","command_line":"","sha256":"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e","normalized_path":"C:\\61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe","uid":"00000000-00003556","icon":"$7b"},{"pid":4028,"ppid":3556,"name":"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe","command_line":"","sha256":"bc984064d01424dfd6a7c530a1927fe5e3fd3c659988ccd503c3fbfd99462a3f","normalized_path":"%TEMP%\\3582-490\\61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe","parent_uid":"00000000-00003556","uid":"00000000-00004028"},{"pid":3280,"ppid":4028,"name":"svchost.com","command_line":"\"%WINDIR%\\System32\\WINDOW~1\\v1.0\\powershell.exe\" Add-MpPreference -ExclusionPath \"%TEMP%\\3582-490\\61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe\"","sha256":"d60208f3894f4556caae5ed2297c0ef1593a4a66f5af8f3f2e44a8f2896bbf8e","normalized_path":"%WINDIR%\\svchost.com","parent_uid":"00000000-00004028","uid":"00000000-00003280"},{"pid":4148,"ppid":3280,"name":"powershell.exe","command_line":"Add-MpPreference -ExclusionPath %TEMP%\\3582-490\\61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe","sha256":"70ba57fb0bf2f34b86426d21559f5f6d05c1268193904de8e959d7b06ce964ce","normalized_path":"%WINDIR%\\System32\\WINDOW~1\\v1.0\\powershell.exe","parent_uid":"00000000-00003280","uid":"00000000-00004148"},{"pid":1372,"ppid":4028,"name":"svchost.com","command_line":"\"%WINDIR%\\System32\\WINDOW~1\\v1.0\\powershell.exe\" Add-MpPreference -ExclusionPath \"%APPDATA%\\eiVfWxqyEFoV.exe\"","sha256":"d60208f3894f4556caae5ed2297c0ef1593a4a66f5af8f3f2e44a8f2896bbf8e","normalized_path":"%WINDIR%\\svchost.com","parent_uid":"00000000-00004028","uid":"00000000-00001372"},{"pid":1160,"ppid":1372,"name":"powershell.exe","command_line":"Add-MpPreference -ExclusionPath %APPDATA%\\eiVfWxqyEFoV.exe","sha256":"70ba57fb0bf2f34b86426d21559f5f6d05c1268193904de8e959d7b06ce964ce","normalized_path":"%WINDIR%\\System32\\WINDOW~1\\v1.0\\powershell.exe","parent_uid":"00000000-00001372","uid":"00000000-00001160"},{"pid":2768,"ppid":4028,"name":"svchost.com","command_line":"\"%WINDIR%\\System32\\schtasks.exe\" /Create /TN \"Updates\\eiVfWxqyEFoV\" /XML \"%TEMP%\\tmpA312.tmp\"","sha256":"d60208f3894f4556caae5ed2297c0ef1593a4a66f5af8f3f2e44a8f2896bbf8e","normalized_path":"%WINDIR%\\svchost.com","parent_uid":"00000000-00004028","uid":"00000000-00002768"},{"pid":2724,"ppid":2768,"name":"schtasks.exe","command_line":"/Create /TN Updates\\eiVfWxqyEFoV /XML %TEMP%\\tmpA312.tmp","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00000000-00002768","uid":"00000000-00002724"},{"pid":4296,"ppid":4028,"name":"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe","command_line":"","sha256":"bc984064d01424dfd6a7c530a1927fe5e3fd3c659988ccd503c3fbfd99462a3f","normalized_path":"%TEMP%\\3582-490\\61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe","parent_uid":"00000000-00004028","uid":"00000000-00004296"},{"pid":1416,"ppid":4296,"name":"svchost.com","command_line":"\"%TEMP%\\3582-490\\61D0FA~1.EXE\"","sha256":"d60208f3894f4556caae5ed2297c0ef1593a4a66f5af8f3f2e44a8f2896bbf8e","normalized_path":"%WINDIR%\\svchost.com","parent_uid":"00000000-00004296","uid":"00000000-00001416"},{"pid":2580,"ppid":1416,"name":"61D0FA~1.EXE","command_line":"","sha256":"bc984064d01424dfd6a7c530a1927fe5e3fd3c659988ccd503c3fbfd99462a3f","normalized_path":"%TEMP%\\3582-490\\61D0FA~1.EXE","parent_uid":"00000000-00001416","uid":"00000000-00002580"},{"pid":4484,"ppid":2580,"name":"svchost.com","command_line":"\"%WINDIR%\\System32\\WINDOW~1\\v1.0\\powershell.exe\" Add-MpPreference -ExclusionPath \"%TEMP%\\3582-490\\61D0FA~1.EXE\"","sha256":"d60208f3894f4556caae5ed2297c0ef1593a4a66f5af8f3f2e44a8f2896bbf8e","normalized_path":"%WINDIR%\\svchost.com","parent_uid":"00000000-00002580","uid":"00000000-00004484"}],"all_imported_dlls":["cryptbase.dll","secur32.dll","api-ms-win-core-xstate-l2-1-0.dll","ntshrui.dll","AutoItX3.PowerShell.dll","oleaut32.dll","profapi.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","crypt32.dll","System.Transactions.ni.dll","ntdll.dll","user32.dll","ntmarta.dll","SensApi.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","userenv.dll","shell32.dll","System.Management.Automation.ni.dll","mscoreei.dll","RpcRtRemote.dll","wshext.dll","System.Management.ni.dll","urlmon.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","propsys.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","clr.dll","Microsoft.PowerShell.Security.ni.dll","api-ms-win-crt-utility-l1-1-0.dll","sspicli.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","Microsoft.Windows.Diagnosis.TroubleshootingPack.dll","wininet.dll","Microsoft.PowerShell.LocalAccounts.dll","sechost.dll","usp10.dll","api-ms-win-core-processthreads-l1-1-1.dll","System.ni.dll","GdiPlus.dll","ncrypt.dll","apphelp.dll","uxtheme.dll","api-ms-win-crt-time-l1-1-0.dll","kernel32.dll","System.Core.ni.dll","ieframe.dll","System.Data.dll","Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll","Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.dll","ktmw32.dll","imm32.dll","api-ms-win-core-file-l2-1-0.dll","msvcp140.dll","api-ms-win-crt-math-l1-1-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","version.dll","mscoree.dll","System.Drawing.ni.dll","rsaenh.dll","WindowsCodecs.dll","advapi32.dll","comctl32.dll","shdocvw.dll","mscorlib.ni.dll","wintrust.dll","shlwapi.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-user32-l1-1-0.dll","linkinfo.dll","Microsoft.BackgroundIntelligentTransfer.Management.dll","diasymreader.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","System.Configuration.ni.dll","Microsoft.CSharp.ni.dll","Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll","msvcrt.dll","nsi.dll","ucrtbase.dll","api-ms-win-crt-string-l1-1-0.dll","api-ms-win-crt-locale-l1-1-0.dll","System.DirectoryServices.ni.dll","ole32.dll","msctf.dll","api-ms-win-crt-stdio-l1-1-0.dll","clbcatq.dll","normaliz.dll","Microsoft.VisualBasic.ni.dll","devobj.dll","vcruntime140.dll","cfgmgr32.dll","clrjit.dll","System.Xml.ni.dll","Microsoft.Windows.Diagnosis.SDEngine.dll","netutils.dll","taskschd.dll","ws2_32.dll","api-ms-win-core-synch-l1-2-0.dll","setupapi.dll","gpapi.dll","lpk.dll","api-ms-win-core-localization-l1-2-0.dll","ucrtbase_clr0400.dll","System.Windows.Forms.ni.dll","rpcrt4.dll","api-ms-win-core-file-l1-2-0.dll","api-ms-win-crt-heap-l1-1-0.dll","System.Windows.Forms.dll","cryptsp.dll","Wldap32.dll","vcruntime140_clr0400.dll","bcrypt.dll","cscapi.dll","msasn1.dll","msisip.dll","pwrshsip.dll","Microsoft.Management.Infrastructure.ni.dll","gdi32.dll","psapi.dll","mscorrc.dll","System.Management.Automation.dll","System.Data.ni.dll","cryptnet.dll","fltLib.dll","iertutil.dll","slc.dll","System.Transactions.dll","Microsoft.Management.Infrastructure.Native.ni.dll","rpcss.dll","api-ms-win-crt-environment-l1-1-0.dll","srvcli.dll","Microsoft.PowerShell.Commands.Management.ni.dll","System.Configuration.Install.ni.dll","api-ms-win-core-timezone-l1-1-0.dll","nlssorting.dll","atl.dll","Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll","Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll","bcryptprimitives.dll","KernelBase.dll","VxSSL32.dll","api-ms-win-crt-convert-l1-1-0.dll","System.Numerics.ni.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"6389684b4c4ad12dc53c8cbbce4cf65f283c8fb4d8b98d90df7485a9424873fa","sha256":"6389684b4c4ad12dc53c8cbbce4cf65f283c8fb4d8b98d90df7485a9424873fa","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"java.exe","sha256":"65f127863feb1b07b418f9bc6fae54f548a8e7aa5ea2b31636d3a09efbc28dc3","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"javaw.exe","sha256":"23f9f6840b0ae42e5c9ef90c3c6b42382bcb409dbbd4ce2142bdcc0e8d83df97","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"javaws.exe","sha256":"cdfb8e974645b87948552bc7658bcee8d64120ef8eb10096c32a9da4edbc58df","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"pythonw.exe","sha256":"dc5818104cc7c1161a8e5e6da75571ce960310bdf602931d8b5c4b462eb1b8be","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"pip.exe","sha256":"d01e8f852dfcea8f4532743cfa639d3c47a7562f596f9a4ca9589d9e651f2541","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe","sha256":"bc984064d01424dfd6a7c530a1927fe5e3fd3c659988ccd503c3fbfd99462a3f","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"dwtrig20.exe","sha256":"214f478e94658fa2bd7f0bc17022831baee707756798addb41d9c5bee050e70b","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"setup.exe","sha256":"2ffa2ed7e3cbf119525111322aa894f21a328e806a63fa8952bee40736c9d501","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"python.exe","sha256":"d416a825fc01a791ed50338480ef4c4e330e7f5e0c632b48a847a8cd3e25f787","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"KMSSS.exe","sha256":"4f87fc73c05ed363d45ad8ff9a3bf852512c4d651fe4a58d5421f5aa53c040b4","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"OneDrive.exe","sha256":"05230d05b6659408918d1a09834a6e72fe749167f2abc461d1cd9e87121a9db9","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"ose.exe","sha256":"6c7abeebd50487ca33315f5e507c9a5346e6e7a4b732103b35b8006ed58d7bb2","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"t64.exe","sha256":"9516ba18fb9dbbed96fa49d941a7bc9f799983f6f94f928bf4c6b063fe2fda44","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"w64.exe","sha256":"5bf92be67136c0fc968e1892189a76849a8681590860e78275d6a31261410fd6","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"gui-32.exe","sha256":"50f223ac045b967d2daa59633cb9a1f484743e809e52413ca6b555c0ae42f4e2","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"eiVfWxqyEFoV.exe","sha256":"bc984064d01424dfd6a7c530a1927fe5e3fd3c659988ccd503c3fbfd99462a3f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"gui-64.exe","sha256":"b42005f3b473a5a2493e46c3d115c4fe2c2936c269daa73f662a99988dd6ee43","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"gui.exe","sha256":"50f223ac045b967d2daa59633cb9a1f484743e809e52413ca6b555c0ae42f4e2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"PIP38~1.EXE","sha256":"d01e8f852dfcea8f4532743cfa639d3c47a7562f596f9a4ca9589d9e651f2541","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"pip3.exe","sha256":"d01e8f852dfcea8f4532743cfa639d3c47a7562f596f9a4ca9589d9e651f2541","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"tmpA312.tmp","sha256":"3155f0e4db95a7954cc78cef56e83d10f80a377afcdba643bf70cdfb0f511309","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"svchost.com","sha256":"d60208f3894f4556caae5ed2297c0ef1593a4a66f5af8f3f2e44a8f2896bbf8e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"t32.exe","sha256":"e4eb2afd0a7af27a183f9b777cc0af52616fe4ac4b980e46dd4c8716dba854de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"w32.exe","sha256":"d0256bf00a0d4663c45698d56cab6979911f95afd765f9ebbbffeb945642660e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"devcon.exe","sha256":"7f304369366e30b330586b7f3a0f6f0d89a446b708c672bb5d53634ca1989f2e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"cli-64.exe","sha256":"96e1943a64ace6b1ac7280c4f9788f78f770b69124f02d3849c12c67028925a3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"cli.exe","sha256":"50ccfe4f51fc519bc09cddb174166fee2c4ee6e3fca46f8c71a8501605196acf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"TOR-GE~1.EXE","sha256":"f10bf3daedcbfee1c3c7fe8f7b78d962487f6fabcd4cb31309167f53360b0b5a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"CHROME~1.EXE","sha256":"6b5e5f1b9f6fad201b9d9372ec57f1d775dbabd9e9b2e63cd515587df376c815","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"PYTHON~1.EXE","sha256":"67f2c180657c5e3cb4bb53e79cba47494520d9ba81a1a73cc4363e79340eea33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"INTEGR~1.EXE","sha256":"6495ebfdfc37563c4803ece5af68fb6704dad330e04864c29588c41edff84ccc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"DW20.EXE","sha256":"acd32dd903e5464b0ecd153fb3f71da520d2e59a63d4c355d9c1874c919d04e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"VC_RED~1.EXE","sha256":"5b38f1165321cf22ce4a1e84356179a8252bf1b73b448aab6039b4cc5808ae56","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"WININS~4.EXE","sha256":"8f7e99eada89fa54c4eac5ec9b3dd0569b997869703518e7c560eef6ae8c4d83","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"WININS~3.EXE","sha256":"bf5f0809143d865417434ad1f7320416028ad042d61136a3ab048ec468744d01","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"ADOBEA~1.EXE","sha256":"f45d0c843387d5a23e11607ee739042122a8119579055547b50af48d53933368","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"AIRAPP~1.EXE","sha256":"3719381482e62035cf69ee29e9151e838e1ccc024e31225aff5455060bd046f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"WI5DE4~1.EXE","sha256":"d4951544857c917ab4a83592d8ab9a503b315d3b2ff086d96432de15ea7b6a33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"WININS~2.EXE","sha256":"d49cf5a1050c1ffc3ed8abf77e427212ebac09f8694cd1b612cde7de68f9ec5b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"WI02EA~1.EXE","sha256":"28ad43d2b4c8f36b8cafee610087ccb1495b8811514d3ce200d04f645179213b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"WININS~1.EXE","sha256":"0da7cfe08a4981bc09728671b30a88d6fb2ff6a6b143269927dde9b88ae24d71","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"FILESY~1.EXE","sha256":"51442b4cf564625e631bf7d86bf8d9aa1e928d4339ada4373130b1c53cce16f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"NORMAL~1.EXE","sha256":"00f88025be1ab2aeee3c7d3871f5c2bb6b4b8892732aec0413e40a503f1668e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"EASY_I~2.EXE","sha256":"5ab0870b9943134535bcd6b9253faf85c7dffe1e2905d5105d69a0fce5b9ce89","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"WI5ED8~1.EXE","sha256":"3b90315db375e4c0ef00f4971a64848edba8a3ea8a0950a619c774f7141a418a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"WI2335~1.EXE","sha256":"a0973da1564f14a93a9ef72af3f32721eb53b0d551905236fdb6f1eeb45ff6ab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"WIC467~1.EXE","sha256":"bea4a3d0f05f90995441438a8b1646c354f2514e1310167ea60f494677fed479","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"SVCHOST.COM.6A8DE18A.bin","sha256":"d60208f3894f4556caae5ed2297c0ef1593a4a66f5af8f3f2e44a8f2896bbf8e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"cli-32.exe","sha256":"50ccfe4f51fc519bc09cddb174166fee2c4ee6e3fca46f8c71a8501605196acf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"EASY_I~1.EXE","sha256":"5ab0870b9943134535bcd6b9253faf85c7dffe1e2905d5105d69a0fce5b9ce89","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"PIP36~1.EXE","sha256":"8075b65b9a6f0d6a9259b29f2c6868520fb4df49a71680fd5f9c3bed32c07cea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"SVCHOST.COM.6A8DB95C.bin","sha256":"d60208f3894f4556caae5ed2297c0ef1593a4a66f5af8f3f2e44a8f2896bbf8e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"SVCHOST.COM.6A8DDEC1.bin","sha256":"d60208f3894f4556caae5ed2297c0ef1593a4a66f5af8f3f2e44a8f2896bbf8e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"D2Q972V9L0DME0SRKDHU.temp","sha256":"d6d3c7aa1c716dd5a6eb530c9af1b1e367b030c831aeaae025a69453c9f0366d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"FH8YCUY4Y857AKKF9M5J.temp","sha256":"d6d3c7aa1c716dd5a6eb530c9af1b1e367b030c831aeaae025a69453c9f0366d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"tmp4691.tmp","sha256":"3155f0e4db95a7954cc78cef56e83d10f80a377afcdba643bf70cdfb0f511309","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"directx.sys","sha256":"c2e93830491669db35613f97ba1bc4bd2f54f4c2094136110ea1407e0d9baf5e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]}],"files_written":[{"path":"%TEMP%\\3582-490\\61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e.exe","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"path":"%WINDIR%\\svchost.com","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"path":"%APPDATA%\\eiVfWxqyEFoV.exe","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"path":"%TEMP%\\tmpA312.tmp","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"path":"%WINDIR%\\directx.sys","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\FH8YCUY4Y857AKKF9M5J.temp","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RF12a6d9.TMP","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"path":"%TEMP%\\jyjf524l.1yu.ps1","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"path":"%TEMP%\\aer2aixr.kmk.psm1","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\D2Q972V9L0DME0SRKDHU.temp","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RF12b5b7.TMP","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"path":"%TEMP%\\wgnjlu2q.acp.ps1","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"path":"%TEMP%\\vrf030o2.c5x.psm1","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"path":"%TEMP%\\tmp4691.tmp","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MutexPolesskayaGlush*.*svchost.comexefile\\shell\\open\\command‹À \"%1\" %*œ‘@","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\QkZIgqsFKSkmXvyECPLgu","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MutexPolesskayaGlush*.*svchost.comµáÙnÊXý±.štÛNóÄžt“îâhî„‹À`ˆ²òTø5ýœ‘@","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"6a8d9a55fa04dd721101b432"}]}]}},"report_ids":{"sandbox_job_ids":["6a8d9a55fa04dd721101b432"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Virus.Neshta Sample 61d0fa3933d0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 61d0fa3933d0…. Malware family: Virus.Neshta. Threat score 100/100. 21/27 AV engines flagged this file. 14 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e"}],["$","meta","4",{"property":"og:title","content":"Malicious Virus.Neshta Sample 61d0fa3933d0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 61d0fa3933d0…. Malware family: Virus.Neshta. Threat score 100/100. 21/27 AV engines flagged this file. 14 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Virus.Neshta Sample 61d0fa3933d0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 61d0fa3933d0…. Malware family: Virus.Neshta. Threat score 100/100. 21/27 AV engines flagged this file. 14 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L7c","11",{}]]