26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 54:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4a7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious MSIL.Packy.Generic Sample 63cff2928fc7… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 63cff2928fc7…. Malware family: MSIL.Packy.Generic. Threat score 100/100. 20/27 AV engines flagged this file. 10 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/63cff2928fc70c3dfa283c9a03415afc725360bfbf2312a77ad364e5bd000be1","keywords":["Malicious","MSIL.Packy.Generic","malware analysis","sandbox report","threat intelligence","63cff2928fc70c3dfa283c9a03415afc725360bfbf2312a77ad364e5bd000be1"],"about":{"@type":"SoftwareApplication","name":"WormExploit.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"63cff2928fc70c3dfa283c9a03415afc725360bfbf2312a77ad364e5bd000be1","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"MSIL.Packy.Generic","antivirusDetections":{"malicious":20,"total":27},"behavioralIndicators":{"malicious":10,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T657,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "# Format-Hex cmdlet helps in displaying the Hexadecimal equivalent of the input data." (Indicator: "Format-Hex"; Source: "00000000-00004868.00000000.124318.07720000.00000004.mdmp") Found string "function Format-Hex" (Indicator: "Format-Hex"; Source: "00000000-00004868.00000000.124318.07720000.00000004.mdmp")28:T6d0,file/memory contains long string with (Indicator: "HashAlgorithm"; File: "WormExploit.exe") file/memory contains long string with (Indicator: "MD5CryptoServiceProvider"; File: "WormExploit.exe") file/memory contains long string with (Indicator: "Rijndael"; File: "WormExploit.exe") file/memory contains long string with (Indicator: "RijndaelManaged"; File: "WormExploit.exe") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "WormExploit.exe") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00006572-00000BC0-921973288") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00004868.00000000.124318.00E50000.00000004.mdmp, 00000000-00004868.00000000.124318.00F33000.00000004.mdmp, 00000000-00004868.00000000.124318.07720000.00000004.mdmp") Found reference to "[ValidateSet("SHA1", "SHA256", "SHA384", "SHA512", "MACTripleDES", "MD5", "RIPEMD160")]" (Indicator: "SHA384"; Source: "00000000-00004868.00000000.124318.07720000.00000004.mdmp") Found reference to "[ValidateSet("SHA1", "SHA256", "SHA384", "SHA512", "MACTripleDES", "MD5", "RIPEMD160")]" (Indicator: "SHA512"; Source: "00000000-00004868.00000000.124318.07720000.00000004.mdmp") Found reference to "[ValidateSet("SHA1", "SHA256", "SHA384", "SHA512", "MACTripleDES", "MD5", "RIPEMD160")]" (Indicator: "TripleDES"; Source: "00000000-00004868.00000000.124318.07720000.00000004.mdmp") Found reference to "if ($Algorithm -eq "MACTripleDES")" (Indicator: "TripleDES"; Source: "00000000-00004868.00000000.124318.07720000.00000004.mdmp") Found reference to "[System.Security.Cryptography.HashAlgorithm]" (Indicator: "HashAlgorithm"; Source: "00000000-00004868.00000000.124318.07720000.00000004.mdmp")29:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}2a:Tbbc,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004868-65412-49-011EEE60 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004868-65412-141-011ED610 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004868-65412-141-011ED610 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004868-65412-149-011ED560 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004868-65412-149-011ED560 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004868-65412-151-011ED501 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004868-65412-151-011ED501 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004868-65412-158-011EA510 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004868-65412-161-011EA4E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004868-65412-162-011EA4B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004868-65412-182-011E8190 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004868-65412-182-011E8190 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00004868-65412-194-011EC4B6 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00004868-65412-194-011EC4B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004868-65412-195-011E8AF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004868-65412-195-011E8AF0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004868-65412-198-011E8E30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004868-65412-198-011E8E30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004868-65412-199-011E7C30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004868-65412-199-011E7C30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004868-65412-202-011E85B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004868-65412-202-011E85B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004868-65412-203-011E89F0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004868-65412-203-011E89F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004868-65412-214-011EC439 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004868-65412-214-011EC439 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004868-65412-215-011E92C0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004868-65412-215-011E92C0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004868-65412-317-011EC812 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004868-65412-317-011EC812 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004868-65412-322-011EEE322b:T621,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains reference to cryptographic keys Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Tries to steal crypto wallet extension (file access) Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt the data Matched sigs: Tries to steal Crypto currency wallets information (file access) Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: Contains ability to perform symmetric decryption (Dotnet) Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to decode string content at runtime (Dotnet) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: Sample file has high entropy (likely encrypted/compressed content)2c:T1157,"WormExploit.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001800000000000000ccad67f9367700000800000000000000ffffffffffffffff3400000000000000e42a77edff7f000088e77b0000000000db04e50ff87f000000000000f87f00002a96100df87f0000000000000000000009000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff3400000000000000f0e77b00000000000800000000000000000000000000000000000000000000005cb266f936770000c3f0e30ff87f00000000b20200000000a713e40ff87f000048e87b00 (UID: 00000000-00006572) "WormExploit.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006572) "WormExploit.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006572) "WormExploit.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac990ef87f0000000000000000000051ede70ff87f000000000000000000000000000000000000ab9709b1c61e00002a00000000000000900dc002000000008fece70ff87f0000e0ac990ef87f0000e0ac990ef87f0000000000000000000000000000f87f0000ffffff7f8a0c000000000000000000000000000000000000d8ce8d0ef87f00002a0000000000000069c3460ef87f0000310000000000000024030000000000002803000000000000110001100000000080cd7b000000000003a3310ef87f000080cd7b000000000000000000000000002b00000000000000000000000000000020b04c0ef87f0000b43f4b0ef87f0000e0ce8d0e (UID: 00000000-00006572) "WormExploit.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00006572) "WormExploit.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006572) "exploit.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000180000001f1caa0f639985738005b500687d857428f5b50000c78573fb4d987cfeffffff44f4b50092778473e8f3b5000000d176e0f4b500ab778473e0dffc7608000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000070f4b5000000000008000000000000000000000000000000000000000000000000000000071caa0f00000000b0f4b5006992ec76ffffffff3400000070f4b50008000000000000000000d176e0f4b5002794ec7678f4b5000b00000000000000c8f4b500 (UID: 00000000-00004560)2d:T5e8,"WormExploit.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000006f00d07cbf02000000000100000003000000010000006600740018000000650074000000000000000000000000000000000001000000360034000100000034002e0000000000000000000000000039005c0063006f0000000000000000000000000000000000010000002f00000000000000000000006600690067000000 (UID: 00000000-00006572) "WormExploit.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000006f00770073005c004d006900630072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e006600690067000000 (UID: 00000000-00002444) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000006f006e0000000a00730007000000000000000700000000000000a400000001010000000000005bffffff6f0077000000000000000000001000000000000080b5e5000800000852e400002091e500c846e5007300680065006c000500000551e40000184ee500a840e5006e006600690067000000e5001837e5001837e500 (UID: 00000000-00004868) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000018018000000000000000a11400009ccef409ee13cb7780000000ee13cb77000000000000000080000000f062506f00000000bccef4095072d574000018010000000080000000f062506f02000000002f506fd8cef409fb62506f010000008004516f885fd77400000000d4ed694108cff409b864506ff42e506f (UID: 00000000-00004868)2e:T470,"WormExploit.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WormExploit.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "exploit.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "exploit.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME")2f:Te50,"WormExploit.exe" queries volume information of "C:\WormExploit.exe" at 00000000-00006572-00000C17-921977021 "exploit.exe" queries volume information of "C:\Program Files (x86)" at 00000000-00004560-00000C17-929194578 "exploit.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local" at 00000000-00004560-00000C17-929195208 "WormExploit.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\WormExploit.exe" at 00000000-00002444-00000C17-925834394 "WormExploit.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data" at 00000000-00001160-00000C17-934857196 "WormExploit.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Local State" at 00000000-00001160-00000C17-934864373 "WormExploit.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Last Browser" at 00000000-00001160-00000C17-935714976 "WormExploit.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Packages\WormExploit.exe" at 00000000-00001160-00000C17-935715957 "WormExploit.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Ad Blocking" at 00000000-00001160-00000C17-941088653 "WormExploit.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent" at 00000000-00001160-00000C17-941091085 "WormExploit.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Autofill" at 00000000-00001160-00000C17-941092012 "WormExploit.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics" at 00000000-00001160-00000C17-941092922 "WormExploit.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation" at 00000000-00001160-00000C17-941095010 "WormExploit.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Crashpad" at 00000000-00001160-00000C17-941095941 "WormExploit.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default" at 00000000-00001160-00000C17-941098528 "WormExploit.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" at 00000000-00001160-00000C17-941551456 "WormExploit.exe" queries volume information of "C:\Users\2PsMpPY" at 00000000-00001160-00000C17-942602639 "WormExploit.exe" queries volume information of "C:\Users\2PsMpPY" at 00000000-00001160-00000C17-942629670 "WormExploit.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Web Data" at 00000000-00001160-00000C17-942671696 "WormExploit.exe" queries volume information of "C:\Users\2PsMpPY" at 00000000-00001160-00000C17-942705885 "WormExploit.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Web Data" at 00000000-00001160-00000C17-942831466 "WormExploit.exe" queries volume information of "C:\Users\2PsMpPY" at 00000000-00001160-00000C17-943570628 "WormExploit.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\EADPData Component" at 00000000-00001160-00000C17-943754213 "WormExploit.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Kids Mode" at 00000000-00001160-00000C17-943765477 "WormExploit.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Shopping" at 00000000-00001160-00000C17-94378657930:T8c4,"powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")31:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")32:T6958,"WormExploit.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006572) "WormExploit.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006572) "WormExploit.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006572) "WormExploit.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006572) "WormExploit.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006572) "WormExploit.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006572) "WormExploit.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006572) "WormExploit.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006572) "WormExploit.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006572) "WormExploit.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00006572) "WormExploit.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006572) "WormExploit.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006572) "WormExploit.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00006572) "WormExploit.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006572) "WormExploit.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00006572) "WormExploit.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006572) "WormExploit.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006572) "WormExploit.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00006572) "WormExploit.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00006572) "WormExploit.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006572) "WormExploit.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006572) "WormExploit.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006572) "WormExploit.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006572) "WormExploit.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00006572) "WormExploit.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006572) "WormExploit.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00006572) "WormExploit.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00006572) "WormExploit.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\fb4ba4db52ca77687f807bb068871ec2\Microsoft.VisualBasic.ni.dll (UID: 00000000-00006572) "WormExploit.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006572) "WormExploit.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006572) "WormExploit.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006572) "WormExploit.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00006572) "WormExploit.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006572) "WormExploit.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006572) "exploit.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004560) "exploit.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004560) "exploit.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004560) "exploit.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004560) "exploit.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00004560) "exploit.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00004560) "exploit.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004560) "exploit.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00004560) "exploit.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004560) "exploit.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00004560) "exploit.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004560) "exploit.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004560) "exploit.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004560) "exploit.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00004560) "exploit.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00004560) "exploit.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004560) "exploit.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004560) "exploit.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00004560) "exploit.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00004560) "exploit.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00004560) "WormExploit.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002444) "WormExploit.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002444) "WormExploit.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002444) "WormExploit.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002444) "WormExploit.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002444) "WormExploit.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002444) "WormExploit.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002444) "WormExploit.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002444) "WormExploit.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002444) "WormExploit.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00002444) "WormExploit.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002444) "WormExploit.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002444) "WormExploit.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00002444) "WormExploit.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002444) "WormExploit.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002444) "WormExploit.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002444) "WormExploit.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002444) "WormExploit.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00002444) "WormExploit.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00002444) "WormExploit.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002444) "WormExploit.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002444) "WormExploit.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002444) "WormExploit.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002444) "WormExploit.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00002444) "WormExploit.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002444) "WormExploit.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00002444) "WormExploit.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00002444) "WormExploit.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001160) "WormExploit.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001160) "WormExploit.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001160) "WormExploit.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001160) "WormExploit.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00001160) "WormExploit.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00001160) "WormExploit.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001160) "WormExploit.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00001160) "WormExploit.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00001160) "WormExploit.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00001160) "WormExploit.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001160) "WormExploit.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001160) "WormExploit.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001160) "WormExploit.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00001160) "WormExploit.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00001160) "WormExploit.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001160) "WormExploit.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001160) "WormExploit.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00001160) "WormExploit.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00001160) "WormExploit.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00001160) "WormExploit.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00001160) "WormExploit.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00001160) "WormExploit.exe" called "LoadLibrary" with a parameter Crypt32.dll (UID: 00000000-00001160) "WormExploit.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00001160) "WormExploit.exe" called "LoadLibrary" with a parameter rstrtmgr.dll (UID: 00000000-00001160) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e7f9e4af50c666b5fec85987c303915a\Microsoft.Management.Infrastr (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00004868) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00004868) "WormExploit.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004920) "WormExploit.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004920) "WormExploit.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004920) "WormExploit.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004920) "WormExploit.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00004920) "WormExploit.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00004920) "WormExploit.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004920) "WormExploit.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00004920) "WormExploit.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004920) "WormExploit.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00004920) "WormExploit.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004920) "WormExploit.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004920) "WormExploit.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004920) "WormExploit.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004920) "WormExploit.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007756) "WormExploit.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007756) "WormExploit.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007756) "WormExploit.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007756) "WormExploit.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00007756) "WormExploit.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00007756) "WormExploit.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007756) "WormExploit.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00007756) "WormExploit.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00007756) "WormExploit.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00007756) "WormExploit.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007756) "WormExploit.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007756) "WormExploit.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007756) "WormExploit.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007756)33:T3ac5,Found reference to API (Indicator: "ExitProcess"; File: "WormExploit.exe") Found reference to API (Indicator: "GetProcAddress"; File: "WormExploit.exe") Found reference to API (Indicator: "VirtualProtect"; File: "WormExploit.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "WormExploit.exe") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00004868.00000000.124318.00E50000.00000004.mdmp, 00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00004868.00000000.124318.00E50000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00004868.00000000.124318.011E1000.00000020.mdmp, 00000000-00004868.00000000.124318.72371000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00004868.00000000.124318.011E1000.00000020.mdmp, 00000000-00004868.00000000.124318.72371000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00004868.00000000.124318.011E1000.00000020.mdmp, 00000000-00004868.00000000.124318.72371000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp, 00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp, 00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp, 00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp, 00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp, 00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp, 00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp, 00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp, 00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp, 00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp, 00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp, 00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp, 00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp, 00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp, 00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp, 00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp, 00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp, 00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp, 00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp, 00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp, 00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp, 00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp, 00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp, 00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp, 00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp, 00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp, 00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp, 00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp, 00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp, 00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp, 00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp, 00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp, 00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp, 00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00004868.00000000.124318.011F1000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00004868.00000000.124318.72371000.00000020.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00004868.00000000.124318.72371000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00004868.00000000.124318.72371000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00004868.00000000.124318.72371000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00004868.00000000.124318.72371000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00004868.00000000.124318.72371000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00004868.00000000.124318.72371000.00000020.mdmp, 00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00004868.00000000.124318.72371000.00000020.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00004868.00000000.124318.72385000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00004868.00000000.124318.72385000.00000002.mdmp")34:T149a,"Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 65412-149-011ED560 "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 65412-182-011E8190 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 65412-182-011E8190 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 65412-182-011E8190 "SOFTWARE\Microsoft\PowerShell\3" in Source: 65412-184-011EBFA2 "SOFTWARE\Microsoft\PowerShell" in Source: 65412-195-011E8AF0 "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004868.00000000.124318.00E50000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004868.00000000.124318.00E50000.00000004.mdmp "e\Software\Cla" in Source: 00000000-00004868.00000000.124318.00E50000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004868.00000000.124318.011E1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004868.00000000.124318.011E1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004868.00000000.124318.011E1000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004868.00000000.124318.011E1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004868.00000000.124318.011E1000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004868.00000000.124318.011E1000.00000020.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004868.00000000.124318.050F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004868.00000000.124318.050F0000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004868.00000000.124318.050F0000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00004868.00000000.124318.050F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00004868.00000000.124318.050F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00004868.00000000.124318.050F0000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00004868.00000000.124318.050F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00004868.00000000.124318.050F0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00004868.00000000.124318.050F0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004868.00000000.124318.050F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004868.00000000.124318.050F0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004868.00000000.124318.050F0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004868.00000000.124318.050F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004868.00000000.124318.050F0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004868.00000000.124318.050F0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004868.00000000.124318.050F0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004868.00000000.124318.050F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004868.00000000.124318.050F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004868.00000000.124318.050F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004868.00000000.124318.050F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004868.00000000.124318.050F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004868.00000000.124318.050F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004868.00000000.124318.050F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004868.00000000.124318.050F0000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00004868.00000000.124318.050F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00004868.00000000.124318.050F0000.00000004.mdmp35:T15d0,"WormExploit.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:ffffffffc0000135] "WormExploit.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:ffffffffc0000135] "WormExploit.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "WormExploit.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:ffffffffc0000135]36:T53a7,"WormExploit.exe" loaded module "KERNEL32" at base 7ff80de50000 "WormExploit.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff80ca20000 "WormExploit.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff80ca20000 "WormExploit.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff80ca20000 "WormExploit.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ff80e010000 "WormExploit.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff80ca20000 "WormExploit.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff80ca20000 "WormExploit.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff80ca20000 "WormExploit.exe" loaded module "ADVAPI32.DLL" at base 7ff80e040000 "WormExploit.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffff3e60000 "WormExploit.exe" loaded module "SHLWAPI.DLL" at base 7ff80d610000 "WormExploit.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff80c1a0000 "WormExploit.exe" loaded module "VERSION.DLL" at base 7ff803620000 "WormExploit.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7fffddde0000 "WormExploit.exe" loaded module "USER32.DLL" at base 7ff80d6d0000 "WormExploit.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ff80ca20000 "WormExploit.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "WormExploit.exe" loaded module "MSCOREE.DLL" at base 7ffff9c40000 "WormExploit.exe" loaded module "NTDLL" at base 7ff80fe30000 "WormExploit.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff80d300000 "WormExploit.exe" loaded module "PSAPI.DLL" at base 7ff80fa40000 "WormExploit.exe" loaded module "RPCRT4.DLL" at base 7ff80f850000 "WormExploit.exe" loaded module "KERNEL32.DLL" at base 7ff80de50000 "WormExploit.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7fffdc7e0000 "WormExploit.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "WormExploit.exe" loaded module "OLE32.DLL" at base 7ff80fbc0000 "WormExploit.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff80a7c0000 "WormExploit.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "WormExploit.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff80d300000 "WormExploit.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ff80ca20000 "WormExploit.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7fffdc690000 "WormExploit.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7fffdba20000 "WormExploit.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7fffdafa0000 "WormExploit.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.V9921E851#\FB4BA4DB52CA77687F807BB068871EC2\MICROSOFT.VISUALBASIC.NI.DLL" at base 7fffdad70000 "WormExploit.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff80b620000 "WormExploit.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff80c250000 "WormExploit.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "WormExploit.exe" loaded module "SHELL32.DLL" at base 7ff80e3b0000 "WormExploit.exe" loaded module "NTDLL.DLL" at base 7ff80fe30000 "WormExploit.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ff808630000 "WormExploit.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ffff6c80000 "WormExploit.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 7ff80e3b0000 "WormExploit.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ff801900000 "WormExploit.exe" loaded module "MSISO.DLL" at base 7fffed7d0000 "WormExploit.exe" loaded module "SSPICLI.DLL" at base 7ff80c080000 "WormExploit.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ff80ca20000 "WormExploit.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ff80c2d0000 "WormExploit.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ff80a510000 "exploit.exe" loaded module "KERNEL32" at base 76c00000 "exploit.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76dc0000 "exploit.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76dc0000 "exploit.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76dc0000 "exploit.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 76d90000 "exploit.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76dc0000 "exploit.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76dc0000 "exploit.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76dc0000 "exploit.exe" loaded module "KERNEL32.DLL" at base 76c00000 "exploit.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 766d0000 "exploit.exe" loaded module "NTDLL.DLL" at base 77c70000 "exploit.exe" loaded module "WINMM.DLL" at base 73790000 "exploit.exe" loaded module "WS2_32.DLL" at base 77c00000 "exploit.exe" loaded module "POWRPROF.DLL" at base 74800000 "exploit.exe" loaded module "USER32.DLL" at base 74dd0000 "exploit.exe" loaded module "ADVAPI32.DLL" at base 74a20000 "exploit.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73940000 "exploit.exe" loaded module "USERENV.DLL" at base 73730000 "exploit.exe" loaded module "RPCRT4.DLL" at base 76750000 "exploit.exe" loaded module "NETAPI32.DLL" at base 73710000 "exploit.exe" loaded module "OLE32.DLL" at base 74aa0000 "exploit.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74140000 "exploit.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76dc0000 "exploit.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 73690000 "exploit.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74a20000 "exploit.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 73610000 "exploit.exe" loaded module "%WINDIR%\SYSWOW64\OLEAUT32.DLL" at base 770c0000 "exploit.exe" loaded module "OLEAUT32.DLL" at base 770c0000 "exploit.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 73560000 "exploit.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 73550000 "exploit.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 73490000 "exploit.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 76dc0000 "exploit.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 76dc0000 "exploit.exe" loaded module "%WINDIR%\SYSWOW64\TASKSCHD.DLL" at base 73b50000 "exploit.exe" loaded module "SSPICLI.DLL" at base 74690000 "exploit.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 745e0000 "WormExploit.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7fffdffb0000 "WormExploit.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7fffdbb70000 "WormExploit.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7fffdb0f0000 "WormExploit.exe" loaded module "KERNEL32" at base 76c00000 "WormExploit.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76dc0000 "WormExploit.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76dc0000 "WormExploit.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76dc0000 "WormExploit.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 76d90000 "WormExploit.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76dc0000 "WormExploit.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76dc0000 "WormExploit.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76dc0000 "WormExploit.exe" loaded module "KERNEL32.DLL" at base 76c00000 "WormExploit.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 766d0000 "WormExploit.exe" loaded module "NTDLL.DLL" at base 77c70000 "WormExploit.exe" loaded module "WINMM.DLL" at base 73790000 "WormExploit.exe" loaded module "WS2_32.DLL" at base 77c00000 "WormExploit.exe" loaded module "POWRPROF.DLL" at base 74800000 "WormExploit.exe" loaded module "USER32.DLL" at base 74dd0000 "WormExploit.exe" loaded module "ADVAPI32.DLL" at base 74a20000 "WormExploit.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73940000 "WormExploit.exe" loaded module "USERENV.DLL" at base 73730000 "WormExploit.exe" loaded module "RPCRT4.DLL" at base 76750000 "WormExploit.exe" loaded module "NETAPI32.DLL" at base 73710000 "WormExploit.exe" loaded module "OLE32.DLL" at base 74aa0000 "WormExploit.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74140000 "WormExploit.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76dc0000 "WormExploit.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 73690000 "WormExploit.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74a20000 "WormExploit.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 73610000 "WormExploit.exe" loaded module "%WINDIR%\SYSWOW64\OLEAUT32.DLL" at base 770c0000 "WormExploit.exe" loaded module "OLEAUT32.DLL" at base 770c0000 "WormExploit.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 73560000 "WormExploit.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 73550000 "WormExploit.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 73490000 "WormExploit.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 76dc0000 "WormExploit.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 76dc0000 "WormExploit.exe" loaded module "WTSAPI32.DLL" at base 742f0000 "WormExploit.exe" loaded module "GDI32.DLL" at base 76d10000 "WormExploit.exe" loaded module "CRYPT32.DLL" at base 751a0000 "WormExploit.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 745e0000 "WormExploit.exe" loaded module "RSTRTMGR.DLL" at base 6f560000 "WormExploit.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 766d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76dc0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76dc0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76dc0000 "powershell.exe" loaded module "KERNEL32" at base 76c00000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 74a20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 734f0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 76670000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 749b0000 "powershell.exe" loaded module "VERSION.DLL" at base 743c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72d40000 "powershell.exe" loaded module "USER32.DLL" at base 74dd0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 76dc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 73650000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 768a0000 "powershell.exe" loaded module "PSAPI.DLL" at base 766c0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 76c00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70c80000 "powershell.exe" loaded module "RPCRT4.DLL" at base 76750000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 74aa0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 768a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 770c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72c60000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 766d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 76dc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 72bd0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 70220000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 723b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 768a0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 768a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 77c70000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 75330000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 750c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6faa0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 750c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 751a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "AMSI.DLL" at base 73610000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 743c0000 "powershell.exe" loaded module "CRYPT32.DLL" at base 751a0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 72370000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E7F9E4AF50C666B5FEC85987C303915A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 722f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6f740000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 768a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 722a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6f630000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 72290000 "powershell.exe" loaded module "SSPICLI.DLL" at base 74690000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74140000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WLDP.DLL" at base 0 "powershell.exe" loaded module "WLDP.DLL" at base 72270000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6f590000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 76c00000 "powershell.exe" loaded module "USERENV.DLL" at base 73730000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74a20000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 6f520000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 6f500000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 76c00000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 6f4d0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 6f370000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 6f340000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 6f340000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\URLMON.DLL" at base 0 "powershell.exe" loaded module "URLMON.DLL" at base 73f80000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 76dc0000 "powershell.exe" loaded module "MSISO.DLL" at base 6f270000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 6f1c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 73a10000 "powershell.exe" loaded module "OLEAUT32" at base 770c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 76dc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MSVCRT.DLL" at base 0 "powershell.exe" loaded module "MSVCRT.DLL" at base 74d10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 0 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 6eee0000 "powershell.exe" loaded module "MI.DLL" at base 6eec0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MI.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 76dc0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WMIDCOM.DLL" at base 6ee30000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76dc0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6ee20000 "powershell.exe" loaded module "GDI32.DLL" at base 76d10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6eda0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6ece0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 76dc0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 76dc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 76c00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 76dc000037:T1058,Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Variable to hold all default pairse used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "$pathsToProcess += Resolve-Path -LiteralPath $LiteralPath | Foreach-Object ProviderPath" (Indicator: "Resolve-Path"; Source: "00000000-00004868.00000000.124318.07720000.00000004.mdmp") Found string "$pathsToProcess += Resolve-Path $Path | Foreach-Object ProviderPath" (Indicator: "Resolve-Path"; Source: "00000000-00004868.00000000.124318.07720000.00000004.mdmp") Found string "if(Test-Path -LiteralPath $filePath -PathType Container)" (Indicator: "Test-Path"; Source: "00000000-00004868.00000000.124318.07720000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ReadError -ErrorId "FileReadError" -TargetObject $FilePath" (Indicator: "Write-Error"; Source: "00000000-00004868.00000000.124318.07720000.00000004.mdmp") Found string "Write-Error -ErrorRecord $errorRecord" (Indicator: "Write-Error"; Source: "00000000-00004868.00000000.124318.07720000.00000004.mdmp") Found string "$resolvedPaths = Resolve-Path -LiteralPath $filePath" (Indicator: "Resolve-Path"; Source: "00000000-00004868.00000000.124318.07720000.00000004.mdmp") Found string "$resolvedPaths = Resolve-Path -Path $filePath" (Indicator: "Resolve-Path"; Source: "00000000-00004868.00000000.124318.07720000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ([System.Management.Automation.ErrorCategory]::InvalidData) -ErrorId "FormatHexResolvePathError"" (Indicator: "Write-Error"; Source: "00000000-00004868.00000000.124318.07720000.00000004.mdmp")38:Td37,"WormExploit.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "WormExploit.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "WormExploit.exe" touched "Sync root manager" (Path: "HKCU\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "WormExploit.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "WormExploit.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "WormExploit.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "WormExploit.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "exploit.exe" touched "WBEM Scripting Locator" (Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}") "exploit.exe" touched "TaskScheduler class" (Path: "HKCU\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS") "exploit.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "exploit.exe" touched "PSDispatch" (Path: "HKCU\WOW6432NODE\CLSID\{00020420-0000-0000-C000-000000000046}\TREATAS") "exploit.exe" touched "PSTypeInfo" (Path: "HKCU\WOW6432NODE\CLSID\{00020422-0000-0000-C000-000000000046}\TREATAS") "exploit.exe" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "exploit.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "exploit.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "exploit.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "exploit.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "exploit.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "exploit.exe" touched "PSEnumVariant" (Path: "HKCU\WOW6432NODE\CLSID\{00020421-0000-0000-C000-000000000046}\TREATAS") "WormExploit.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\WOW6432NODE\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\WOW6432NODE\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "WormExploit.exe" touched "PSOAInterface" (Path: "HKCU\WOW6432NODE\CLSID\{00020424-0000-0000-C000-000000000046}\TREATAS")39:T6cf,"WormExploit.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "WormExploit.exe" file has an entrypoint instructions - "pushal ,mov esi, 0xc5e015,lea edi, [esi - 0x85d015],push edi,mov ebp, esp,lea ebx, [esp - 0x3e80],xor eax, eax,push eax,cmp esp, ebx,jne 0xf7d2d8,inc esi,inc esi,push ebx,push 0xb7b99c,push edi,add ebx, 4,push ebx,push 0x31f2a8,push esi,add ebx, 4,push ebx,push eax,mov dword ptr [ebx], 0x20003,push ebp,push edi,push esi,push ebx,sub esp, 0x7c,mov edx, dword ptr [esp + 0x90],mov dword ptr [esp + 0x74], 0,mov byte ptr [esp + 0x73], 0,mov ebp, dword ptr [esp + 0x9c],lea eax, [edx + 4],mov dword ptr [esp + 0x78], eax,"3a:T4e7,"WormExploit.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "WormExploit.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "WormExploit.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "WormExploit.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "WormExploit.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "exploit.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "exploit.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "exploit.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "exploit.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "exploit.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "WormExploit.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH")3b:T1153,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",13,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll",03,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll",03,"Microsoft.VisualBasic Version=10.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a","C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\fb4ba4db52ca77687f807bb068871ec2\Microsoft.VisualBasic.ni.dll",0" [Source: WormExploit.exe.log] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00006572-00000C2A-921407934] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00006572-00000C2A-921641642] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00006572-00000C2A-921721141] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00006572-00000C2A-921799223] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00006572-00000C2A-921954036] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00006572-00000C2A-921977887] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00006572-00000C2A-922023780] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00006572-00000C2A-922116439] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00006572-00000C2A-922395138] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00006572-00000C2A-922426879] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\fb4ba4db52ca77687f807bb068871ec2\Microsoft.VisualBasic.ni.dll" [Source: 00000000-00006572-00000C2A-922468226] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00006572-00000C2A-922828126] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00006572-00000C2A-922847703] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00006572-00000C2A-922866891] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00006572-00000C2A-923007848] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00004868-00000C2A-934923296] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00004868-00000C2A-935208202] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00004868-00000C2A-935300281] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00004868-00000C2A-935514964] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00004868-00000C2A-935536247] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00004868-00000C2A-935597643] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00004868-00000C2A-935650818] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00004868-00000C2A-935982529] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00004868-00000C2A-936002700]3c:T820,Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "function New-TemporaryFile" (Indicator: "New-TemporaryFile"; Source: "00000000-00004868.00000000.124318.07720000.00000004.mdmp") Found string "function New-Guid" (Indicator: "New-Guid"; Source: "00000000-00004868.00000000.124318.07720000.00000004.mdmp")3d:T5b9,"WormExploit.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed 3 sections"- Location: [%PROGRAMFILES%\Google\Chrome\Application\WormExploit.exe]- [targetUID: 00000000-00006572] "WormExploit.exe" has type "PE32 executable (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [%TEMP%\WormExploit.exe]- [targetUID: 00000000-00006572] "powershell.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log]- [targetUID: 00000000-00004868] "WormExploit.exe.log" has type "CSV ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0\UsageLogs\WormExploit.exe.log]- [targetUID: 00000000-00006572] "StartupProfileData-Interactive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-Interactive]- [targetUID: 00000000-00004868] "WormExploit.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed 3 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\WormExploit.exe]- [targetUID: 00000000-00006572] "exploit.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed 3 sections"- Location: [%TEMP%\exploit.exe]- [targetUID: 00000000-00006572] "WormExploit.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed 3 sections"- Location: [%LOCALAPPDATA%\Packages\WormExploit.exe]- [targetUID: 00000000-00006572]3e:Ta4e,"WormExploit.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "WormExploit.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "WormExploit.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "WormExploit.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}\"; Key: ""; Value: "") "WormExploit.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}\"; Key: ""; Value: "") "WormExploit.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME"; Key: ""; Value: "") "WormExploit.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID"; Key: ""; Value: "") "WormExploit.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: ""; Value: "") "WormExploit.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\CUSTOMATTRIBUTES"; Key: ""; Value: "") "WormExploit.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\DIAGNOSIS"; Key: ""; Value: "") "WormExploit.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER"; Key: ""; Value: "") "WormExploit.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: ""; Value: "") "WormExploit.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\DEBUGINFORMATION"; Key: ""; Value: "") "WormExploit.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY\CUSTOMATTRIBUTES"; Key: ""; Value: "") "WormExploit.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WormExploit.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WormExploit.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WormExploit.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "")3f:Te9a,"WormExploit.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "DATA"; Value: "") "WormExploit.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "GENERATION"; Value: "") "WormExploit.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "DATA"; Value: "") "WormExploit.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "GENERATION"; Value: "") "WormExploit.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATIONTYPE"; Value: "") "WormExploit.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "SERVER"; Value: "") "WormExploit.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "DLLPATH"; Value: "") "WormExploit.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "THREADING"; Value: "") "WormExploit.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "TRUSTLEVEL"; Value: "") "WormExploit.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "REMOTESERVER"; Value: "") "WormExploit.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEASUSER"; Value: "") "WormExploit.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINSHAREDBROKER"; Value: "") "WormExploit.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "PERMISSIONS"; Value: "") "WormExploit.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXEPATH"; Value: "") "WormExploit.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "COMMANDLINE"; Value: "") "WormExploit.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITYTYPE"; Value: "") "WormExploit.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "PERMISSIONS"; Value: "") "WormExploit.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "ACTIVATABLECLASSES"; Value: "") "WormExploit.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVERTYPE"; Value: "") "WormExploit.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "APPID"; Value: "") "WormExploit.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITY"; Value: "")40:T4e2,"WormExploit.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" "WormExploit.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll.aux" "WormExploit.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.v9921e851#\fb4ba4db52ca77687f807bb068871ec2\microsoft.visualbasic.ni.dll.aux" "WormExploit.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\e43dd9c73ab5615e461bf5109c3facd6\system.ni.dll.aux" "WormExploit.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\0d59b0e237d7519417de10cd84bda4e7\system.core.ni.dll.aux" "WormExploit.exe" reads file "c:\users\%osuser%\desktop\desktop.ini" "WormExploit.exe" reads file "c:\users\%osuser%\documents\desktop.ini" "WormExploit.exe" reads file "c:\users\%osuser%\music\desktop.ini" "WormExploit.exe" reads file "c:\users\%osuser%\pictures\desktop.ini" "WormExploit.exe" reads file "c:\users\%osuser%\videos\desktop.ini" "WormExploit.exe" reads file "c:\users\%osuser%\downloads\desktop.ini" "WormExploit.exe" reads file "c:\users\%osuser%\onedrive\desktop.ini" "exploit.exe" reads file "c:\windows\syswow64\wbem\wbemdisp.tlb"41:T978,"WormExploit.exe" trying to access non-existent file "C:\FLTLIB.DLL" "WormExploit.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "WormExploit.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "WormExploit.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "WormExploit.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "WormExploit.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "WormExploit.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "WormExploit.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "WormExploit.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "WormExploit.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "WormExploit.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "WormExploit.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "WormExploit.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "WormExploit.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\en-US\MSCORRC.DLL" "WormExploit.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" "WormExploit.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\en-US\MSCORRC.DLL.DLL" "WormExploit.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll.DLL" "WormExploit.exe" trying to access non-existent file "C:\BCRYPT.DLL" "WormExploit.exe" trying to access non-existent file "C:\bcrypt.dll" "WormExploit.exe" trying to access non-existent file "C:\CRYPTBASE.DLL" "WormExploit.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "WormExploit.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\SHELL32.DLL"42:T6ac,"WormExploit.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "WormExploit.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "WormExploit.exe" trying to access non-existent file "C:\WORMEXPLOIT.EXE.CONFIG" "WormExploit.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "WormExploit.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "WormExploit.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WORMEXPLOIT.EXE.LOG" "WormExploit.exe" trying to access non-existent file "C:\WormExploit.exe.config" "WormExploit.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\WORMEXPLOIT" "WormExploit.exe" trying to access non-existent file "C:\WORMEXPLOIT.INI" "WormExploit.exe" trying to access non-existent file "C:\WormExploit.INI" "WormExploit.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "WormExploit.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\exploit.exe:ZONE.IDENTIFIER" "WormExploit.exe" trying to access non-existent file "C:\Users\2PsMpPY\AppData\Local\Temp\exploit.exe:Zone.Identifier" "WormExploit.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\WormExploit.exe:ZONE.IDENTIFIER" "WormExploit.exe" trying to access non-existent file "C:\Users\2PsMpPY\AppData\Local\Temp\WormExploit.exe:Zone.Identifier" "exploit.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\CD6D193C-9C3A-F02F-0A3B-D4E13F503C9C"43:T59a,Observed Namespace "System.Net.Sockets.Socket" and MemberReference ".ctor" in "WormExploit.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "set_ReceiveBufferSize" in "WormExploit.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "set_SendBufferSize" in "WormExploit.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginConnect" in "WormExploit.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_Connected" in "WormExploit.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndConnect" in "WormExploit.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_RemoteEndPoint" in "WormExploit.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Close" in "WormExploit.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Poll" in "WormExploit.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Send" in "WormExploit.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndReceive" in "WormExploit.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginReceive" in "WormExploit.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginSend" in "WormExploit.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndSend" in "WormExploit.exe"44:T18e1,Heuristic match: "+6.cl" Heuristic match: "hfi.uy" Heuristic match: "lg.ax" Heuristic match: "~$.mv" Heuristic match: "s3,.si" Heuristic match: "k:xz.ni" Heuristic match: "o9[\.mz" Heuristic match: "l2.tm" Heuristic match: "uo\2.cg" Pattern match: "microsoft.net/framework/v4.0.30319/" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "www.digicert.com1+0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "http://www.microsoft.com/windows" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll" Pattern match: "http://schemas.microsoft.com/powershell/microsoft.powershell" Heuristic match: "set-location $myinvocation.mycommand.name" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225750" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225747" Heuristic match: "get-content $file | more.com" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113316" Pattern match: "https://go.microsoft.com/fwlink/?linkid=160712" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.powershell.consolehost/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.consolehost.dll" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/xmlschema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.powershell.security/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.security.dll" Heuristic match: "ntrust.net" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ell.se" Heuristic match: "ile:///c:/windows/syswow64/windowspowershell/v1.0/en-us/microsoft.powershell.co" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "http://www.microsoft.com0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "www.digicert.com1!0" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526726" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526920" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526919" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "http://www.validationtest.contoso.com/test%d.html"45:T2098,Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00004868.00000000.124318.00E50000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00004868.00000000.124318.00E50000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00004868.00000000.124318.00E50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004868.00000000.124318.00E50000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00004868.00000000.124318.00E50000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00004868.00000000.124318.00E50000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00004868.00000000.124318.00F33000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcsystem.directoryservicessystem.managementsyst" - Source: "00000000-00004868.00000000.124318.00F33000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00004868.00000000.124318.00F33000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00004868.00000000.124318.00F33000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eil" - Source: "00000000-00004868.00000000.124318.00F33000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%ydigicert" - Source: "00000000-00004868.00000000.124318.00F33000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004868.00000000.124318.00F33000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004868.00000000.124318.00F33000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004868.00000000.124318.00F33000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00004868.00000000.124318.00F33000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004868.00000000.124318.00F33000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004868.00000000.124318.00F33000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004868.00000000.124318.00F33000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004868.00000000.124318.00F33000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0com/3$n?r<0" - Source: "00000000-00004868.00000000.124318.00F33000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00004868.00000000.124318.01180000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004868.00000000.124318.01180000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004868.00000000.124318.01180000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004868.00000000.124318.07720000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00004868.00000000.124318.07720000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004868.00000000.124318.07720000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00004868.00000000.124318.72371000.00000020.mdmp")46:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp")47:T876,"WormExploit.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006572) "WormExploit.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00006572) "WormExploit.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006572) "WormExploit.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00006572) "WormExploit.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00006572) "WormExploit.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00006572) "WormExploit.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00006572) "WormExploit.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00006572) "WormExploit.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00006572) "WormExploit.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00006572) "WormExploit.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00006572) "WormExploit.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00006572) "WormExploit.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00006572) "WormExploit.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\WormExploit\* (UID: 00000000-00006572) "WormExploit.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\* (UID: 00000000-00006572) "WormExploit.exe" called "FindNextFileW" with parameter fb4ba4db52ca77687f807bb068871ec2 (UID: 00000000-00006572) "WormExploit.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00006572) "WormExploit.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00006572) "WormExploit.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00006572)48:T1160,Found string "}oAES" (Indicator: "aes"; File: "WormExploit.exe") file/memory contains long string with (Indicator: "aes"; File: "WormExploit.exe") file/memory contains long string with (Indicator: "base64"; File: "WormExploit.exe") file/memory contains long string with (Indicator: "createdecryptor"; File: "WormExploit.exe") file/memory contains long string with (Indicator: "createencryptor"; File: "WormExploit.exe") file/memory contains long string with (Indicator: "GzipStream"; File: "WormExploit.exe") file/memory contains long string with (Indicator: "ToBase64String"; File: "WormExploit.exe") file/memory contains long string with (Indicator: "md5cryptoserviceprovider"; File: "WormExploit.exe") file/memory contains long string with (Indicator: "rijndael"; File: "WormExploit.exe") file/memory contains long string with (Indicator: "Rijndaelmanaged"; File: "WormExploit.exe") file/memory contains long string with (Indicator: "System.Security.Cryptography"; File: "WormExploit.exe") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; File: "00000000-00004868.00000000.124318.011E1000.00000020.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00004868.00000000.124318.00E50000.00000004.mdmp, 00000000-00004868.00000000.124318.07720000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004868.00000000.124318.00F33000.00000004.mdmp, 00000000-00004868.00000000.124318.07720000.00000004.mdmp") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00004868.00000000.124318.011E1000.00000020.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004868.00000000.124318.011E1000.00000020.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004868.00000000.124318.011E1000.00000020.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004868.00000000.124318.011E1000.00000020.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004868.00000000.124318.011E1000.00000020.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004868.00000000.124318.011E1000.00000020.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004868.00000000.124318.011E1000.00000020.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004868.00000000.124318.011E1000.00000020.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004868.00000000.124318.011E1000.00000020.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00004868.00000000.124318.050F0000.00000004.mdmp") Found string "[-WindowStyle