21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 52:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T482,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan/PS.Runner Sample 6f32089bf357… — Score 58/100 — Hybrid Analysis","description":"Malicious verdict for sample 6f32089bf357…. Malware family: Trojan/PS.Runner. Threat score 58/100. 3/26 AV engines flagged this file. 2 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6f32089bf35798e207feb07417b06a73aac6f27d3ca30a3f6963c90b63a5e303","keywords":["Malicious","Trojan/PS.Runner","malware analysis","sandbox report","threat intelligence","6f32089bf35798e207feb07417b06a73aac6f27d3ca30a3f6963c90b63a5e303"],"about":{"@type":"SoftwareApplication","name":"hxhgr.ps1","applicationCategory":["powershell","ps"],"identifier":"6f32089bf35798e207feb07417b06a73aac6f27d3ca30a3f6963c90b63a5e303","additionalType":"Malicious sample"},"threatScore":58,"malwareFamily":"Trojan/PS.Runner","antivirusDetections":{"malicious":3,"total":26},"behavioralIndicators":{"malicious":2,"suspicious":4},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T7f4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAFvElEQVR4XuWWeWxTdQCATTwQlfin0WhiDBoiJmict4kaJ3KJAaJoVGK2ZDpYxCMcATUDowYUNjYQHOI2kLGxju6AdetYz/XYunZX1x1sUOiOdl3pGGu3tWOf720uo90Nf/pLvvyaNHnf9977vd97d9zx37DZbNwuJpOJ+Ph4xo45pyEeYHh4eFJu3LgxDUMMDY3S0tKCQqEgNjZ27hGTB4TLwhmXi3R1daHVatHr9URHR88tYmJAuCycUPkYZrOZtrY2jEYjMTExs48IDQiXhYqnkg8NBbFYLAQCAdxuN+Xl5cTFxc0uYixgonDmsxbFIsFgcOTy+3w++vr6cDgclJSUEBUVNXOEGDBRODe5SH5+PtnZ2WRlZY0glUqRyWS3GxAunVw+SmAE8Xji7VAqlRQVFd1qwPT3O1Q8LhfXwDiDWK3WWwkIF0531lPLxwj3TRihAeHS25MPDs4pIFw6nXxUPJN8DgHh0nG5tKCQUq2eUo0OuUCxSodMrSNfUYa0VCvM2pE5p0RLtlzLKbmak8VqTsjUpMuU/HW2lJRCDbsTD08eIwZMJhZxCVuspKAIX2CI60PgDQ7jDQxT6/ZhbL9GmaOHis5emq4JC87Tj8Xtp9zVh67jOuq2a5y/7EUlIGnsYvOuX2cbMH7JdXojxUYLTn8AlSdIkXuQc90BvjO2cabFg9HZxyclrXxtdrOz3ss3tVeJsXTzuamLTw0drFNf4YeKdv4wNPNZzKbZBITe7wKZHHWDnTrvIFLXIKfa+0lv62d7VRcJ1Z0IFwRFey+v59QTZfawwdTNBwYXazUdrFFc5p3CFn4yOth/Tseq1WumC5hsoQX5R5KH5qKTYpeflCt+Dlz0sbelj611XpbLWtlr6WTgxjApVicRuU2s0Dl5V+kgstjOm2cv8EqOjZ0aO7tTJUQuWzZ9QLhcXMkpmTkoWl0cu9zHzxeus6Ohl68F+UaBT4UzfjKjjiMNboTlwR5zOwsljTyT28zCLCuPpVexKK2SqLONbNxzmKVLl04dEC4XHy/xhXJQWoysyUl8Uy+b63v4otrLBkG81uRhcaGd1wovUur00TYQ5KuKDu5ONrAgtYb7/zQxL0nPoj+NfCSpYsOWeN77aIrvhNCA0Wd7YKAfXbmJRLmBVOHyxtb2sL7Sw3JDN0vkbdx33Mp6tYPaawGULh8vZtYIcj33JOp4IKWSBYcM3LtPzXNHhW+DDC1rN0SzatWqmQLGN5be3uvkFMjYq6rje7OTSJ2bJSoXj+Rd4tEMK8mtvTj8QX4su8Tzf1fw0D4ljydpeOA3JfMTtDyYqGX+r+eJSDEQe6yQtyKnuPziGA0I3dU8Hg8pWXnsKLWxWt3BEyWdPFzUwV2Si7x6tgVNt5+VebaRs4wraUIuPOvSZjfz95Ry5x4l8wT5vF2FPJ2sJTopk4iIl2YOuHlLtdoa+P1ENgkqK3F6Bx9rL7NOZWel8My/caaOF7KqePl0NcvONbKywMbyMzVEnqokIknOijQNa04a+SC9jHXHDXz20yGeff7F6QPC9/NcuYLkkznYL9npdbu46uwcwevqpKfLiVfYIXuE3011NZjLDVgqyqkxm6gzGSnKz6VCX8bVdjtVtmbWf/kti56NmE3A+IvkUGYux3JlNAn/2ZsbaGlsoHWMpkYuNTdTX11NXo6EjBNpZJ48Tr40h6vCrTuQmMDpUxmYytScU+qJfP9D7lmwYKaA0LfY3swC0otUKIStWKEzUFpmFBBnEf3IXKzSojGYMJqrMFRWCbMFlUbLackZausb0ZdXcji7kJfeeHtquThuDhh7hX6XeJQtB9PYfuQEW/84ztZD6QJpbD0oksq2ZBHh/6S/2XbgmMBfbEs4yje/JLJ9/xGBFHYmpbJp1z6eWrR45oAx8SgDIQwMiPRPoL9fxD8lfr+Ib3q5OEIDwsW3J59DwGRnfavyUfGsA/63419VriCx/9vdmwAAAABJRU5ErkJggg==23:T4f9,"powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\70GB5IE8B7M98419CZQI.temp" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF2cc03c.TMP" "powershell.exe" touched file "C:\Windows\System32\CatRoot" "powershell.exe" touched file "C:\Windows\System32\catroot2" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\70GB5IE8B7M98419CZQI.temp" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF2cc03c.TMP" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive" "powershell.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive"24:Ta2a,"powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\LINKINFO.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\LINKINFO.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\NTSHRUI.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\ntshrui.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\SSPICLI.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\SspiCli.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\SRVCLI.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\srvcli.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CSCAPI.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\cscapi.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll"25:T403,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API "6804568544,5176,3120,,CreateToolhelp32Snapshot,kernel32.dll,"00:49:36.890",RX=0,PX=0" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00005180.00000000.190651.74FD0000.00000004.mdmp")26:T426,"powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA")27:T8d6,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe (UID: 00000000-00001880) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001880) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00001880) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001880) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00001880) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00001880) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00001880) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00001880) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00001880) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00001880) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00001880) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00001880) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00001880) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00001880) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00001880) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00001880) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00001880) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00001880) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00001880) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00001880)28:T966,"powershell.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 2496) "powershell.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 2496) "powershell.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 2480) "powershell.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 2480) "powershell.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 2500) "powershell.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 2500) "powershell.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1976) "powershell.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1976) "powershell.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 2488) "powershell.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 2488) "powershell.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1220) "powershell.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1220) "powershell.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1932) "powershell.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1932) "powershell.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 156) "powershell.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 156) "powershell.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 736) "powershell.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 736)29:Ta26,"powershell.exe" queried SystemProcessInformation at 00000000-00001880-00000C15-1905167032 [PID: 1880] "powershell.exe" queried SystemProcessInformation at 00000000-00001880-00000C15-1905174439 [PID: 1880] "powershell.exe" queried SystemProcessInformation at 00000000-00001880-00000C15-1906075808 [PID: 1880] "powershell.exe" queried SystemProcessInformation at 00000000-00001880-00000C15-1906083469 [PID: 1880] "powershell.exe" queried SystemProcessInformation at 00000000-00001880-00000C15-1908517997 [PID: 1880] "powershell.exe" queried SystemProcessInformation at 00000000-00001880-00000C15-1908526652 [PID: 1880] "powershell.exe" queried SystemProcessInformation at 00000000-00001880-00000C15-1908705686 [PID: 1880] "powershell.exe" queried SystemProcessInformation at 00000000-00001880-00000C15-1908732420 [PID: 1880] "powershell.exe" queried SystemProcessInformation at 00000000-00001880-00000C15-1909229938 [PID: 1880] "powershell.exe" queried SystemProcessInformation at 00000000-00001880-00000C15-1910183681 [PID: 1880] "powershell.exe" queried SystemProcessInformation at 00000000-00001880-00000C15-1910192315 [PID: 1880] "powershell.exe" queried SystemProcessInformation at 00000000-00001880-00000C15-1910522640 [PID: 1880] "powershell.exe" queried SystemProcessInformation at 00000000-00001880-00000C15-1910530639 [PID: 1880] "powershell.exe" queried SystemProcessInformation at 00000000-00002420-00000C15-1916798565 [PID: 2420] "powershell.exe" queried SystemProcessInformation at 00000000-00002420-00000C15-1916806921 [PID: 2420] "powershell.exe" queried SystemProcessInformation at 00000000-00002420-00000C15-1918275842 [PID: 2420] "powershell.exe" queried SystemProcessInformation at 00000000-00002420-00000C15-1918283944 [PID: 2420] "powershell.exe" queried SystemProcessInformation at 00000000-00002420-00000C15-1919029240 [PID: 2420] "powershell.exe" queried SystemProcessInformation at 00000000-00002420-00000C15-1919036911 [PID: 2420] "powershell.exe" queried SystemProcessInformation at 00000000-00002420-00000C15-1919343859 [PID: 2420] "powershell.exe" queried SystemProcessInformation at 00000000-00002420-00000C15-1919351301 [PID: 2420] "powershell.exe" queried SystemProcessInformation at 00000000-00002420-00000C15-1919715621 [PID: 2420] "powershell.exe" queried SystemProcessInformation at 00000000-00002420-00000C15-1919724057 [PID: 2420] "powershell.exe" queried SystemProcessInformation at 00000000-00002508-00000C15-1927287981 [PID: 2508] "powershell.exe" queried SystemProcessInformation at 00000000-00002508-00000C15-1927322226 [PID: 2508]2a:T11bc,"powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "23d2b96bb30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e0552a473d020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "23d2b96bb30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "10562a473d020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "23d2b96bb30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "80582a473d020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "23d2b96bb30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "90cb2b473d020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "23d2b96bb30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e0c92b473d020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "23d2b96bb30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "70cd2b473d020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "23d2b96bb30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "105c2a473d020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "23d2b96bb30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "00512a473d020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "23d2b96bb30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "c01232473d020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "23d2b96bb30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "d00b32473d020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "23d2b96bb30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "600f32473d020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "23d2b96bb30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "d00832473d020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "23d2b96bb30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e00732473d020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "23d2b96bb30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "801332473d020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "23d2b96bb30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "c0bf31473d020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "23d2b96bb30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "00bf31473d020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "23d2b96bb30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e0c631473d020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "23d2b96bb30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e0bd31473d020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "23d2b96bb30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "10d031473d020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "23d2b96bb30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "40cd31473d020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "23d2b96bb30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "90c831473d020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "23d472c5ef0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "k0G=" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"}2b:Tc1a,"powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "513E13D413EADC010000000000000000000000000200000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "B40E9DF313EADC010000000000000000000000000200000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "F72AADF913EADC010000000000000000000000000200000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "E9E4BAFF13EADC010000000000000000000000000200000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "813CC60514EADC010000000000000000000000000200000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "1894D10B14EADC010000000000000000000000000200000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "B0EBDC1114EADC010000000000000000000000000200000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "99A5EA1714EADC010000000000000000000000000200000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "875FF81D14EADC010000000000000000000000000200000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "C97B082414EADC010000000000000000000000000200000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US")2c:Ta89,"powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\DESKTOP.INI" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\70GB5IE8B7M98419CZQI.TEMP" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\70GB5IE8B7M98419CZQI.temp" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.XAML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.xaml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSD1"2d:T8c4,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.SYSTEM.TRANSACTIONS__B77A5C561934E089"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.SYSTEM.TRANSACTIONS__B77A5C561934E089"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\STANDARDS"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\STANDARDS\V4.0.30319"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER TYPES\TYPE 001"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT STRONG CRYPTOGRAPHIC PROVIDER"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OFFLOAD"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.3.0.SYSTEM.MANAGEMENT.AUTOMATION.RESOURCES_EN-US_31BF3856AD364E35"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.3.0.SYSTEM.MANAGEMENT.AUTOMATION.RESOURCES_EN-US_31BF3856AD364E35"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG"; Key: ""; Value: "")2e:Tc63,"powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\crypt32" (Filter: 268435460; Subtree: 0) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\Root" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\FlightRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config" (Filter: 268435461; Subtree: 1)2f:T5f7,"2.5.29.37" "2.5.29.35" "192.168.0.2" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" "2.5.29.17" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "10.0.0.0" found in string "icrosoft.JScript,10.0.0.0,,b03f5f7f11d50a3a,MSIL" "2.5.29.3" "2.5.29.19" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.31" "2.5.29.32" "2.5.29.15" "2.5.29.14" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.4.6" "2.5.29.1" "2.5.29.10" "2.5.4.3" "2.5.4.8" "2.5.4.7" "2.5.4.11" "2.5.4.5" "2.5.4.10" "2.5.29.16" "1.12.1.3" Potential IP "4.0.0.0" found in string "ystem.Management,4.0.0.0,,b03f5f7f11d50a3a" Potential IP "4.0.0.0" found in string "ystem.Numerics,4.0.0.0,,b77a5c561934e089" Potential IP "4.0.0.0" found in string "n=4.0.0.0, Cultu" Potential IP "4.0.0.0" found in string "ystem.DirectoryServices,4.0.0.0,,b03f5f7f11d50a3a" Potential IP "4.0.0.0" found in string "ystem.Xml,4.0.0.0,,b77a5c561934e089" Potential IP "4.0.0.0" found in string "ersion=4.0.0.0, Culture=neutral, Publi" "14.0.0.0000000" Potential IP "1.0.16.0" found in string "=1.0.16.0, Cultur" Potential IP "4.0.0.0" found in string "ystem.Runtime.Caching,4.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "4.0.0.0" found in string "ystem.EnterpriseServices,4.0.0.0,,b03f5f7f11d50a3a,AMD64" Potential IP "4.0.0.0" found in string "ystem.Data,4.0.0.0,,b77a5c561934e089" "3.0.0.0"30:T5bc,Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Wind ..." (UID: 00000000-00002420), Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Wind ..." (UID: 00000000-00002508) Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Wind ..." (UID: 00000000-00003336), Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Wind ..." (UID: 00000000-00005180) Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Wind ..." (UID: 00000000-00006388), Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Wind ..." (UID: 00000000-00007240) Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Wind ..." (UID: 00000000-00000656), Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Wind ..." (UID: 00000000-00005284) Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Wind ..." (UID: 00000000-00003192), Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Wind ..." (UID: 00000000-00007136)31:T8be,Process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1"" (UID: 00000000-00002420) Process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1"" (UID: 00000000-00002508) Process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1"" (UID: 00000000-00003336) Process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1"" (UID: 00000000-00005180) Process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1"" (UID: 00000000-00006388) Process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1"" (UID: 00000000-00007240) Process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1"" (UID: 00000000-00000656) Process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1"" (UID: 00000000-00005284) Process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1"" (UID: 00000000-00003192) Process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1"" (UID: 00000000-00007136)32:Tc99,"powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "0O" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "0V" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "0Q" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "b0108a473d020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b0388a473d020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b0418a473d020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b01f8a473d020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b03f8a473d020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b0118a473d020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b02a8a473d020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b0228a473d020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b0398a473d020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b0158a473d020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b03d8a473d020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b0218a473d020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b0358a473d020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b0268a473d020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b0468a473d020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b02b8a473d020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b01c8a473d020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b0258a473d020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "b0358a473d020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "b04a8a473d020000" "szProvider": "Microsoft Enhanced RSA and AES Cryptographic Provider" "dwProvType": "24" "dwFlags": "4026531840"}33:T21fc,"powershell.exe" called "CryptImportKey" with parameters {"hProv": "23d2b944f30" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "d0da29473d020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "23d2b944f30" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "50de29473d020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "23d2b944f30" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "80e029473d020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "23d2b945630" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "80882c473d020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "23d2b945630" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "208b2c473d020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "23d2b945630" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "d0822c473d020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "23d2b944f30" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "60822c473d020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "23d2b944f30" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "907d2c473d020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "23d2b944f30" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "40832c473d020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "23d2b944f30" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "b0832c473d020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "23d2b944f30" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "401930473d020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "23d2b945630" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "d01130473d020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "23d2b944f30" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "200c30473d020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "23d2b944f30" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "b00b30473d020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "23d2b944f30" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "d00a30473d020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "23d2b944f30" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "a01630473d020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "23d2b945130" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "801730473d020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "23d2b945130" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "c01530473d020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "23d2b945130" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "d00a30473d020000"}34:T919,Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00000656.00000000.192598.90030000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000656.00000000.192598.AA3C0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00002420.00000000.188679.2E6C0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002420.00000000.188679.2E6C0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00002508.00000000.189350.7E020000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002508.00000000.189350.7E020000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00003192.00000000.193899.FE6B0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003192.00000000.193899.FF6E0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00003336.00000000.190001.151E0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003336.00000000.190001.2F5E0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00005180.00000000.190651.72C80000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005180.00000000.190651.74FD0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00005284.00000000.193248.167F0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005284.00000000.193248.30B00000.00000004.mdmp")35:Tde2b,"powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00001880) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00002420) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002508) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00003336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006388) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00007240)36:Tbf8,Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00000656.00000000.192598.90030000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00000656.00000000.192598.90030000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00002420.00000000.188679.2E6C0000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00002420.00000000.188679.48B40000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00002508.00000000.189350.18720000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00002508.00000000.189350.18720000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00003192.00000000.193899.FF6E0000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00003192.00000000.193899.FF6E0000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00003336.00000000.190001.2F5E0000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00003336.00000000.190001.2F5E0000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00005180.00000000.190651.72C80000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00005180.00000000.190651.72C80000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00005284.00000000.193248.30B00000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00005284.00000000.193248.30B00000.00000004.mdmp")37:T835,"powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2026"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")38:T95b,Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1880:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1880:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1880:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1880:120:WilError_01" Process powershell.exe created mutex with name "SM0:1880:120:WilError_01" Process powershell.exe created mutex with name "Local\SM0:1880:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:1880:120:WilError_01" Process powershell.exe created mutex with name "SM0:1880:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2420:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:2420:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:2420:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2420:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2508:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:2508:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:2508:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2508:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3336:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:3336:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:3336:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3336:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5180:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:5180:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:5180:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5180:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6388:304:WilStaging_02"39:T13c06,Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00000656.00000000.192598.90030000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3s" - Source: "00000000-00000656.00000000.192598.90030000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czc2.5.29.1bhv*8tpas" - Source: "00000000-00000656.00000000.192598.AA3C0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?es&i5globalsign" - Source: "00000000-00000656.00000000.192598.AA3C0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00000656.00000000.192598.AA3C0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00000656.00000000.192598.AA3C0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00000656.00000000.192598.AA3C0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00000656.00000000.192598.AA3C0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00000656.00000000.192598.AA3C0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;s6i5addtrust" - Source: "00000000-00000656.00000000.192598.AA3C0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00000656.00000000.192598.AA3C0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00000656.00000000.192598.AA3C0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00000656.00000000.192598.AA3C0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00000656.00000000.192598.AA3C0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000656.00000000.192598.AA3C0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0sgo5sij5sjq51.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00000656.00000000.192598.AA3C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00000656.00000000.192598.AA3C0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00000656.00000000.192598.AA3C0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00000656.00000000.192598.AA3C0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00000656.00000000.192598.AA3C0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000656.00000000.192598.AA3C0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00000656.00000000.192598.AA3C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000656.00000000.192598.AA469000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>ss(5ssk5casmcasmwindowsah/\nodejscture=amd64proces50a3abws\docus\system32\wblicses6/\local\t" - Source: "00000000-00000656.00000000.192598.AA469000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00000656.00000000.192598.AA469000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00000656.00000000.192598.ABD50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00000656.00000000.192598.ABD50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000656.00000000.192598.ABD50000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czc(b.9" - Source: "00000000-00002420.00000000.188679.48B40000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00002420.00000000.188679.48B40000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002420.00000000.188679.48B40000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002420.00000000.188679.48B40000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00002420.00000000.188679.48B40000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002420.00000000.188679.48B40000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002420.00000000.188679.48B40000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;9?dwhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002420.00000000.188679.48B40000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3p" - Source: "00000000-00002420.00000000.188679.48B40000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002420.00000000.188679.48B40000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002420.00000000.188679.48B40000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002420.00000000.188679.48B40000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnh7&z" - Source: "00000000-00002420.00000000.188679.48B40000.00000004.mdmp") Found URL "http://www.1.3.36.3.3.2.8.1.1.13ecdp1.2.840.10045.3.1.2ecdpcrosoft" - Source: "00000000-00002420.00000000.188679.48B40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washisgcwnpgbwtgnwxgjw" - Source: "00000000-00002420.00000000.188679.48C19000.00000004.mdmp") Found URL "http://www.microsoft.comg" - Source: "00000000-00002420.00000000.188679.48C19000.00000004.mdmp") Found URL "http://crl.microsofi/crl/products/mictimstapca_2010-07-01.crl0zo/>" - Source: "00000000-00002420.00000000.188679.48C19000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002420.00000000.188679.48C19000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wwashington1redmond1microsoft" - Source: "00000000-00002420.00000000.188679.48C19000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002420.00000000.188679.48C19000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00002420.00000000.188679.4A460000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002420.00000000.188679.4A460000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002420.00000000.188679.4A460000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002508.00000000.189350.18720000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.cr[(;1fwr/290211235959z0greater" - Source: "00000000-00002508.00000000.189350.18720000.00000004.mdmp") Found URL "http://ocsp.comodoca.com0z" - Source: "00000000-00002508.00000000.189350.18720000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002508.00000000.189350.18720000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002508.00000000.189350.18720000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002508.00000000.189350.18720000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lgreater" - Source: "00000000-00002508.00000000.189350.18720000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002508.00000000.189350.18720000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002508.00000000.189350.18720000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002508.00000000.189350.18720000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002508.00000000.189350.18720000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00002508.00000000.189350.18720000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?evj" - Source: "00000000-00002508.00000000.189350.18720000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002508.00000000.189350.18720000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002508.00000000.189350.18720000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00002508.00000000.189350.18720000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002508.00000000.189350.18720000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002508.00000000.189350.18720000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;f$eogtt3;6n5-o6n5)o6n5*o6n5'o6n5>o6n5:o6n54o6n53o56n5" - Source: "00000000-00002508.00000000.189350.18720000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002508.00000000.189350.18720000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002508.00000000.189350.18720000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002508.00000000.189350.18720000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002508.00000000.189350.18720000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002508.00000000.189350.18720000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]" - Source: "00000000-00002508.00000000.189350.18720000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002508.00000000.189350.18720000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00002508.00000000.189350.18720000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002508.00000000.189350.18720000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00002508.00000000.189350.18720000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>696," - Source: "00000000-00002508.00000000.189350.18720000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fe" - Source: "00000000-00002508.00000000.189350.187CD000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@" - Source: "00000000-00002508.00000000.189350.187CD000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>" - Source: "00000000-00002508.00000000.189350.187D2000.00000004.mdmp") Found URL "http://crl.m.com/pki/crl/products/microoceraut_2010-06-23.crl0z>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0microsoft" - Source: "00000000-00002508.00000000.189350.187D2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002508.00000000.189350.187D2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002508.00000000.189350.187D2000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00002508.00000000.189350.1A0F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002508.00000000.189350.1A0F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002508.00000000.189350.1A0F0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czccth" - Source: "00000000-00003192.00000000.193899.FF6E0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00003192.00000000.193899.FF6E0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00003192.00000000.193899.FF6E0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00003192.00000000.193899.FF6E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00003192.00000000.193899.FF6E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00003192.00000000.193899.FF6E0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00003192.00000000.193899.FF6E0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00003192.00000000.193899.FF6E0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003192.00000000.193899.FF6E0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003192.00000000.193899.FF6E0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003192.00000000.193899.FF6E0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003192.00000000.193899.FF6E0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003192.00000000.193899.FF6E0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0root" - Source: "00000000-00003192.00000000.193899.FF6E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00003192.00000000.193899.FF6E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00003192.00000000.193899.FF6E0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00003192.00000000.193899.FF6E0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00003192.00000000.193899.FF6E0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00003192.00000000.193899.FF6E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn9iqmgvw,czc0)^/ion1pprogramdata=c:\programdatalogonserver=\\desktop-fvvf82auserprofile=c:\users\hapubwsonedrive=c:\users\hapubws\onedriveprogramw6432=c:\program" - Source: "00000000-00003336.00000000.190001.2F5E0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e460)^/globalsign" - Source: "00000000-00003336.00000000.190001.2F5E0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00003336.00000000.190001.2F5E0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00003336.00000000.190001.2F5E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00003336.00000000.190001.2F5E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00003336.00000000.190001.2F5E0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00003336.00000000.190001.2F5E0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;" - Source: "00000000-00003336.00000000.190001.2F5E0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003336.00000000.190001.2F5E0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003336.00000000.190001.2F5E0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003336.00000000.190001.2F5E0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003336.00000000.190001.2F5E0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l@dc/p!_/microsoft" - Source: "00000000-00003336.00000000.190001.2F5E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00003336.00000000.190001.2F5E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?p)a/c'a/secom" - Source: "00000000-00003336.00000000.190001.2F5E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003336.00000000.190001.2F5E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00003336.00000000.190001.2F5E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003336.00000000.190001.2F691000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003336.00000000.190001.2F691000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003336.00000000.190001.2F691000.00000004.mdmp") Found URL "http://mstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003336.00000000.190001.2F691000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>s\wimodules;?powershell\modules;c:\windows\system32\windowspowershell\v1.0\modules\;c:\program" - Source: "00000000-00003336.00000000.190001.2F691000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00003336.00000000.190001.2F691000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1l0j" - Source: "00000000-00003336.00000000.190001.2F691000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsqst*washington1redmond1microsoft" - Source: "00000000-00003336.00000000.190001.2F691000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00003336.00000000.190001.30F00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003336.00000000.190001.30F00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003336.00000000.190001.30F00000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005180.00000000.190651.72C80000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00005180.00000000.190651.74FD0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czco!yjthawte," - Source: "00000000-00005180.00000000.190651.74FD0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e2.5.29.1bhv*8tpa2.5.4.3globalsign" - Source: "00000000-00005180.00000000.190651.74FD0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005180.00000000.190651.74FD0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005180.00000000.190651.74FD0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005180.00000000.190651.74FD0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005180.00000000.190651.74FD0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005180.00000000.190651.74FD0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00005180.00000000.190651.74FD0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005180.00000000.190651.74FD0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005180.00000000.190651.74FD0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005180.00000000.190651.74FD0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005180.00000000.190651.74FD0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005180.00000000.190651.74FD0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0(erissxc\*2.5.29.10" - Source: "00000000-00005180.00000000.190651.74FD0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005180.00000000.190651.74FD0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00005180.00000000.190651.74FD0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005180.00000000.190651.74FD0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005180.00000000.190651.74FD0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005180.00000000.190651.74FD0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005180.00000000.190651.74FD0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00005180.00000000.190651.74FD0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linki" - Source: "00000000-00005180.00000000.190651.74FD0000.00000004.mdmp") Found URL "https://go.microsoft.c5z8mwashington1redmond1microsoft" - Source: "00000000-00005180.00000000.190651.74FD0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005180.00000000.190651.74FD0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00005180.00000000.190651.768F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005180.00000000.190651.768F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005180.00000000.190651.768F0000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00005284.00000000.193248.30B00000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcwashington1redmond1microsoft" - Source: "00000000-00005284.00000000.193248.30B00000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lthawte," - Source: "00000000-00005284.00000000.193248.30B00000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00005284.00000000.193248.30B00000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005284.00000000.193248.30B00000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005284.00000000.193248.30B00000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005284.00000000.193248.30B00000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005284.00000000.193248.30B00000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005284.00000000.193248.30B00000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00005284.00000000.193248.30B00000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005284.00000000.193248.30B00000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005284.00000000.193248.30B00000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005284.00000000.193248.30B00000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005284.00000000.193248.30B00000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005284.00000000.193248.30B00000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eris" - Source: "00000000-00005284.00000000.193248.30B00000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005284.00000000.193248.30B00000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00005284.00000000.193248.30B00000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005284.00000000.193248.30B00000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005284.00000000.193248.30B00000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005284.00000000.193248.30B00000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005284.00000000.193248.30B00000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00005284.00000000.193248.30B00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>1.2.840.10045.3.1.2ecdp1.3.36.3.3.2.8.1.1.10@eckp@1.3.36.3.3.2.8.1.1.12ecdp1.2.840.10045.3.1.1ecdp1.3.36.3.3.2.8.1.1.11ecdp1.2.840.10045.3.1.7ecdp1.3.36.3.3.2.8.1.1.14ecdp1.2.156.11235.1.1.2.1ecdp1.2.840.10045.3.1.1ecdp1.3.36.3.3.2.8.1.1.11@eckp1.2.840.10045.3.1.7@eckp1.2.840.10045.3.1.1ecdp1.2.840.10045.3.1.3@eckp1.2.840.10045.3.1.6@eckp1.2.840.10045.3.1.4@eckp1.2.840.10045.3.1.6ecdp1.3.36.3.3.2.8.1.1.14@eckp1.2.840.10045.3.1.7@eckp1.2.840.10045.3.1.1@eckp1.2.156.11235.1.1.2.1@eckp1.3.36.3.3.2.8.1.1.10ecdp@1.2.840.10045.3.1.1@eckp1.2.840.10045.3.1.3ecdp1.3.36.3.3.2.8.1.1.13ecdp1.2.840.10045.3.1.4ecdp1.2.840.10045.3.1.5@eckp1.2.840.10045.3.1.7ecdp1.3.36.3.3.2.8.1.1.13@eckp1.3.36.3.3.2.8.1.1.12@eckp1.2.840.10045.3.1.7ecdp1.2.840.10045.3.1.2@eckp1.2.840.10045.3.1.5ecdprsa1(]b,=t]o-rsa1-g!" - Source: "00000000-00005284.00000000.193248.30B00000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>1.3.6.1.4.1.311.60.3.2microsoft.management.infrastructure.dllsystem.directoryservices.dllcurl_ca_bundle=c:\users\hapubws\.mitmproxy\mitmproxy-ca-cert.cer1.3.6.1.4.1.311.10.3.6microsoft.management.infrastructure.dllprocessor_identifier=intel64" - Source: "00000000-00005284.00000000.193248.30BB1000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00005284.00000000.193248.30BB1000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005284.00000000.193248.30BB7000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005284.00000000.193248.30BB7000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005284.00000000.193248.30BB7000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00005284.00000000.193248.32490000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005284.00000000.193248.32490000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005284.00000000.193248.32490000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czco!yj)" - Source: "00000000-00006388.00000000.191300.F8FF0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006388.00000000.191300.F8FF0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006388.00000000.191300.F8FF0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006388.00000000.191300.F8FF0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006388.00000000.191300.F8FF0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006388.00000000.191300.F8FF0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006388.00000000.191300.F8FF0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00006388.00000000.191300.F8FF0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006388.00000000.191300.F8FF0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006388.00000000.191300.F8FF0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006388.00000000.191300.F8FF0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006388.00000000.191300.F8FF0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00006388.00000000.191300.F8FF0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows*m1aus1!0the" - Source: "00000000-00006388.00000000.191300.F8FF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006388.00000000.191300.F8FF0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3geotrust" - Source: "00000000-00006388.00000000.191300.F8FF0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006388.00000000.191300.F8FF0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006388.00000000.191300.F8FF0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00006388.00000000.191300.F90AB000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00006388.00000000.191300.F90AB000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00006388.00000000.191300.F90AB000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623621" - Source: "00000000-00006388.00000000.191300.F90AB000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623636" - Source: "00000000-00006388.00000000.191300.F90AB000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00006388.00000000.191300.F90AB000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006388.00000000.191300.F90AB000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006388.00000000.191300.F90AB000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00006388.00000000.191300.F90AB000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>c" - Source: "00000000-00006388.00000000.191300.F90AB000.00000004.mdmp") Found URL "http://crl.m.com/pki/crl/products/miut_2010-06-23.crl0z>http://wwoft.com/pki/certs/microo010-06-23.crt0p://www.microsoft.com/pkps/default.htm0@7" - Source: "00000000-00006388.00000000.191300.F90AB000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00006388.00000000.191300.F94D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006388.00000000.191300.F94D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006388.00000000.191300.F94D0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007240.00000000.191949.3A0C0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007240.00000000.191949.3A0C0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007240.00000000.191949.3A0C0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007240.00000000.191949.3A0C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007240.00000000.191949.3A0C0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007240.00000000.191949.3A0C0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007240.00000000.191949.3A0C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007240.00000000.191949.3A0C0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcsmx8thawte," - Source: "00000000-00007240.00000000.191949.3A0C0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e1.3.6.1.pmscorlibmscorlibbesw[;mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>l$0ht$8ld$@ll$hhl$0ht$8ld$@ll$hhus1%0" - Source: "00000000-00007240.00000000.191949.3A0C0000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00007240.00000000.191949.3A0C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00007240.00000000.191949.3A0C0000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00007240.00000000.191949.3A0C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00007240.00000000.191949.3A0C0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lx8!5h1.3.6.1.4.1.311.92.1.1rosophy\42!70.1!71.3.6.1.4.1.311.64.1.1120531151137z01.3.6.1.4.1.311.80.11.3.6.1.4.1.311.76.6.1path=c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\roaming\nvm;c:\program" - Source: "00000000-00007240.00000000.191949.3A0C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007240.00000000.191949.3A0C0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lx8lhi1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007240.00000000.191949.3A0C0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00007240.00000000.191949.3A0C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007240.00000000.191949.3A0C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007240.00000000.191949.3A0C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>n+" - Source: "00000000-00007240.00000000.191949.3A0C0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00007240.00000000.191949.3BA50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007240.00000000.191949.3BA50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007240.00000000.191949.3BA50000.00000004.mdmp")3a:T3e97,Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00000656.00000000.192598.AA3C0000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00002420.00000000.188679.48C19000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00002420.00000000.188679.48C19000.00000004.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00003192.00000000.193899.FE6B0000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00003192.00000000.193899.FF6E0000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00005180.00000000.190651.74FD0000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00005180.00000000.190651.74FD0000.00000004.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00005284.00000000.193248.167F0000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00005284.00000000.193248.30B00000.00000004.mdmp")3b:Tba1,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135]3c:T6a1,Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API "System.IO.Path]::GetTempFileName()" (Indicator: "GetTempFileName"; Source: "00000000-00005180.00000000.190651.74FD0000.00000004.mdmp")3d:T19c4,"o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00000656.00000000.192598.90030000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00000656.00000000.192598.90030000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00000656.00000000.192598.90030000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00000656.00000000.192598.90030000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00000656.00000000.192598.90030000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00000656.00000000.192598.AA3C0000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.76.6.1!7" in Source: 00000000-00000656.00000000.192598.AA3C0000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00002420.00000000.188679.2E6C0000.00000004.mdmp "th=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C2F03A33-21F5-47FA" in Source: 00000000-00002420.00000000.188679.2E6C0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002420.00000000.188679.2E6C0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002420.00000000.188679.2E6C0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002420.00000000.188679.48B40000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002420.00000000.188679.48B40000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002508.00000000.189350.18720000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00002508.00000000.189350.18720000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002508.00000000.189350.7E020000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00002508.00000000.189350.7E020000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00002508.00000000.189350.7E020000.00000004.mdmp "y\Machine\Software\C" in Source: 00000000-00002508.00000000.189350.7E020000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00003192.00000000.193899.FE6B0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003192.00000000.193899.FF6E0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003192.00000000.193899.FF6E0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003336.00000000.190001.151E0000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00003336.00000000.190001.151E0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003336.00000000.190001.151E0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003336.00000000.190001.151E0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003336.00000000.190001.2F5E0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005180.00000000.190651.72C80000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005180.00000000.190651.72C80000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005180.00000000.190651.72C80000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00005180.00000000.190651.72C80000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005180.00000000.190651.74FD0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005284.00000000.193248.167F0000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00005284.00000000.193248.167F0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005284.00000000.193248.167F0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005284.00000000.193248.167F0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005284.00000000.193248.30B00000.00000004.mdmp3e:T2079,"o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00000656.00000000.192598.90030000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00000656.00000000.192598.90030000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00000656.00000000.192598.90030000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00000656.00000000.192598.90030000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00000656.00000000.192598.90030000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.76.6.1!7" in Source: 00000000-00000656.00000000.192598.AA3C0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00000656.00000000.192598.AA3C0000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00002420.00000000.188679.2E6C0000.00000004.mdmp "th=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C2F03A33-21F5-47FA" in Source: 00000000-00002420.00000000.188679.2E6C0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002420.00000000.188679.2E6C0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002420.00000000.188679.2E6C0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002420.00000000.188679.48B40000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002420.00000000.188679.48B40000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00002508.00000000.189350.18720000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002508.00000000.189350.18720000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002508.00000000.189350.7E020000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00002508.00000000.189350.7E020000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00002508.00000000.189350.7E020000.00000004.mdmp "y\Machine\Software\C" in Source: 00000000-00002508.00000000.189350.7E020000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00003192.00000000.193899.FE6B0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003192.00000000.193899.FF6E0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003192.00000000.193899.FF6E0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003336.00000000.190001.151E0000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00003336.00000000.190001.151E0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003336.00000000.190001.151E0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003336.00000000.190001.151E0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003336.00000000.190001.2F5E0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005180.00000000.190651.72C80000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005180.00000000.190651.72C80000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005180.00000000.190651.72C80000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00005180.00000000.190651.72C80000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005180.00000000.190651.74FD0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005284.00000000.193248.167F0000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00005284.00000000.193248.167F0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005284.00000000.193248.167F0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005284.00000000.193248.167F0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005284.00000000.193248.30B00000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006388.00000000.191300.F6AA0000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00006388.00000000.191300.F6AA0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006388.00000000.191300.F6AA0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006388.00000000.191300.F6AA0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006388.00000000.191300.F8FF0000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00007240.00000000.191949.1FD20000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007240.00000000.191949.1FD20000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007240.00000000.191949.1FD20000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00007240.00000000.191949.1FD20000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007240.00000000.191949.3A0C0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007240.00000000.191949.3A0C0000.00000004.mdmp3f:T5bc,Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Wind ..." (UID: 00000000-00002420), Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Wind ..." (UID: 00000000-00002508) Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Wind ..." (UID: 00000000-00003336), Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Wind ..." (UID: 00000000-00005180) Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Wind ..." (UID: 00000000-00006388), Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Wind ..." (UID: 00000000-00007240) Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Wind ..." (UID: 00000000-00000656), Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Wind ..." (UID: 00000000-00005284) Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Wind ..." (UID: 00000000-00003192), Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Wind ..." (UID: 00000000-00007136)40:Ta54,"powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c005300740061007200740020004d0065006e007500000000000000000000000000000000000000 (UID: 00000000-00001880) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e0065007800650000005c006d0061006300680069006e0065002e0063000500000598c5000030356c2e (UID: 00000000-00002420) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e006500780065000000fb7f00000000000000000000000000000000000005000005df060000f0ce027e (UID: 00000000-00002508) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e0065007800650000005c006d0061006300680069006e0065002e00630005000005979f000030351e15 (UID: 00000000-00003336) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e0065007800650000005c006d0061006300680069006e0065002e00630005000005fd6d00006070c872 (UID: 00000000-00005180) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e006500780065000000710100003023adf6710100007023adf67101000006000006a01d0000d028abf6 (UID: 00000000-00006388) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e0065007800650000005c006d0061006300680069006e0065002e006300050000053f4800003035d21f (UID: 00000000-00007240)41:T4ac,Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00003336.00000000.190001.7AB42000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found reference to API "6262462482,5236,3024,,RtlGetVersion,NTDLL.dll,"00:49:36.671",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00005180.00000000.190651.74FD0000.00000004.mdmp") Found reference to API "8700475864,5176,3024,,RtlGetVersion,NTDLL.dll,"00:49:37.687",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00005180.00000000.190651.74FD0000.00000004.mdmp")42:T4da,"powershell.exe" reads file "C:\Users\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Saved Games\desktop.ini"43:T6fc,"powershell.exe" touched "Custom Destination List" (Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}") "powershell.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "powershell.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "powershell.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "powershell.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "powershell.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "powershell.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "powershell.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "powershell.exe" touched "Property Store over folder final" (Path: "HKCU\CLSID\{0340F119-A598-4ED9-B0AC-6F6A12D3E755}\TREATAS") "powershell.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "powershell.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "powershell.exe" touched "Known Folder Manager" (Path: "HKCU\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32")44:T38f4,"powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001880) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001880) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0acef2d3d020000000000000000000051edd49bfb7f0000000000003d0200000000000000000000b967311694a000002a0000000000000000b7902b3d0200008fecd49bfb7f0000e0acef2d3d020000e0acef2d3d020000000000000000000000000000fb7f0000ffffff7fed39000000000000000000000000000000000000d8cee32d3d0200002a0000000000000069c39c2d3d020000310000000000000058020000000000005c020000000000001100011000000000a0dc4722a100000003a34499fb7f0000a0dc4722a100000000000000000000002b00000000000000000000000000000020b0a22d3d020000b43fa12d3d020000e0cee32d (UID: 00000000-00001880) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000001000000000000000b000000000000000b000000000000005800000000000000000000000000000000000000000000000000120100000000920000000100000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001880) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000360d00000000000080d44722a1000000040000000000000050054b099c01000006000000000000000300000000000000a740a498fb7f0000000000000000000000000000000000000000000000000000010100000000000070db922b3d0200000a000000000000000000000000000000000000000000000043003a005c0055007300650072007300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000498d29bfb7f00000000000000000000000000000000000000000000 (UID: 00000000-00001880) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000a0119e2b3d020000000000000000000000009e2b3d02000000f03122a1000000000000000000000000000000000000000000000000000000000000000000000028002a0000000000c00c9e2b3d0200000200000000000000400000000000000020cd4722a100000000000000000000000000000000000000000000000000000000000000000000000400000000000000200d9e2b3d020000000000000000000000009e2b3d02000000f03122a1000000400000003d0200000000000000000000320000000000000000000000000000000000000000000000ffffffff3d02000000000000 (UID: 00000000-00001880) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000f03122a1000000400000003d0200000000000000000000320000000000000000000000000000000000000000000000ffffffff3d0200000000000000000000000000000000000070d5912b3d02000060e04722a1000000f443912b3d020000609e932b3d02000000000000000000000000000000000000000000000000000000000000000000000000000000000000b046912b3d020000c446912b3d020000b046912b3d020000feffffffffffffff0000000000000000b2f3902b3d020000000000000000000000000000000000000000000000000000f0cd4722a1000000320000000000000020cd4722a100000040cd4722a100000000e9932b (UID: 00000000-00001880) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000fa0c000000000000c0b74722a1000000682670765a7f0000701b4a099c0100001affff7f000000002000000000000000a740a498fb7f00001b800800a10000005806000000000000e8b84722a1000000e30000000000000090d3912b3d0200002b000000000000003801000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f006600740000000000cd0b0000e8be4722a1000000000000000498d29bfb7f00000000000000000000000000000000000064d8e4c0 (UID: 00000000-00001880) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000060189e2b3d020000000000000000000000009e2b3d02000000f03122a100000000000000000000000000000000000000000000000000000000000000000000006c006e0000000000c00c9e2b3d0200000900000000000000800000000000000060b04722a100000000000000000000000000000000000000000000000000000000000000000000000800000000000000a0149e2b3d020000000000000000000000009e2b3d02000000f03122a1000000400000003d0200000000000000000000760000000000000000000000000000000000000000000000ffffffff3d02000000000000 (UID: 00000000-00001880) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000f03122a1000000400000003d0200000000000000000000760000000000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000070d5912b3d020000a0c34722a10000008875932b3d02000080ef952b3d0200000000000000000000000000000000000000000000000000000000000000000000000000000000000000008e2b3d02000000008e2b3d0200001e2cd39bfb7f0000feffffffffffffff0000000000000000f6f3902b3d020000000000000000000000100000000000000000000000000000010200000000000020ef952b3d020000002000000000000033c1d29bfb7f000000500000 (UID: 00000000-00001880) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000d60c00000000000060a94722a1000000a43470765a7f0000e0c14c099c0100002cffff7f000000003200000000000000a740a498fb7f0000f06e942b3d0200009669d69bfb7f00000000000000000000d100000000000000c027962b3d0200003e000000000000000000000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c005300740061007200740020004d0065006e00750000003d020000f011962b (UID: 00000000-00001880) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000e0169e2b3d020000000000000000000000009e2b3d02000000f03122a100000000000000000000000000000000000000000000000000000000000000000000009200940000000000c00c9e2b3d0200000900000000000000b00000000000000000a24722a100000000000000000000000000000000000000000000000000000000000000000000000b00000000000000e0169e2b3d020000000000000000000000009e2b3d02000000f03122a1000000400000003d02000000000000000000009c0000000000000000000000000000000000000000000000ffffffff3d02000000000000 (UID: 00000000-00001880) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000c00c00000000000030a24722a1000000be3b70765a7f0000208f4e099c01000037ffff7f000000003d00000000000000a740a498fb7f000000a24722a100000020a24722a1000000003d972b02000000c600000000000000d08e922b3d02000047000000000000000200000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c005300740061007200740020004d0065006e0075005c00500072006f006700 (UID: 00000000-00001880) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000060159e2b3d020000000000000000000000009e2b3d02000000f03122a10000000000000000000000000000000000000000000000000000000000000000000000a400a60000000000c00c9e2b3d0200001300000000000000c000000000000000d09a4722a100000000000000000000000000000000000000000000000000000000000000000000000c0000000000000060159e2b3d020000000000000000000000009e2b3d02000000f03122a100000040000000000000000000000000000000ae0000000000000000000000000000000000000000000000ffffffff3d02000000000000 (UID: 00000000-00001880) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000ae0c000000000000009b4722a1000000dc4270765a7f0000609c4b099c01000040ffff7f000000004600000000000000a740a498fb7f0000d09a4722a1000000f09a4722a1000000000e080702000000bd00000000000000c0fa912b3d0200005a000000000000000200000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c005300740061007200740020004d0065006e0075005c00500072006f006700 (UID: 00000000-00001880) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000202020720000000000090944722a1000000ffffffffffffffff0100000000000000bc944722a1000000000000003307020233072e0000000000f50000000000000000000000000000002a553a69ef77000009000009000000007ff0ffff7f000000ffffffff000000000004000000000000707d8e2b3d02000090934722a100000090944722a1000000ffffffff00000000000000000000000090934722a1000000e674a398fb7f00007f00000000000000000400000000000000009e2b3d02000000f03122a100000090944722a1000000ffffffff00000000000000000000000000000000000000000000000000000000ffffffff3d02000000000000 (UID: 00000000-00001880) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000f03122a100000090944722a1000000ffffffff00000000000000000000000000000000000000000000000000000000ffffffff3d0200000000000000000000000000000000000070d5912b3d020000e0a64722a10000005867942b3d02000030f3952b3d02000000000000000000000000000000000000000000000000000000000000000000000f000000000000007800000000000000d863942b3d02000040ed932b3d020000feffffffffffffff180000000100000054f4902b3d02000080000000000000000f0000000000000000000000000000000000000000000000d400000000000000570069006e0064006f007700000000000df0ffff (UID: 00000000-00001880) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00001880) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000f88912b3d0200002788912b3d0200000f88912b3d020000000000000000000000000000000000000000000000000000010000004d006900630072006f0073006f0066007400000040fe952b3d020000d7492298fb7f000000000000000000000001962b3d020000000000000000000000b24722a100000060c8912b3d020000c0b14722a1000000ffffffff000000008afc139e8e610000feffffffffffffff00000000000000005aed139e8e610000d0d5912b3d020000d0d5912b3d020000d667d29bfb7f0000e0139e2b3d0200006287a598fb7f000000009e2b3d0200006462ae99fb7f00000000000000000000ffffffff3d02000000000000 (UID: 00000000-00001880) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996ad29bfb7f000000008e2b3d0200000000000000000000000000000000000000008e2b3d020000aaea139e8e610000d667d29bfb7f0000efbe0000000000005844912b3d020000108f942b3d0200005844912b3d020000000000000000000078ff952b3d020000c8b04722a1000000b49d1d98fb7f000060c8912b3d020000d667d29bfb7f0000ffffffff0000000070a5932b3d020000000000000000000000000000000000000100000000000000000000000000000040fe952b3d0200009c961e98fb7f0000a028932b3d0200000c00000000000000080000000000000031d43c9bfb7f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00001880) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996ad29bfb7f000000008e2b3d0200000000000000000000000000000000000000008e2b3d020000aaea139e8e610000d667d29bfb7f0000efbe0000000000005844912b3d020000108f942b3d0200005844912b3d0200000000000000000000c8fb952b3d020000c8b04722a1000000b49d1d98fb7f000060c8912b3d020000d667d29bfb7f0000ffffffff00000000f0a2932b3d020000000000000000000000000000000000000100000000000000000000000000000090fa952b3d0200009c961e98fb7f0000a028932b3d0200000c00000000000000080000000000000031d43c9bfb7f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00001880) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996ad29bfb7f000000008e2b3d0200000000000000000000000000000000000000008e2b3d020000aaea139e8e610000d667d29bfb7f0000efbe0000000000005844912b3d020000108f942b3d0200005844912b3d0200000000000000000000b8f0952b3d020000c8b04722a1000000b49d1d98fb7f000060c8912b3d020000d667d29bfb7f0000ffffffff0000000060ab932b3d020000000000000000000000000000000000000100000000000000000000000000000080ef952b3d0200009c961e98fb7f0000a028932b3d0200000c00000000000000080000000000000031d43c9bfb7f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00001880) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996ad29bfb7f000000008e2b3d0200000000000000000000000000000000000000008e2b3d020000aaea139e8e610000d667d29bfb7f0000efbe0000000000005844912b3d020000108f942b3d0200005844912b3d020000000000000000000078ff952b3d020000c8b04722a1000000b49d1d98fb7f0000209a902b3d020000d667d29bfb7f0000ffffffff00000000b0a6932b3d020000000000000000000000000000000000000100000000000000000000000000000040fe952b3d0200009c961e98fb7f0000a028932b3d0200000c00000000000000080000000000000031d43c9bfb7f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00001880)45:T1a92,Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "??\c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ntrust.net" Pattern match: "www.digicert.com1$0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "www.digicert.com1+0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://www.microsoft.com0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "www.digicert.com1!0" Pattern match: "http://crl.globalsign" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "http://www.microsoft.com/windows" Heuristic match: "5.cat" Heuristic match: "ystem.management.automation.re" Heuristic match: "??\c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "www.geotrust.com/resources/cps0" Pattern match: "www.dig" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010" Pattern match: "http://www.microsoft.com" Heuristic match: "ws\microsoft.net" Pattern match: "http://crl.globalsign.net/root.cr" Pattern match: "www.microsoft.com/pki/certs/microocu" Pattern match: "http://www.microsoft.com/windows0" Heuristic match: "sh;.ms" Heuristic match: "lib.ni" Heuristic match: "osoft.office.in" Pattern match: "obalsign.net/root.cr" Heuristic match: "symcb.co" Pattern match: "microsoft.net/assembly/gac_msil/system/v4.0_4.0.0.0__b77a5c561934e089/system.dll" Pattern match: "icrosoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Heuristic match: "ystem.ma" Heuristic match: "pathext=.com" Heuristic match: "6299.15.cat" Pattern match: "http://crl.glo" Pattern match: "https://go.microsoft.com/fwlink/?linki" Pattern match: "https://go.microsoft.c" Pattern match: "https://go.microsoft.com/fwlink/?linkidq" Heuristic match: "mmands.bt" Heuristic match: "$rowcount = [math]::floor($inputstreamarray.co" Pattern match: "crl.microsoft.com/pki/crl/products/mil" Pattern match: "www.microsoft.com/pki/certs/microob" Pattern match: "www.microsoft.com/pk" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Heuristic match: "ce.in" Heuristic match: "2.0.microsoft.office.in" Heuristic match: ".15.cat"46:Tc66,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}\PROPERTYBAG") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ALLOWEDENUMERATION") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ALLOWEDENUMERATION") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\PROPERTYBAG") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{76FC4E2D-D6AD-4519-A663-37BD56068185}\PROPERTYBAG") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{491E922F-5643-4AF4-A7EB-4E7A138D8174}\PROPERTYBAG") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{33E28130-4E1E-4676-835A-98395C3BC3BB}\PROPERTYBAG") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{33E28130-4E1E-4676-835A-98395C3BC3BB}\PROPERTYBAG") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TERMINAL SERVER") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TERMINAL SERVER") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST\S-1-5-21-735145574-3570218355-1207367261-1001\FDEPLOY") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\PROPERTYBAG") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{DEBF2536-E1A8-4C59-B6A2-414586476AEA}\PROPERTYBAG") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{0F214138-B1D3-4A90-BBA9-27CBC0C5389A}\PROPERTYBAG") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{2400183A-6185-49FB-A2D8-4A392A602BA3}\PROPERTYBAG") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PROPERTYBAG") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{D9DC8A3B-B784-432E-A781-5A1130A75963}\PROPERTYBAG") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\PROPERTYBAG")47:T418,Found string "+ncalrpc:[OLEFBD7503841958243C6DF9159FE2B]" (Indicator: "ncalrpc"; Source: "00000000-00000656.00000000.192598.90030000.00000004.mdmp") Found string "+ncalrpc:[OLE1C8A2757250CBEFCAFD8A9D70543]" (Indicator: "ncalrpc"; Source: "00000000-00002420.00000000.188679.2E6C0000.00000004.mdmp") Found string "+ncalrpc:[OLEC9301874FCFAD71A11EC344653A1]" (Indicator: "ncalrpc"; Source: "00000000-00002508.00000000.189350.7E020000.00000004.mdmp") Found string "+ncalrpc:[OLE3481C3BD04C553FF74FB14392CB4]" (Indicator: "ncalrpc"; Source: "00000000-00003192.00000000.193899.FE6B0000.00000004.mdmp") Found string "+ncalrpc:[OLE4D3530080CF179D39E09605E2D5A]" (Indicator: "ncalrpc"; Source: "00000000-00003336.00000000.190001.151E0000.00000004.mdmp") Found string "+ncalrpc:[OLEA2830337B88B054D7F994822F9B5]" (Indicator: "ncalrpc"; Source: "00000000-00005180.00000000.190651.72C80000.00000004.mdmp") Found string "+ncalrpc:[OLE45D19AA71612EFA3809D4A8E1016]" (Indicator: "ncalrpc"; Source: "00000000-00005284.00000000.193248.167F0000.00000004.mdmp")48:Te4f,Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00000656.00000000.192598.90030000.00000004.mdmp, 00000000-00000656.00000000.192598.AA3C0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00000656.00000000.192598.AA3C0000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00002420.00000000.188679.2E6C0000.00000004.mdmp, 00000000-00002420.00000000.188679.48B40000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00002420.00000000.188679.48B40000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00002508.00000000.189350.18720000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00002508.00000000.189350.18720000.00000004.mdmp") Found string "OFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003192.00000000.193899.FE6B0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003192.00000000.193899.FF6E0000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00003336.00000000.190001.2F5E0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003336.00000000.190001.2F5E0000.00000004.mdmp") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003336.00000000.190001.C11AA000.00000002.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00005180.00000000.190651.72C80000.00000004.mdmp, 00000000-00005180.00000000.190651.74FD0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00005180.00000000.190651.74FD0000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00005284.00000000.193248.167F0000.00000004.mdmp, 00000000-00005284.00000000.193248.30B00000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00005284.00000000.193248.30B00000.00000004.mdmp")49:T459,"powershell.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms" "powershell.exe" reads file "c:\windows\system32\windowspowershell\v1.0\powershell.exe.config" "powershell.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.pb378ec07#\b5ba37e1558ced178a99011a1d659b52\microsoft.powershell.consolehost.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\e43dd9c73ab5615e461bf5109c3facd6\system.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\0d59b0e237d7519417de10cd84bda4e7\system.core.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\system.management.automation.ni.dll.aux"4a:T1e3d,"powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb98a00000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb98a00000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb98a00000 "powershell.exe" loaded module "KERNEL32" at base 7ffb9b620000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffb79bc0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffb96690000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffb98100000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPRESOLVER.DLL" at base 7ffb830d0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffb9b620000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffb946d0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ffb9b0b0000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ffb9bd00000 "powershell.exe" loaded module "CSCAPI.DLL" at base 7ffb8ac60000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffb98c70000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffb9b000000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffb77ea0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ffb998a0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffb980e0000 "powershell.exe" loaded module "VERSION.DLL" at base 7ffb8f6f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffb75920000 "powershell.exe" loaded module "USER32.DLL" at base 7ffb9b6e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffb98a00000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffb79d30000 "powershell.exe" loaded module "NTDLL" at base 7ffb9bd00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffb99530000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffb6a9a0000 "powershell.exe" loaded module "OLE32.DLL" at base 7ffb9b3c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffb99530000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffb9b1d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffb69d30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ffb692b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffb77960000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffb97490000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffb67240000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffb99530000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffb99530000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ffb9bcc0000 "powershell.exe" loaded module "SHELL32.DLL" at base 23d2d910000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ffb989a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ffb989a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffb98e40000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffb7d290000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffb8f6f0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffb7ab30000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ffb98e40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\HWHEV9VH.DLL" at base 7ffb77640000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffb757c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffb668d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffb75450000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffb66020000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffb74eb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffb74d40000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffb98a00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ffb753f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffb72c70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffb75380000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffb72b90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffb65ee0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffb775f0000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffb8f6e0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ffb97f50000 "powershell.exe" loaded module "WLDP.DLL" at base 7ffb970b0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffb72ab0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffb9b620000 "powershell.exe" loaded module "USERENV.DLL" at base 7ffb97f80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffb9b000000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffb99530000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffb651d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffb7a1c0000 "powershell.exe" loaded module "SHELL32.DLL" at base 23948c40000 "powershell.exe" loaded module "SHELL32.DLL" at base 1ab18820000 "powershell.exe" loaded module "SHELL32.DLL" at base 1f12f6e0000 "powershell.exe" loaded module "SHELL32.DLL" at base 20d750d0000 "powershell.exe" loaded module "SHELL32.DLL" at base 171f9720000 "powershell.exe" loaded module "SHELL32.DLL" at base 1bf3a1c00004b:T8be,Process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1"" (UID: 00000000-00002420) Process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1"" (UID: 00000000-00002508) Process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1"" (UID: 00000000-00003336) Process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1"" (UID: 00000000-00005180) Process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1"" (UID: 00000000-00006388) Process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1"" (UID: 00000000-00007240) Process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1"" (UID: 00000000-00000656) Process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1"" (UID: 00000000-00005284) Process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1"" (UID: 00000000-00003192) Process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1"" (UID: 00000000-00007136)4c:T81a,Observed system executable string:"While( $true ){Start-Sleep -Seconds (5) ;try {C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -file 'C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\skjxk.ps1'} catch {}};Start-Sleep -Seconds (30);" [Source: 6f32089bf35798e207feb07417b06a73aac6f27d3ca30a3f6963c90b63a5e303.bin] Observed system executable string:"CFSFAppDataRoamingMICROS~1WindowsfLhGSTARTM~1ProgramsWINDOW~1WINDOW~1.LNKC:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnkdesktop-fvvf82a'KPv'KPv1SPS1SPS/C:\WindowsSystem32WINDOW~1=K$uv1.0m=K$u.=Kgm powershell_ise.exe=Kgm=Kgm.C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exedesktop-fvvf82a'KPv'KPv1SPS1SPS/C:\WindowsSystem32WINDOW~1=K$uv1.0m=K$u.=Kgm powershell_ise.exe=Kgm=Kgm.C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exedesktop-fvvf82a'KPv'KPv1SPS1SPS" [Source: 70GB5IE8B7M98419CZQI.temp] Observed system executable string:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -file 'C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\skjxk.ps1'" [Source: 6f32089bf35798e207feb07417b06a73aac6f27d3ca30a3f6963c90b63a5e303.bin] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00001880-00000BC1-1916336708] Observed system executable string:"%WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe" [Source: 00000000-00001880-00000C2D-2544511264] Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "%LOCALAPPDATA%\ow\LocalLo" [Source: 00000000-00001880-00000C46-27552439276]4d:T9ae,Spawned process "powershell.exe" with commandline "-f "C:\\6f32089bf35798e207feb07417b06a73aac6f27d3ca30a3f6963c90b63a5e303.bin.ps1"" (UID: 00000000-00001880) Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1"" (UID: 00000000-00002420) Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1"" (UID: 00000000-00002508) Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1"" (UID: 00000000-00003336) Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1"" (UID: 00000000-00005180) Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1"" (UID: 00000000-00006388) Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1"" (UID: 00000000-00007240) Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1"" (UID: 00000000-00000656) Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1"" (UID: 00000000-00005284) Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1"" (UID: 00000000-00003192) Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass -file "%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1"" (UID: 00000000-00007136)4e:T400,Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00002420-00000BC0-1917903398") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00000656.00000000.192598.AA3C0000.00000004.mdmp") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00002420.00000000.188679.2E6C0000.00000004.mdmp, 00000000-00002420.00000000.188679.48B40000.00000004.mdmp") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00002508.00000000.189350.18720000.00000004.mdmp") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00003192.00000000.193899.FF6E0000.00000004.mdmp") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00003336.00000000.190001.2F5E0000.00000004.mdmp") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00005180.00000000.190651.74FD0000.00000004.mdmp") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00005284.00000000.193248.30B00000.00000004.mdmp")4f:Tfca,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00001880-00000C2A-1906379009] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00001880-00000C2A-1906774332] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00001880-00000C2A-1906910286] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00001880-00000C2A-1906992769] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00001880-00000C2A-1907139819] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00001880-00000C2A-1907209340] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00001880-00000C2A-1907288387] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00001880-00000C2A-1907342434] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00001880-00000C2A-1907414013] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00001880-00000C2A-1907454862] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00001880-00000C2A-1907523138] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00001880-00000C2A-1907639302] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00001880-00000C2A-1907728909] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00001880-00000C2A-1908058448] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00001880-00000C2A-1908084480] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00001880-00000C2A-1908356396] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00001880-00000C2A-1908363656] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00001880-00000C2A-1908461429] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00001880-00000C2A-1908606435] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00001880-00000C2A-1908710799] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00001880-00000C2A-1908804225] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00001880-00000C2A-1908877925] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00001880-00000C2A-1909021737] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00001880-00000C2A-1909283352] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll" [Source: 00000000-00001880-00000C2A-1909356489]50:Tb98,"powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "513E13D413EADC010000000000000000000000000200000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "B40E9DF313EADC010000000000000000000000000200000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "F72AADF913EADC010000000000000000000000000200000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "E9E4BAFF13EADC010000000000000000000000000200000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "813CC60514EADC010000000000000000000000000200000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "1894D10B14EADC010000000000000000000000000200000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "B0EBDC1114EADC010000000000000000000000000200000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "99A5EA1714EADC010000000000000000000000000200000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "875FF81D14EADC010000000000000000000000000200000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "C97B082414EADC010000000000000000000000000200000000")51:Tdb9,"powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00001880-00000C17-1905905067 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00001880-00000C17-1905922634 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00001880-00000C17-1905926950 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001880-00000C17-1909030821 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00001880-00000C17-1909398912 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00001880-00000C17-1910028911 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00001880-00000C17-1910291256 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001880-00000C17-1911027443 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001880-00000C17-1911178754 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001880-00000C17-1911224731 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002420-00000C17-1919884738 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002508-00000C17-1930511746 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00002508-00000C17-1930658048 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00003336-00000C17-1940464059 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005180-00000C17-1950521729 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006388-00000C17-1960916722 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007240-00000C17-197113598618:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"activity":{"behavior_tags":null,"file_activity":{"dropped_files":[],"extracted_files":[{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"verdict":"undetected"},{"name":"70GB5IE8B7M98419CZQI.temp","sha256":"d25c7c8a78d15bf0285e62835909a7d04d1a2e908b130b2a42799411d096e3fb","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"verdict":"undetected"}],"files_deleted":[],"files_written":[{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\70GB5IE8B7M98419CZQI.temp","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF2cc03c.TMP","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_jeopktii.ezz.psm1","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"path":"PIPE\\srvsvc","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_moqgv5wo.5k0.ps1","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7240:304:WilStaging_02","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"name":"Local\\SM0:2420:304:WilStaging_02","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"name":"SM0:6388:304:WilStaging_02","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1880:120:WilError_01","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5180:304:WilStaging_02","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6388:304:WilStaging_02","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6388:304:WilStaging_02","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7240:304:WilStaging_02","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1880:304:WilStaging_02","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"name":"SM0:2420:304:WilStaging_02","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2420:304:WilStaging_02","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"name":"SM0:3336:304:WilStaging_02","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1880:120:WilError_01","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"name":"Local\\SM0:1880:304:WilStaging_02","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"name":"Local\\SM0:1880:120:WilError_01","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2420:304:WilStaging_02","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"name":"Local\\SM0:2508:304:WilStaging_02","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3336:304:WilStaging_02","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"name":"Local\\SM0:5180:304:WilStaging_02","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"name":"SM0:5180:304:WilStaging_02","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"name":"Local\\SM0:7240:304:WilStaging_02","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1880:304:WilStaging_02","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3336:304:WilStaging_02","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5180:304:WilStaging_02","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"name":"Local\\SM0:6388:304:WilStaging_02","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"name":"SM0:7240:304:WilStaging_02","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"name":"SM0:1880:120:WilError_01","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"name":"SM0:1880:304:WilStaging_02","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"name":"SM0:2508:304:WilStaging_02","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2508:304:WilStaging_02","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"name":"Local\\SM0:3336:304:WilStaging_02","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2508:304:WilStaging_02","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]}]},"network_activity":{"contacted_hosts":[],"dns_resolutions":[],"http_requests":[]},"process_activity":{"all_imported_dlls":["mscoree.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","Microsoft.Management.Infrastructure.ni.dll","clbcatq.dll","System.Data.ni.dll","ntmarta.dll","bcryptprimitives.dll","rsaenh.dll","System.Management.ni.dll","System.Data.dll","VxSSL64.dll","shell32.dll","srvcli.dll","ucrtbase.dll","userenv.dll","clrjit.dll","msvcp_win.dll","vcruntime140_clr0400.dll","amsi.dll","imagehlp.dll","iertutil.dll","secur32.dll","cfgmgr32.dll","cscapi.dll","cryptsp.dll","win32u.dll","windows.storage.dll","advapi32.dll","aepic.dll","System.Numerics.ni.dll","shlwapi.dll","kernel.appcore.dll","ole32.dll","fltLib.dll","linkinfo.dll","sspicli.dll","sechost.dll","cryptbase.dll","version.dll","ucrtbase_clr0400.dll","atl.dll","gpapi.dll","clr.dll","System.Management.Automation.ni.dll","System.Configuration.ni.dll","msvcrt.dll","psapi.dll","MpOAV.dll","uxtheme.dll","sppc.dll","Microsoft.PowerShell.Security.ni.dll","wldp.dll","gdi32.dll","msasn1.dll","ntshrui.dll","msvcp110_win.dll","System.DirectoryServices.ni.dll","mscoreei.dll","MpClient.dll","policymanager.dll","System.Configuration.Install.ni.dll","System.Core.ni.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","hwheV9vH.dll","ELSCore.dll","ntdll.dll","kernel32.dll","rpcrt4.dll","combase.dll","oleaut32.dll","ws2_32.dll","System.Xml.ni.dll","imm32.dll","BCP47Langs.dll","user32.dll","AppResolver.dll","profapi.dll","slc.dll","gdi32full.dll","wintrust.dll","mscorlib.ni.dll","KernelBase.dll","powrprof.dll","System.Transactions.ni.dll","SHCore.dll","propsys.dll","System.ni.dll","System.Transactions.dll","crypt32.dll","cldapi.dll","bcrypt.dll","urlmon.dll"],"processes":[{"command_line":"-f \"C:\\6f32089bf35798e207feb07417b06a73aac6f27d3ca30a3f6963c90b63a5e303.bin.ps1\"","icon":"$22","name":"powershell.exe","normalized_path":"%WINDIR%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe","pid":1880,"ppid":0,"sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","uid":"00000000-00001880"},{"command_line":"-ExecutionPolicy Bypass -file \"%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1\"","name":"powershell.exe","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001880","pid":2420,"ppid":1880,"sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","uid":"00000000-00002420"},{"command_line":"-ExecutionPolicy Bypass -file \"%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1\"","name":"powershell.exe","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001880","pid":2508,"ppid":1880,"sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","uid":"00000000-00002508"},{"command_line":"-ExecutionPolicy Bypass -file \"%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1\"","name":"powershell.exe","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001880","pid":3336,"ppid":1880,"sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","uid":"00000000-00003336"},{"command_line":"-ExecutionPolicy Bypass -file \"%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1\"","name":"powershell.exe","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001880","pid":5180,"ppid":1880,"sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","uid":"00000000-00005180"},{"command_line":"-ExecutionPolicy Bypass -file \"%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1\"","name":"powershell.exe","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001880","pid":6388,"ppid":1880,"sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","uid":"00000000-00006388"},{"command_line":"-ExecutionPolicy Bypass -file \"%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1\"","name":"powershell.exe","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001880","pid":7240,"ppid":1880,"sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","uid":"00000000-00007240"},{"command_line":"-ExecutionPolicy Bypass -file \"%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1\"","name":"powershell.exe","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001880","pid":656,"ppid":1880,"sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","uid":"00000000-00000656"},{"command_line":"-ExecutionPolicy Bypass -file \"%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1\"","name":"powershell.exe","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001880","pid":5284,"ppid":1880,"sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","uid":"00000000-00005284"},{"command_line":"-ExecutionPolicy Bypass -file \"%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1\"","name":"powershell.exe","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001880","pid":3192,"ppid":1880,"sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","uid":"00000000-00003192"},{"command_line":"-ExecutionPolicy Bypass -file \"%LOCALAPPDATA%\\ow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\skjxk.ps1\"","name":"powershell.exe","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001880","pid":7136,"ppid":1880,"sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","uid":"00000000-00007136"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]}],"keys_deleted":[],"keys_modified":[]},"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"analysis_start_time":"2026-05-22T17:49:16+00:00","environment_description":"Windows 10 64 bit","environment_id":160,"id":"6a10971c5870fd9bb709e931","indicators_count":{"informative":145,"malicious":2,"suspicious":6},"is_in_unified_schema":true,"malware_family":"PS.Runner","state":"SUCCESS","submit_name":"6f32089bf35798e207feb07417b06a73aac6f27d3ca30a3f6963c90b63a5e303.bin","tags":["Multi-Process","Extracted Files"],"threat_score":58,"verdict":"malicious"}],"stats":{"contacted_hosts_count":0,"contacted_urls_count":0,"dns_resolutions_count":0,"dropped_files_count":0,"embedded_domains_count":0,"embedded_ips_count":0,"embedded_urls_count":0,"extracted_files_count":2,"files_deleted_count":0,"files_written_count":11,"http_requests_count":0,"imported_dlls_count":92,"injected_processes_count":0,"mutex_created_count":32,"process_count":11,"registry_keys_created_count":33,"registry_keys_deleted_count":0,"registry_keys_modified_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":33,"script_calls_count":0,"spawned_processes_count":11}},"all_analysis_status":{"fastscan_status":"SUCCESS","qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS"},"detections":{"attributions":{"malware_families":[{"sources":[{"report_id":"","report_type":"quickscan"}],"value":"Trojan/PS.Runner"}]},"av_detections":{"engines":{"ahnlab":{"data_source":"MetaDefender","name":"AhnLab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"antiy":{"data_source":"MetaDefender","name":"Antiy","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"aurora":{"data_source":"MetaDefender","name":"Aurora","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"avira":{"data_source":"MetaDefender","name":"Avira","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"TR/SNH","verdict":"malicious"},"bitdefender":{"data_source":"MetaDefender","name":"Bitdefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"clamav":{"data_source":"MetaDefender","name":"ClamAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"cmc":{"data_source":"MetaDefender","name":"CMC","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"emsisoft":{"data_source":"MetaDefender","name":"Emsisoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"eset":{"data_source":"MetaDefender","name":"ESET","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"filseclab":{"data_source":"MetaDefender","name":"Filseclab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"gridinsoft":{"data_source":"MetaDefender","name":"Gridinsoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"huorong":{"data_source":"MetaDefender","name":"Huorong","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan/PS.Runner.aj","verdict":"malicious"},"k7":{"data_source":"MetaDefender","name":"K7","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"lionic":{"data_source":"MetaDefender","name":"Lionic","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"nanoav":{"data_source":"MetaDefender","name":"NANOAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"netgate":{"data_source":"MetaDefender","name":"NETGATE","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"rocketcyber":{"data_source":"MetaDefender","name":"RocketCyber","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"sentinelone":{"data_source":"MetaDefender","name":"SentinelOne","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"sophos":{"data_source":"MetaDefender","name":"Sophos","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"tachyon":{"data_source":"MetaDefender","name":"TACHYON","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"trellix":{"data_source":"MetaDefender","name":"Trellix","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"varist":{"data_source":"MetaDefender","name":"Varist","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"viritexplorer":{"data_source":"MetaDefender","name":"Vir.IT eXplorer","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.PS.Agent.JND","verdict":"malicious"},"virusblokada":{"data_source":"MetaDefender","name":"VirusBlokAda","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"xcitium":{"data_source":"MetaDefender","name":"Xcitium","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"zillya":{"data_source":"MetaDefender","name":"Zillya!","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"}}},"incidents":[{"details":[{"detail":"Spawns many processes"}],"details_count":1,"name":"Persistence","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]}],"mitre_attacks":[{"attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Execution Guardrails"},{"attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Persistence","technique":"Component Object Model Hijacking"},{"attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Access Token Manipulation"},{"attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"System Checks"},{"attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Timestomp"},{"attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Opens file with deletion access rights"},{"type":"informative","value":"Marks file for deletion"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File Deletion"},{"attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Discovery","technique":"Query Registry"},{"attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Information Discovery"},{"attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"malicious","value":"Executes powershell requesting to bypass execution policy"},{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Scripts code detected via AMSI (Antimalware Scan Interface)"},{"type":"informative","value":"Executes a PowerShell script"},{"type":"informative","value":"Executes PowerShell with command line"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Execution","technique":"PowerShell"},{"attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Execution","technique":"Inter-Process Communication"},{"attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Persistence","technique":"Modify Registry"},{"attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection"},{"attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Disable or Modify Tools"},{"attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Mutual Exclusion"},{"attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Discovery","technique":"Software Discovery"},{"attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Encrypted Channel"},{"attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution (Powershell command string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Time Based Checks"},{"attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Discovery","technique":"Application Window Discovery"},{"attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Collection","technique":"Data from Local System"},{"attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Impact","technique":"Data Manipulation"},{"attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Execution","technique":"Command and Scripting Interpreter"},{"attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Persistence","technique":"Windows Service"},{"attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Persistence","technique":"Boot or Logon Autostart Execution"},{"attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"suspicious","value":"Writes data to a remote process"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Injection"},{"attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information"},{"attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Masquerading"},{"attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets"},{"attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access recent files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Discovery","technique":"File and Directory Discovery"},{"attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion"},{"attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Execution","technique":"Native API"},{"attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Execution","technique":"Shared Modules"},{"attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"ListPlanting"},{"attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Location Discovery"},{"attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Service Discovery"},{"attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Mail Protocols"},{"attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Ingress Tool Transfer"},{"attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking"},{"attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation"},{"attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Match Legitimate Resource Name or Location"},{"attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Discovery","technique":"Local Storage Discovery"},{"attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Proxy"},{"attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Impact","technique":"Service Stop"},{"attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Reflective Code Loading"},{"attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Owner/User Discovery"},{"attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Language Discovery"},{"attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Lateral Movement","technique":"Lateral Tool Transfer"},{"attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Collection","technique":"Email Collection"},{"attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Application Layer Protocol"},{"attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Calls an API typically used to import asymmetric cryptographic keys into a CSP"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Asymmetric Cryptography"},{"attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"},{"type":"informative","value":"Calls an API typically used to import cryptographic keys into a CSP"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Impact","technique":"Data Encrypted for Impact"},{"attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Calls an API typically used to acquire handle to a key container within a CSP"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information"},{"attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Credential Access","technique":"OS Credential Dumping"},{"attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}],"tactic":"Discovery","technique":"Process Discovery"}],"rule_matches":{},"sandbox_signatures":[{"category":"Cryptographic Related","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Able to import cryptographic keys (seen in ransomware)\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to import cryptographic keys into a CSP\n Matched sigs: Reads the cryptographic machine GUID","id":"summary-28","level":"informative","mitre_attack_id":"T1027","name":"Shows ability to obfuscate file or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00001880)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00001880)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00002420)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00002508)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00003336)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00005180)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00006388)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00007240)","id":"api-148","level":"informative","mitre_attack_id":"T1033","name":"Calls an API typically used to retrieve account information for specified SID","origin":"API Call","relevance":3,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$23","id":"api-55","level":"informative","mitre_attack_id":"T1083","name":"Touches files in the Windows directory","origin":"API Call","relevance":7,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","id":"api-173","level":"informative","mitre_attack_id":"T1083","name":"Tries to access Powershell profile file","origin":"API Call","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$24","id":"api-126","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp\")","id":"string-164","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve the fully qualified path of module (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"System Security","description":"\"powershell.exe\" opened \"\\Device\\KsecDD\"","id":"api-37","level":"informative","mitre_attack_id":"T1068","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","origin":"API Call","relevance":10,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00001880)","id":"api-296","level":"informative","mitre_attack_id":"T1497","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","origin":"API Call","relevance":3,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp\")","id":"string-310","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to load modules (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00001880)","id":"api-141","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve computer name","origin":"API Call","relevance":2,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$25","id":"string-85","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to enumerate process and/or its information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"System Security","description":"$26","id":"registry-19","level":"informative","mitre_attack_id":"T1112","name":"Modifies Software Policy Settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00003336.00000000.190001.C11AA000.00000002.mdmp\")","id":"string-345","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to disable/close registry key (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at 6A9A0000","id":"module-3","level":"informative","mitre_attack_id":"T1129","name":"Loads the .NET runtime environment","origin":"Loaded Module","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 98C70000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 97BB0000","id":"module-9","level":"informative","mitre_attack_id":"T1027","name":"Loads the Bcrypt module DLL","origin":"Loaded Module","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$27","id":"api-102","level":"informative","mitre_attack_id":"T1083","name":"Calls an API typically used for searching a directory for files","origin":"API Call","relevance":5,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"System Destruction","description":"\"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF2cc03c.TMP\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_moqgv5wo.5k0.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_jeopktii.ezz.psm1\" for deletion","id":"api-26","level":"informative","mitre_attack_id":"T1070.004","name":"Marks file for deletion","origin":"API Call","relevance":10,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00003336.00000000.190001.7AB42000.00000002.mdmp\")","id":"string-92","level":"informative","mitre_attack_id":"T1055","name":"Able to inject code into another process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00001880)","id":"api-297","level":"informative","mitre_attack_id":"T1003","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","origin":"API Call","relevance":3,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00000656.00000000.192598.90030000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002420.00000000.188679.2E6C0000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002508.00000000.189350.7E020000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00003192.00000000.193899.FE6B0000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00003336.00000000.190001.151E0000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00005180.00000000.190651.72C80000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00005284.00000000.193248.167F0000.00000004.mdmp\")","id":"string-868","level":"informative","mitre_attack_id":"T1558","name":"Able to access credential file using Kerberos","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found registry query API: \"RegQueryValueExW\" in \"00000000-00003336.00000000.190001.C11AA000.00000002.mdmp\"\n Found registry query API: \"RegGetValueW\" in \"00000000-00003336.00000000.190001.C11AA000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00003336.00000000.190001.C11AA000.00000002.mdmp\"\n Found registry query API: \"RegEnumKeyExW\" in \"00000000-00003336.00000000.190001.C11AA000.00000002.mdmp\"","id":"string-229","level":"informative","mitre_attack_id":"T1012","name":"Able to query registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp\")","id":"string-535","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to write files (API string)","origin":"File/Memory","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$28","id":"api-0","level":"suspicious","mitre_attack_id":"T1055","name":"Writes data to a remote process","origin":"API Call","relevance":6,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"External Systems","description":"3/26 Antivirus vendors marked sample as malicious (11% detection rate)","id":"avtest-0","level":"suspicious","name":"Sample was identified as malicious by at least one Antivirus engine","origin":"External System","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp\")","id":"string-318","level":"informative","mitre_attack_id":"T1055.001","name":"Contains ability to load/free library (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found string \"function Format-Hex\" (Indicator: \"Format-Hex\"; Source: \"00000000-00005180.00000000.190651.74FD0000.00000004.mdmp\")\n Found string \"# valid values (supported on all paltforms where Format-Hex is avaliI\" (Indicator: \"Format-Hex\"; Source: \"00000000-00005180.00000000.190651.74FD0000.00000004.mdmp\")\n Found string \"80 | format-hex\" (Indicator: \"Format-Hex\"; Source: \"00000000-00005180.00000000.190651.74FD0000.00000004.mdmp\")","id":"string-366","level":"informative","mitre_attack_id":"T1565","name":"Contains ability to modify data representation (Powershell command string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$29","id":"api-9","level":"informative","mitre_attack_id":"T1057","name":"Queries process information","origin":"API Call","relevance":4,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$2a","id":"api-234","level":"informative","mitre_attack_id":"T1573.002","name":"Calls an API typically used to import asymmetric cryptographic keys into a CSP","origin":"API Call","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"1880\" - (UID: 00000000-00001880)","id":"api-146","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used to determine if process is running under WOW64","origin":"API Call","relevance":3,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","id":"registry-1","level":"informative","mitre_attack_id":"T1082","name":"Reads the cryptographic machine GUID","origin":"Registry Access","relevance":5,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\27748148BBE67A43CDBFEC6C3784862CE134E6EA\"; Key: \"BLOB\")","id":"registry-17","level":"informative","mitre_attack_id":"T1112","name":"Accesses System Certificates Settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\USER PROFILE\"; Key: \"LANGUAGES\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\GEO\"; Key: \"NATION\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","id":"registry-25","level":"informative","mitre_attack_id":"T1082","name":"Reads information about supported languages","origin":"Registry Access","relevance":3,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"Process \"powershell.exe\" with commandline \"-f \"C:\\\\6f32089bf35798e207feb07417b06a73aac6f27d3ca30a3f6963c90b63a5e303.bin.ps1\"\" (UID: 00000000-00001880)","id":"target-401","level":"informative","mitre_attack_id":"T1059.001","name":"Executes a PowerShell script","origin":"Monitored Target","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" queries basic process information of the \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 1880)","id":"api-235","level":"informative","mitre_attack_id":"T1057","name":"Queries basic information of the specified process","origin":"API Call","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"Found string \"function New-TemporaryFile\" (Indicator: \"New-TemporaryFile\"; Source: \"00000000-00005180.00000000.190651.74FD0000.00000004.mdmp\")\n Found string \"function New-Guid\" (Indicator: \"New-Guid\"; Source: \"00000000-00005180.00000000.190651.74FD0000.00000004.mdmp\")","id":"string-396","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to create/modify Windows services (Powershell command string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"System Security","description":"$2b","id":"registry-136","level":"informative","mitre_attack_id":"T1112","name":"Writes registry keys","origin":"Registry Access","relevance":3,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002420.00000000.188679.48C19000.00000004.mdmp\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00005180.00000000.190651.74FD0000.00000004.mdmp\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00005284.00000000.193248.30B00000.00000004.mdmp\")","id":"string-212","level":"informative","mitre_attack_id":"T1140","name":"Contains ability to perform decryption (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$2c","id":"api-161","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (non-executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\70GB5IE8B7M98419CZQI.TEMP\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\70GB5IE8B7M98419CZQI.temp\"\n \"powershell.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF2cc03c.TMP\"","id":"api-169","level":"informative","mitre_attack_id":"T1083","name":"Tries to access recent files","origin":"API Call","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$2d","id":"registry-177","level":"informative","mitre_attack_id":"T1012","name":"Opens registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00003192.00000000.193899.FE6B0000.00000004.mdmp\")\n Found reference to API \"5580514498,6132,3186,,AdjustTokenPrivileges,advapi32.dll,\"00:49:36.390\",RX=0,PX=0\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00005180.00000000.190651.74FD0000.00000004.mdmp\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00005284.00000000.193248.167F0000.00000004.mdmp\")","id":"string-77","level":"informative","mitre_attack_id":"T1134","name":"Contains ability to modify access token privileges (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$2e","id":"api-12","level":"informative","mitre_attack_id":"T1012","name":"Monitors specific registry key for changes","origin":"API Call","relevance":4,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution (Powershell command string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess","id":"summary-29","level":"informative","mitre_attack_id":"T1480","name":"Shows ability to use execution guardrails","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Network Related","description":"$2f","id":"string-14","level":"informative","mitre_attack_id":"T1071","name":"Found potential IP address in binary/memory","origin":"File/Memory","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00000656.00000000.192598.AA3C0000.00000004.mdmp\")\n Found api reference \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002420.00000000.188679.48C19000.00000004.mdmp\")\n Found api reference \"CryptExportKey\" (Indicator: \"CryptExportKey\"; Source: \"00000000-00002420.00000000.188679.48C19000.00000004.mdmp\")\n Found api reference \"CryptExportKey\" (Indicator: \"CryptExportKey\"; Source: \"00000000-00003192.00000000.193899.FF6E0000.00000004.mdmp\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00005180.00000000.190651.74FD0000.00000004.mdmp\")\n Found api reference \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00005180.00000000.190651.74FD0000.00000004.mdmp\")\n Found api reference \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00005284.00000000.193248.30B00000.00000004.mdmp\")","id":"string-602","level":"informative","mitre_attack_id":"T1573","name":"Able to use Microsoft's Enhanced Cryptographic Provider","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00001880)\n \"powershell.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00001880)\n \"powershell.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00001880)","id":"api-294","level":"informative","mitre_attack_id":"T1082","name":"Attempts to call APIs to gather system and hardware detail","origin":"API Call","relevance":3,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 9B0B0000","id":"module-10","level":"informative","mitre_attack_id":"T1129","name":"Loads the RPC (Remote Procedure Call) module DLL","origin":"Loaded Module","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"\"19001a000000000040c7b798fb7f0000@ntdll.dll\"\n \"220023000000000018c7b798fb7f0000@ntdll.dll\"","id":"api-8","level":"informative","mitre_attack_id":"T1129","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","origin":"API Call","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"$30","id":"target-103","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes that are not known child processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00001880)","id":"api-327","level":"informative","mitre_attack_id":"T1680","name":"Calls an API typically used to enumerate Windows drive types","origin":"API Call","relevance":7,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"System Destruction","description":"\"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\70GB5IE8B7M98419CZQI.temp\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF2cc03c.TMP\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_moqgv5wo.5k0.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_jeopktii.ezz.psm1\" with delete access","id":"api-25","level":"informative","mitre_attack_id":"T1070.004","name":"Opens file with deletion access rights","origin":"API Call","relevance":7,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"System Security","description":"$31","id":"target-29","level":"malicious","mitre_attack_id":"T1059.001","name":"Executes powershell requesting to bypass execution policy","origin":"Monitored Target","relevance":5,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$32","id":"api-228","level":"informative","mitre_attack_id":"T1027","name":"Calls an API typically used to acquire handle to a key container within a CSP","origin":"API Call","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$33","id":"api-233","level":"informative","mitre_attack_id":"T1486","name":"Calls an API typically used to import cryptographic keys into a CSP","origin":"API Call","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00002508.00000000.189350.7E020000.00000004.mdmp\n Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00003336.00000000.190001.2F5E0000.00000004.mdmp","id":"string-327","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve operating system version","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" writes file \"\\device\\namedpipe\\srvsvc\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\70gb5ie8b7m98419czqi.temp\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_moqgv5wo.5k0.ps1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_jeopktii.ezz.psm1\"\n \"powershell.exe\" writes file \"%appdata%\\microsoft\\windows\\recent\\customdestinations\\70gb5ie8b7m98419czqi.temp\"\n \"powershell.exe\" writes file \"%temp%\\__psscriptpolicytest_moqgv5wo.5k0.ps1\"\n \"powershell.exe\" writes file \"%temp%\\__psscriptpolicytest_jeopktii.ezz.psm1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\powershell\\startupprofiledata-noninteractive\"\n \"powershell.exe\" writes file \"%localappdata%\\microsoft\\windows\\powershell\\startupprofiledata-noninteractive\"","id":"api-242","level":"informative","name":"Writes files","origin":"API Call","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","id":"registry-35","level":"informative","mitre_attack_id":"T1082","name":"Reads the active computer name","origin":"Registry Access","relevance":5,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003336.00000000.190001.7AB42000.00000002.mdmp\")","id":"string-272","level":"informative","mitre_attack_id":"T1057","name":"Able to retrieve/open a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"file/memory contains long string with (Indicator: \"powershell_ise.exe\"; File: \"70GB5IE8B7M98419CZQI.temp\")\n Found string \"Write-Error -Message\" (Indicator: \"Write-Error\"; Source: \"00000000-00005180.00000000.190651.74FD0000.00000004.mdmp\")\n Found string \"Write-Error -ErrorRecord $errorRecord\" (Indicator: \"Write-Error\"; Source: \"00000000-00005180.00000000.190651.74FD0000.00000004.mdmp\")\n Found string \"Write-Output -InputObject $byteCollect\" (Indicator: \"Write-Output\"; Source: \"00000000-00005180.00000000.190651.74FD0000.00000004.mdmp\")","id":"string-187","level":"informative","mitre_attack_id":"T1059.001","name":"Observed Powershell command strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"StartupProfileData-NonInteractive\" has type \"data\"- Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00007240]","id":"binary-0","level":"informative","mitre_attack_id":"T1105","name":"Dropped files","origin":"Binary File","relevance":3,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"System Security","description":"$34","id":"string-474","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to access device drivers","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001880-00000C2B-1907954588\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001880-00000C2B-1908704724\")","id":"string-659","level":"informative","mitre_attack_id":"T1497.001","name":"Able to identify virtual environment by using API string","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"$35","id":"api-175","level":"informative","mitre_attack_id":"T1129","name":"Calls an API typically used to load libraries","origin":"API Call","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Network Related","description":"$36","id":"string-899","level":"informative","mitre_attack_id":"T1071","name":"Contains references to network communication API (string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00001880)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","id":"api-135","level":"informative","mitre_attack_id":"T1033","name":"Calls an API typically used to retrieve user name","origin":"API Call","relevance":2,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Dropped file: \"70GB5IE8B7M98419CZQI.temp\" - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\70GB5IE8B7M98419CZQI.temp]- [targetUID: 00000000-00001880]\n Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00007240]","id":"binary-37","level":"informative","mitre_attack_id":"T1036","name":"Drops files inside appdata directory","origin":"Binary File","relevance":3,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" queried ProcessMitigationPolicy","id":"api-323","level":"suspicious","mitre_attack_id":"T1497.001","name":"Queries process mitigation policy via NtQueryInformationProcess","origin":"API Call","relevance":3,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00001880)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00001880)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00001880)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00001880)","id":"api-140","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to find a resource in a module","origin":"API Call","relevance":3,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","id":"api-108","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve information about the current system","origin":"API Call","relevance":3,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"System Security","description":"\"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")\n \"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LANMANWORKSTATION\\PARAMETERS\"; Key: \"RPCCACHETIMEOUT\"; Value: \"\")\n \"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\WINDOWSPOWERSHELL\\V1.0\\POWERSHELL.EXE\"; Value: \"\")\n \"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DIAGLEVEL\"; Value: \"\")\n \"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DIAGMATCHANYMASK\"; Value: \"\")","id":"registry-173","level":"informative","mitre_attack_id":"T1007","name":"Queries services related registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp\")\n Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00003336.00000000.190001.C11AA000.00000002.mdmp\")\n Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObjectEx\"; Source: \"00000000-00003336.00000000.190001.C11AA000.00000002.mdmp\")","id":"string-226","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Process \"powershell.exe\" executed suspicious script","id":"amsi-0","level":"informative","mitre_attack_id":"T1059","name":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)","origin":"Windows Antimalware Scan Interface","relevance":3,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00001880-00000C2B-1906991551\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00001880-00000C2B-1906992071\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001880-00000C2B-1908895194\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001880-00000C2B-1908895219\")","id":"string-908","level":"informative","mitre_attack_id":"T1033","name":"Able to query security token membership for user discovery (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00003336.00000000.190001.C11AA000.00000002.mdmp\")\n Found reference to API \"7890494782,6132,3152,,GetLocaleInfoW,kernel32.dll,\"00:49:37.343\",RX=0,PX=0\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005180.00000000.190651.74FD0000.00000004.mdmp\")","id":"string-201","level":"informative","mitre_attack_id":"T1614","name":"Able to query system locale information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","id":"api-264","level":"informative","mitre_attack_id":"T1055.003","name":"Creates a thread in a self process","origin":"API Call","relevance":3,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003336.00000000.190001.7AB42000.00000002.mdmp\")\n Found reference to API \"6262462482,5236,3024,,RtlGetVersion,NTDLL.dll,\"00:49:36.671\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00005180.00000000.190651.74FD0000.00000004.mdmp\")\n Found reference to API \"6254908332,5236,3025,,RtlGetNtProductType,NTDLL.dll,\"00:49:36.671\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00005180.00000000.190651.74FD0000.00000004.mdmp\")\n Found reference to API \"8700398378,5176,3025,,RtlGetNtProductType,NTDLL.dll,\"00:49:37.687\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00005180.00000000.190651.74FD0000.00000004.mdmp\")\n Found reference to API \"8700475864,5176,3024,,RtlGetVersion,NTDLL.dll,\"00:49:37.687\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00005180.00000000.190651.74FD0000.00000004.mdmp\")","id":"string-86","level":"informative","mitre_attack_id":"T1082","name":"Able to discover operating system information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001880-00000C2B-1907954588\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001880-00000C2B-1908704724\")","id":"string-907","level":"informative","mitre_attack_id":"T1057","name":"Able to enumerate system processes using native API","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$37","id":"registry-172","level":"informative","mitre_attack_id":"T1012","name":"Queries registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00003336.00000000.190001.7AB42000.00000002.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00003336.00000000.190001.C11AA000.00000002.mdmp\"","id":"string-89","level":"informative","mitre_attack_id":"T1082","name":"Able to retrieve information about the current system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","id":"registry-13","level":"informative","mitre_attack_id":"T1082","name":"Reads the windows installation date","origin":"Registry Access","relevance":3,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00003336.00000000.190001.C11AA000.00000002.mdmp\")","id":"string-315","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create/open files (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"$38","id":"mutant-0","level":"informative","mitre_attack_id":"T1480.002","name":"Creates mutants","origin":"Created Mutant","relevance":3,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"Pattern match: \"premium-server@thawte.com\"","id":"string-63","level":"informative","mitre_attack_id":"T1114","name":"Found E-Mail address in binary/memory","origin":"File/Memory","relevance":3,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Network Related","description":"$39","id":"memorydump-2","level":"informative","mitre_attack_id":"T1071","name":"Found potential URLs in memory dumps","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","id":"api-103","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used for taking snapshot of the specified processes","origin":"API Call","relevance":3,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00001880)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00002420)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00002508)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00003336)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00005180)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00006388)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00007240)","id":"api-152","level":"informative","mitre_attack_id":"T1010","name":"Calls an API typically used to enumerate active windows","origin":"API Call","relevance":3,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134239457826299808.1880.DefaultAppDomain.powershell\" - (UID: 00000000-00001880)","id":"api-138","level":"informative","mitre_attack_id":"T1570","name":"Calls an API typically used to create an instance of a named pipe","origin":"API Call","relevance":3,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"details too long to display","id":"api-176","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to retrieve function addresses","origin":"API Call","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"$3a","id":"string-101","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute Windows APIs","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"$3b","id":"api-22","level":"informative","mitre_attack_id":"T1129","name":"Fails to load modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$3c","id":"string-207","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to retrieve file and directory information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp\")","id":"string-205","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"$3d","id":"string-120","level":"informative","mitre_attack_id":"T1012","name":"Contains registry location strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"Found string - \\\\.\\pipe\\PSHost.134239457826299808.1880.DefaultAppDomain.powershell","id":"string-146","level":"informative","mitre_attack_id":"T1559","name":"Found named pipe like strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"$3e","id":"memorydump-10","level":"informative","mitre_attack_id":"T1012","name":"Found registry location strings in memory","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"$3f","id":"target-25","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Network Related","description":"Observed email domain:\"pmx.9\" [Source: 00000000-00002420.00000000.188679.2E6C0000.00000004.mdmp\n 00000000-00002420.00000000.188679.48B40000.00000004.mdmp]\n Observed email domain:\"mx.9\" [Source: 00000000-00002420.00000000.188679.2E6C0000.00000004.mdmp]","id":"string-169","level":"informative","mitre_attack_id":"T1071.003","name":"Found mail related domain names","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00003336.00000000.190001.7AB42000.00000002.mdmp\")","id":"string-82","level":"informative","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","id":"registry-26","level":"informative","mitre_attack_id":"T1614.001","name":"Reads the windows installation language","origin":"Registry Access","relevance":2,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$40","id":"api-222","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve OS information","origin":"API Call","relevance":2,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp\")","id":"string-249","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to retrieve file time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$41","id":"string-171","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the OS information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00003336.00000000.190001.7AB42000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00003336.00000000.190001.7AB42000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00003336.00000000.190001.7AB42000.00000002.mdmp\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00003336.00000000.190001.C11AA000.00000002.mdmp\")","id":"string-550","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to find and load resources of specific modules (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 7D290000","id":"module-8","level":"informative","mitre_attack_id":"T1562.001","name":"Loads the AMSI (Antimalware Scan Interface) DLL","origin":"Loaded Module","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"$42","id":"api-6","level":"informative","mitre_attack_id":"T1083","name":"Reads configuration files (.ini files)","origin":"API Call","relevance":4,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp\")","id":"string-316","level":"informative","mitre_attack_id":"T1489","name":"Contains ability to terminate a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00000656.00000000.192598.AA3C0000.00000004.mdmp\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00005180.00000000.190651.74FD0000.00000004.mdmp\")","id":"string-603","level":"informative","mitre_attack_id":"T1486","name":"Able to import cryptographic keys (seen in ransomware)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001880)","id":"api-124","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get product type","origin":"API Call","relevance":3,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -ExecutionPolicy Bypass -file \"%LOCALAPPDATA%\\ow\\LocalLo\" - (UID: 00000000-00001880)","id":"api-128","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to create a process","origin":"API Call","relevance":5,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"$43","id":"registry-72","level":"informative","mitre_attack_id":"T1546.015","name":"Overview of unique CLSIDs touched in registry","origin":"Registry Access","relevance":3,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"Process \"powershell.exe\" (UID: 00000000-00002420) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\"\"\n Process \"powershell.exe\" (UID: 00000000-00002420) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"\n Process \"powershell.exe\" (UID: 00000000-00002420) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","id":"target-67","level":"informative","mitre_attack_id":"T1057","name":"Process launched with changed environment","origin":"Monitored Target","relevance":10,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","id":"registry-20","level":"informative","mitre_attack_id":"T1012","name":"Reads Windows Trust Settings","origin":"Registry Access","relevance":5,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$44","id":"api-125","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get system version information","origin":"API Call","relevance":3,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","id":"registry-78","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to read software policies","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_moqgv5wo.5k0.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_jeopktii.ezz.psm1\"","id":"api-267","level":"informative","mitre_attack_id":"T1005","name":"Writes files in a temp directory","origin":"API Call","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Network Related","description":"$45","id":"string-3","level":"informative","mitre_attack_id":"T1071","name":"Found potential URL in binary/memory","origin":"File/Memory","relevance":3,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$46","id":"registry-215","level":"informative","mitre_attack_id":"T1497","name":"Observed a high volume of repeated registry API calls (API Hammering)","origin":"Registry Access","relevance":7,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00003336.00000000.190001.C11AA000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00003336.00000000.190001.C11AA000.00000002.mdmp\")","id":"string-143","level":"informative","mitre_attack_id":"T1614.001","name":"Able to retrieve system language (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"\"6f32089bf35798e207feb07417b06a73aac6f27d3ca30a3f6963c90b63a5e303.bin\" was detected as \"plain text\" and name: \"Format\"","id":"static-157","level":"informative","mitre_attack_id":"T1027","name":"Matched Compiler/Packer signature (DIE)","origin":"Static Parser","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Remote Access Related","description":"$47","id":"string-531","level":"informative","mitre_attack_id":"T1090","name":"Contains references to RPC protocol sequence strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$48","id":"string-57","level":"informative","mitre_attack_id":"T1027","name":"Contains CRYPTO related strings","origin":"File/Memory","relevance":3,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00001880-00000C2B-1908355139\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00001880-00000C2B-1908355166\")","id":"string-721","level":"informative","mitre_attack_id":"T1055.015","name":"Able to visualize and control listed components (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$49","id":"api-243","level":"informative","mitre_attack_id":"T1083","name":"Reads files","origin":"API Call","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\ATL.DLL\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\atl.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MSCOREE.DLL\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\mscoree.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\ole32.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\oleaut32.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FLTLIB.DLL\"","id":"api-263","level":"informative","mitre_attack_id":"T1083","name":"Touches files","origin":"API Call","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"7728724402,5236,3216,,LookupAccountSidW,advapi32.dll,\"00:49:37.281\",RX=0,PX=0\" (Indicator: \"LookupAccountSid\"; Source: \"00000000-00005180.00000000.190651.74FD0000.00000004.mdmp\")","id":"string-121","level":"informative","mitre_attack_id":"T1033","name":"Able to retrieve usernames and/or user information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp\")","id":"string-427","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve a module handle (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 1880)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 2420)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 2508)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 3336)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 5180)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 6388)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 7240)","id":"api-1","level":"suspicious","mitre_attack_id":"T1562.001","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","origin":"API Call","relevance":10,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"$4a","id":"api-7","level":"informative","mitre_attack_id":"T1129","name":"Loads modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00001880)","id":"api-110","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to find and list the Windows drive types","origin":"API Call","relevance":10,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '2462211571713', 'hResInfo': '2462211572960'}\" (UID: 00000000-00001880)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2462211571713', 'hResInfo': '2462211572992'}\" (UID: 00000000-00001880)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2462211571713', 'hResInfo': '2462211573008'}\" (UID: 00000000-00001880)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2462211571713', 'hResInfo': '2462211572976'}\" (UID: 00000000-00001880)","id":"api-139","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to load a resource in memory","origin":"API Call","relevance":3,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"DONTUSEDESKTOPCHANGEROUTER\")","id":"registry-55","level":"informative","mitre_attack_id":"T1518","name":"Reads the registry for installed applications","origin":"Registry Access","relevance":10,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"$4b","id":"target-486","level":"informative","mitre_attack_id":"T1059.001","name":"Executes PowerShell with command line","origin":"Monitored Target","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"$4c","id":"string-170","level":"informative","name":"Possibly uses system binaries (Windows LOLbins)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp\")","id":"string-317","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve address of exported function from a DLL (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00001880)","id":"api-179","level":"informative","mitre_attack_id":"T1562.001","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","origin":"API Call","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"System Security","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001880)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002420)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002508)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003336)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005180)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006388)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007240)","id":"api-111","level":"informative","mitre_attack_id":"T1134","name":"Calls an API typically used to enable or disable privileges in the specified access token","origin":"API Call","relevance":3,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"System Security","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00003336.00000000.190001.7AB42000.00000002.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00003336.00000000.190001.7AB42000.00000002.mdmp\")","id":"string-748","level":"informative","mitre_attack_id":"T1562.001","name":"Contains ability to disable Windows Defender using PowerShell","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$4d","id":"target-14","level":"malicious","mitre_attack_id":"T1057","name":"Spawns many processes","origin":"Monitored Target","relevance":8,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$4e","id":"string-138","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to use Cryptographic classes","origin":"File/Memory","relevance":2,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 75920000","id":"module-7","level":"informative","mitre_attack_id":"T1620","name":"Loads the CLR Loader DLL","origin":"Loaded Module","sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"$4f","id":"string-625","level":"informative","mitre_attack_id":"T1083","name":"References Windows file paths for DLLs (possible dropped files)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" trying to access LNK file \"C:\\%AppData%\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"C:\\Windows\\%APPDATA%\\MICROSOFT\\WINDOWS\\START MENU\\PROGRAMS\\WINDOWS POWERSHELL\\WINDOWS POWERSHELL.LNK\"\n \"powershell.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"%WINDIR%\\%APPDATA%\\MICROSOFT\\WINDOWS\\START MENU\\PROGRAMS\\WINDOWS POWERSHELL\\WINDOWS POWERSHELL.LNK\"\n \"powershell.exe\" trying to access LNK file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk\"","id":"api-203","level":"informative","mitre_attack_id":"T1083","name":"Tries to access LNK files (Windows shortcut)","origin":"API Call","relevance":3,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"System Security","description":"$50","id":"registry-67","level":"informative","mitre_attack_id":"T1543.003","name":"Creates or modifies windows services","origin":"Registry Access","relevance":10,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"file/memory contains long string with (Indicator: \"Start-Sleep\"; File: \"6f32089bf35798e207feb07417b06a73aac6f27d3ca30a3f6963c90b63a5e303.bin\")\n Found string \"Start-Sleep -Seconds (5) ;\" (Indicator: \"Start-Sleep\"; File: \"6f32089bf35798e207feb07417b06a73aac6f27d3ca30a3f6963c90b63a5e303.bin\")\n Found string \"};Start-Sleep -Seconds (30);\" (Indicator: \"Start-Sleep\"; File: \"6f32089bf35798e207feb07417b06a73aac6f27d3ca30a3f6963c90b63a5e303.bin\")","id":"string-397","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to delay execution (Powershell command string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00001880)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00002420)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00002508)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00003336)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00005180)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00006388)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00007240)","id":"api-147","level":"informative","mitre_attack_id":"T1614","name":"Calls an API typically used to retrieve local language","origin":"API Call","relevance":3,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00003336.00000000.190001.C11AA000.00000002.mdmp\")","id":"string-450","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to determine if process is running under WOW64 (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$51","id":"api-39","level":"informative","mitre_attack_id":"T1082","name":"Queries volume information","origin":"API Call","relevance":8,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00003336.00000000.190001.7AB42000.00000002.mdmp, 00000000-00003336.00000000.190001.C11AA000.00000002.mdmp\")","id":"string-319","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to set/get the last-error code for a calling thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" create file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" create file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" create file \"%WINDIR%\\System32\\CatRoot\"\n \"powershell.exe\" create file \"%WINDIR%\\System32\\catroot2\"","id":"api-324","level":"informative","mitre_attack_id":"T1036.005","name":"Creates file(s) in System32 or SysWOW64 directory","origin":"API Call","relevance":5,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"9705079426,1680,3119,,FindNextFileW,kernel32.dll,\"00:49:07.312\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00002420.00000000.188679.48B40000.00000004.mdmp\")\n Found reference to API \"9138260986,4056,3119,,FindNextFileW,kernel32.dll,\"00:49:27.703\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00003336.00000000.190001.2F5E0000.00000004.mdmp\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00003336.00000000.190001.C11AA000.00000002.mdmp\")","id":"string-83","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to enumerate files on disk (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Script name: C:\\6f32089bf35798e207feb07417b06a73aac6f27d3ca30a3f6963c90b63a5e303.bin.ps1 contents: \nഀ਀圀栀椀氀攀⠀ ␀琀爀甀攀 ⤀笀ഀ਀匀琀愀爀琀ⴀ匀氀攀攀瀀 ⴀ匀攀挀漀渀搀猀 ⠀㔀⤀ 㬀ഀ਀ഀ਀琀爀礀笀ഀ਀䌀㨀尀圀椀渀搀漀眀猀尀匀礀猀琀攀洀㌀㈀尀圀椀渀搀漀眀猀倀漀眀攀爀匀栀攀氀氀尀瘀㄀⸀　尀瀀漀眀攀爀猀栀攀氀氀⸀攀砀攀 ⴀ䔀砀攀挀甀琀椀漀渀倀漀氀椀挀礀䈀礀瀀愀猀猀 ⴀ昀椀氀攀 ✀䌀㨀尀唀猀攀爀猀尀䄀搀洀椀渀尀䄀瀀瀀䐀愀琀愀尀䰀漀挀愀氀䰀漀眀尀䰀漀挀愀氀䰀漀眀圀椀渀搀漀眀猀尀倀爀漀最爀愀洀刀甀氀攀猀尀倀爀漀最爀愀洀刀甀氀攀猀一嘀䤀䐀䔀伀尀倀爀漀最爀愀洀刀甀氀攀猀尀倀爀漀最爀愀洀刀甀氀攀猀一嘀䤀䐀䔀伀尀猀欀樀砀欀⸀瀀猀㄀✀ഀ਀紀 ഀ਀挀愀琀挀栀笀紀ഀ਀ഀ਀紀㬀匀琀愀爀琀ⴀ匀氀攀攀瀀 ⴀ匀攀挀漀渀搀猀 ⠀㌀　⤀㬀\n\n","id":"amsi-2","level":"informative","mitre_attack_id":"T1059.001","name":"Scripts code detected via AMSI (Antimalware Scan Interface)","origin":"Windows Antimalware Scan Interface","relevance":5,"sources":[{"report_id":"6a10971c5870fd9bb709e931","report_type":"sandbox"}]}],"stats":{"attributions":{"campaigns_count":0,"cves_count":0,"malware_families_count":1,"threat_actors_count":0,"threat_types_count":0},"av":{"malicious_count":3,"suspicious_count":0,"total_engines":26},"mitre_attacks":{"total":53},"rule_matches":{"sigma_count":0,"suricata_count":0,"yara_count":0},"sandbox_signatures":{"informative_count":145,"malicious_count":2,"suspicious_count":4,"total":151}},"summary":{"score":58,"tags":null,"verdict":"malicious"}},"metadata":{"file_info":{"file_name":"hxhgr.ps1","file_size":320,"file_type":["powershell","ps"],"file_type_id":"ps1"},"hashes":{"imphash":"Unknown","md5":"e531bd6a89362f242fea19a920865988","sha1":"d57c6f27956ecbd1492147a1d28863a6e262fc05","sha256":"6f32089bf35798e207feb07417b06a73aac6f27d3ca30a3f6963c90b63a5e303","sha512":"b638a0e98cf0e7a2fa4f438caad0484056e717787dd97555d4ef4251ce38656fbf4b1639151dee4bda9fe91c0bac5ba3227dbc1fb8e372bad0ed70cbd16e70c3","ssdeep":"6:htdL82cTn+R9e2jInytGQO0cZAuBn2nK4sKm3ZX5d8ZX5WOmgrtH2cG:hoTn89jjInGHpc+e2qZz8ZSStzG","ssdeep_chunks":["6:htdL82c","6:tdL82cT","6:dL82cTn","6:L82cTn+","6:82cTn+R","6:2cTn+R9","6:cTn+R9e","6:Tn+R9e2","6:n+R9e2j","6:+R9e2jI","6:R9e2jIn","6:9e2jIny","6:e2jInyt","6:2jInytG","6:jInytGQ","6:InytGQO","6:nytGQO0","6:ytGQO0c","6:tGQO0cZ","6:GQO0cZA","6:QO0cZAu","6:O0cZAuB","6:0cZAuBn","6:cZAuBn2","6:ZAuBn2n","6:AuBn2nK","6:uBn2nK4","6:Bn2nK4s","6:n2nK4sK","6:2nK4sKm","6:nK4sKm3","6:K4sKm3Z","6:4sKm3ZX","6:sKm3ZX5","6:Km3ZX5d","6:m3ZX5d8","6:3ZX5d8Z","6:ZX5d8ZX","6:X5d8ZX5","6:5d8ZX5W","6:d8ZX5WO","6:8ZX5WOm","6:ZX5WOmg","6:X5WOmgr","6:5WOmgrt","6:WOmgrtH","6:OmgrtH2","6:mgrtH2c","6:grtH2cG","12:htdL82c","12:tdL82cT","12:dL82cTn","12:L82cTn+","12:82cTn+R","12:2cTn+R9","12:cTn+R9e","12:Tn+R9e2","12:n+R9e2j","12:+R9e2jI","12:R9e2jIn","12:9e2jIny","12:e2jInyt","12:2jInytG","12:jInytGQ","12:InytGQO","12:nytGQO0","12:ytGQO0c","12:tGQO0cZ","12:GQO0cZA","12:QO0cZAu","12:O0cZAuB","12:0cZAuBn","12:cZAuBn2","12:ZAuBn2n","12:AuBn2nK","12:uBn2nK4","12:Bn2nK4s","12:n2nK4sK","12:2nK4sKm","12:nK4sKm3","12:K4sKm3Z","12:4sKm3ZX","12:sKm3ZX5","12:Km3ZX5d","12:m3ZX5d8","12:3ZX5d8Z","12:ZX5d8ZX","12:X5d8ZX5","12:5d8ZX5W","12:d8ZX5WO","12:8ZX5WOm","12:ZX5WOmg","12:X5WOmgr","12:5WOmgrt","12:WOmgrtH","12:OmgrtH2","12:mgrtH2c","12:grtH2cG","6:hoTn89j","6:oTn89jj","6:Tn89jjI","6:n89jjIn","6:89jjInG","6:9jjInGH","6:jjInGHp","6:jInGHpc","6:InGHpc+","6:nGHpc+e","6:GHpc+e2","6:Hpc+e2q","6:pc+e2qZ","6:c+e2qZz","6:+e2qZz8","6:e2qZz8Z","6:2qZz8ZS","6:qZz8ZSS","6:Zz8ZSSt","6:z8ZSStz","6:8ZSStzG"]},"submissions":{"first_seen":1779470177000,"last_multi_scan":1779472156000,"last_seen":1779472156000}},"overall_status":"SUCCESS","report_ids":{"sandbox_job_ids":["6a10971c5870fd9bb709e931"]},"schema_version":"1.0.9","sha256":"6f32089bf35798e207feb07417b06a73aac6f27d3ca30a3f6963c90b63a5e303","threat_score":58,"unified_at":"2026-09-17T11:43:18.261Z","unified_at_epoch_ms":1789645398261,"verdict":"malicious"}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Trojan/PS.Runner Sample 6f32089bf357… — Score 58/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 6f32089bf357…. Malware family: Trojan/PS.Runner. Threat score 58/100. 3/26 AV engines flagged this file. 2 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/6f32089bf35798e207feb07417b06a73aac6f27d3ca30a3f6963c90b63a5e303"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan/PS.Runner Sample 6f32089bf357… — Score 58/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 6f32089bf357…. Malware family: Trojan/PS.Runner. Threat score 58/100. 3/26 AV engines flagged this file. 2 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/6f32089bf35798e207feb07417b06a73aac6f27d3ca30a3f6963c90b63a5e303"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan/PS.Runner Sample 6f32089bf357… — Score 58/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 6f32089bf357…. Malware family: Trojan/PS.Runner. Threat score 58/100. 3/26 AV engines flagged this file. 2 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L52","11",{}]]